Law note · Virginia
Virginia Consumer Data Protection Act, Attorney General enforcement
cite Va. Code Ann. ยงยง 59.1-583, 59.1-584
stage IN FORCE in force since 2023-01-01
reviewed 2026-08-27
The Virginia Attorney General has exclusive authority to enforce VCDPA. Before suing, the Attorney General must give an alleged violator 30 days' written notice identifying the specific provisions violated; this cure right carries no sunset date in the text, unlike several peer states'. The Attorney General may seek an injunction and civil penalties of up to $7,500 per violation. The chapter creates no private right of action.
What it asks of an app
- Expect VCDPA violations to be enforced exclusively by the Virginia Attorney General, never by a private plaintiff.
- Cure a noticed violation and provide a written statement of cure within 30 days of Attorney General notice to avoid an enforcement action. Unlike some peer states, Virginia's cure right carries no sunset date in the statutory text.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Virginia statute text, Title 59.1 Chapter 53, Code of Virginia