Virginia VCDPA (opt out of profiling, $7,500/violation)
Virginia Consumer Data Protection Act (HB 2307 / SB 1392, 2021) — Profiling Opt-Out and Data Protection Assessments
Virginia · Va. Code 59.1-575 to 59.1-585 (esp. 59.1-577, 59.1-580, 59.1-584); HB 2307 / SB 1392 (2021)
- Status
- In effect
- Took effect
- January 1, 2023
- Applies to
- Controllers and processors that conduct business in Virginia or target Virginia residents and meet the Act's data-volume thresholds.
- Enforced by
- Virginia Office of the Attorney General (exclusive enforcement).
Virginia's comprehensive privacy law gives consumers the right to opt out of 'profiling' used to make decisions producing legal or similarly significant effects, such as automated decisions affecting credit, housing, employment, or essential services. Businesses must obtain heightened consent before processing the data of a known child (via federal COPPA) and must conduct documented data protection assessments for higher-risk processing, including certain profiling. The Attorney General enforces the law and may seek up to $7,500 per violation; there is no private right of action.
Who is protected: Virginia residents acting in an individual/household context, including known children (via COPPA), whose personal data is processed by covered controllers.
Legal detail
The Consumer Data Protection Act, Va. Code 59.1-575 et seq. (HB 2307 / SB 1392, 2021), grants a right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects (59.1-577), requires COPPA-compliant handling of known children's data, requires data protection assessments (59.1-580), and authorizes exclusive AG enforcement with civil penalties up to $7,500 per violation (59.1-584).
Key facts
| Jurisdiction | Virginia |
|---|---|
| Level | State |
| Strength | Limited |
| Enacted | March 2, 2021 |
| Citation | Va. Code 59.1-575 to 59.1-585 (esp. 59.1-577, 59.1-580, 59.1-584); HB 2307 / SB 1392 (2021) |
| Private right of action | No, agency enforcement only |
| Penalties | Civil penalties of up to $7,500 per violation, after a 30-day cure period. |
| Topics | consumer data privacy · automated decision-making · consumer protection · children's online safety |
| Statute | Code of Virginia 59.1-577 — Personal data rights; consumers (Consumer Data Protection Act) |
More AI rules in Virginia
- Virginia FY2026-2028 Biennial Budget: Data Center Electricity Tax… · Enacted (not yet in effect)
- Virginia § 15.2-1723.2 (facial recognition by local law enforcement, eff. July 1, 2026) · In effect
- Virginia IVO AI Safety Study (SB 384/HB 797, 2026) · In effect
- Virginia VITA EA400 AI Utilization Policy (Executive Branch AI deployment standard, 2026) · In effect
- Virginia SCC data center transmission cost order (2026) · In effect
- Virginia § 15.2-2209.5 data center siting disclosure law (2026) · In effect
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for location… · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare companies · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.