Sign in
Start free

United States

VCDPA

Virginia Consumer Data Protection Act

The VCDPA is Virginia’s comprehensive consumer privacy law, the second US state law of its kind after California. It gives Virginia residents rights over their personal data and lets them opt out of targeted advertising, the sale of personal data and certain profiling. It is enforced by the Virginia Attorney General.

Start free
Run a free scan

At a glance

Opt-out

Region
Virginia, USA
Status
In force since January 2023
Penalties
Civil penalties of up to USD 7,500 per violation, plus the Attorney General’s costs of investigating and bringing the case, including legal fees. Businesses get 30 days’ written notice and a chance to cure before the Attorney General can sue, and this right has no end date.
Who it affects
Businesses that operate in Virginia or target its residents and control or process the personal data of 100,000 or more Virginia consumers a year, or of 25,000 or more while getting more than 50% of gross revenue from selling personal data. Nonprofits are not covered.

What the VCDPA requires

  • Provide a clear privacy notice covering the categories of data processed.
  • Honour consumer opt-outs of targeted advertising, sale of data, and certain profiling.
  • Get the consumer’s consent before processing sensitive data, and do not sell precise geolocation data.
  • Respond to access, correction, deletion and portability requests within 45 days.
  • Conduct data protection assessments for high-risk processing.
  • Sign processing agreements with vendors that handle personal data.

Your site’s footer

An example

  • Privacy policy
  • Terms
  • Do Not Sell or Share My Personal Information

What the banner does here

The same opt-out mode as California: no blocking wall, a “Do Not Sell or Share My Personal Information” link on every page, and a preference centre to opt out.

How GrantCookie covers it

  • Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
  • Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
  • Opting out later. The opt-out link and preference centre are always available, so visitors can opt out or change an earlier choice at any time.

See every feature

The consent log: each row has a timestamp in UTC, a consent ID and the visitor’s choice

This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.

Related regulations

All regulations

  • CCPA

    Opt-out

    California Consumer Privacy Act

    California, USA In force since January 2020

  • CPA

    Opt-out

    Colorado Privacy Act

    Colorado, USA In force since July 2023

  • CPRA

    Opt-out

    California Privacy Rights Act

    California, USA In force since January 2023

Start free. No card, no sales call.

Scan your site, publish the banner, and move up a tier when you outgrow the free plan. Every plan is on the pricing page.

14-day trial on paid plans · Cancel any time · No card required to start

Start free
See every price