Virginia Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines

What Virginia’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed September 2026.

What You Need to Know

Virginia was the second state to enact a broad consumer privacy law. The law served as the baseline model for all other non-California state consumer data privacy laws. It has been amended several times, including to add an exemption for political organizations and additional provisions protecting children under 13. In 2026, the law was amended to prohibit controllers from selling or offering to sell precise geolocation data.

Official law text

Who the law applies to

Threshold	Requirement
Annual gross revenue	N/A
Consumers whose data is processed	100,000 consumers 1.16% of state's 8.6 million population
Revenue from sale of personal data	Derives more than 50% of gross revenue from sale of personal data and controls or processes personal data of at least 25,000 consumers.

Consumer rights under Virginia's law15

Right	Provided?
Know	Yes
Access	Yes
Obtain list of third parties to which personal data was disclosed	No
Data portability note Right applies only to data provided by the consumer to the controller.	Partial
Delete	Yes
Correct inaccuracies	Yes
Not be discriminated against for exercising rights	Yes
Opt-out of sale	Yes
Opt-out of targeted advertising/sharing	Yes
Opt-out of certain types of profiling	Yes
Opt-out of ADMT	No
Recognize opt-out signals	No
Revoke consent	No
Not process data in discriminatory manner	No
Appeal	Yes

Tracking Virginia’s privacy law? We write about it as the law changes.

Categories treated as sensitive data8

Racial or ethnic origin
Religious beliefs
Mental or physical health diagnosis
Sexual orientation
Citizenship or immigration status
Genetic or biometric data for purposes of uniquely identifying an individual
Personal data of known child
Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.

How sensitive data must be treated3

Obtain Consent to Process
Cannot Sell Precise Geolocation Data
Conduct Data Protection or Risk Assessment

Requirements for minors' data1

Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
note
Virginia creates additional obligations for processing personal data of children under 13.

Activities that trigger a risk or impact assessment6

Targeted advertising (“sharing”)
Sale of personal data
Processing of sensitive data
Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
Any processing activities involving personal data that present a heightened risk of harm to consumers
Each controller that offers any online service, product, or feature directed to consumers whom such controller has actual knowledge are children (under 13 years of age) shall conduct a data protection assessment for such online service, product, or feature that addresses (i) the purpose of such online service, product, or feature; (ii) the categories of known children’s personal data that such online service, product, or feature processes; and (iii) the purposes for which such controller processes known children’s personal data with respect to such online service, product, or feature

Other notable provisions8

Opt-out Request Can Be Verified
Data Processing Agreements
Privacy Policy
Implement Reasonable Data Security Measures
Duty to Avoid Secondary Use
Data Minimization
Attorney General Enforcement
Right to Cure
note
30 day right to cure that does not sunset.

Key dates1

Date	What happens
January 1, 2023	Virginia's consumer data privacy law takes effect

Questions about Virginia’s privacy law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow Virginia’s privacy law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.