Virginia Consumer Data Protection Act (HB 2307 / SB 1392, 2021) — Profiling Opt-Out and Data Protection Assessments
Virginia · Va. Code 59.1-575 to 59.1-585 (esp. 59.1-577, 59.1-580, 59.1-584); HB 2307 / SB 1392 (2021)
Virginia's comprehensive privacy law gives consumers the right to opt out of 'profiling' used to make decisions producing legal or similarly significant effects, such as automated decisions affecting credit, housing, employment, or essential services. Businesses must obtain heightened consent before processing the data of a known child (via federal COPPA) and must conduct documented data protection assessments for higher-risk processing, including certain profiling. The Attorney General enforces the law and may seek up to $7,500 per violation; there is no private right of action.
Technical detail
The Consumer Data Protection Act, Va. Code 59.1-575 et seq. (HB 2307 / SB 1392, 2021), grants a right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects (59.1-577), requires COPPA-compliant handling of known children's data, requires data protection assessments (59.1-580), and authorizes exclusive AG enforcement with civil penalties up to $7,500 per violation (59.1-584).
Who is protected: Virginia residents acting in an individual/household context, including known children (via COPPA), whose personal data is processed by covered controllers.
Who must comply: Controllers and processors that conduct business in Virginia or target Virginia residents and meet the Act's data-volume thresholds.
Key facts
| Jurisdiction | Virginia |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Limited protection |
| Effective date | 2023-01-01 |
| Enacted | 2021-03-02 |
| Citation | Va. Code 59.1-575 to 59.1-585 (esp. 59.1-577, 59.1-580, 59.1-584); HB 2307 / SB 1392 (2021) |
| Enforced by | Virginia Office of the Attorney General (exclusive enforcement). |
| Private right of action | No — agency enforcement only |
| Penalties | Civil penalties of up to $7,500 per violation, after a 30-day cure period. |
| Topics | consumer data privacy · automated decision-making · consumer protection · children's online safety |
| Last verified | 2026-06-16 |
| Official source | Code of Virginia 59.1-577 — Personal data rights; consumers (Consumer Data Protection Act) ↗ |
More AI rules in Virginia
- Virginia FY2026-2028 Biennial Budget: Data Center Electricit · Enacted (not yet in effect)
- Virginia § 15.2-1723.2 (facial recognition by local law enforcement, eff. July 1, 2026) · In effect
- Virginia IVO AI Safety Study (SB 384/HB 797, 2026) · In effect
- VA Data Center Siting Bill (Vetoed) · Vetoed
- VA Data Center Tax Exemption · In effect
- VA Data Center Cost-Allocation Law · In effect
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.