Governance, risk & compliance

Virginia Consumer Data Protection Act (VCDPA) Va. Code 59.1-575 to 59.1-584 (to 2026)

The Virginia Consumer Data Protection Act (Va.

Code 59. 1-575 to 59.

1-584), effective 1 January 2023. It applies to a person that does business in Virginia or targets its residents and, in a calendar year, handles the personal data of at least 100,000 consumers, or at least 25,000 consumers while earning over 50% of gross revenue from sale.

State bodies, GLBA financial institutions, HIPAA covered entities, nonprofits and higher education are exempt. Consumers can confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling, with a 45-day response and a 60-day appeal.

Controllers need consent for sensitive data, must limit collection, secure data, publish a privacy notice, use processor contracts, and assess heightened-risk processing from 1 January 2023. A 2026 amendment adds a ban on selling precise geolocation (reported effective 1 July 2026), and 59.

1-577. 1 limits minors under 16 on social media.

The Act has no universal opt-out signal rule and no teen rule for advertising. The Attorney General alone enforces after a 30-day cure with no end date; penalties reach $7,500 per violation; there is no private action.

Not verified: (1) The enactment clause giving the 1 January 2023 effective date was not read; 59. 1-580 refers to 1 January 2023.

(2) The 2026 c. 820 ban on selling precise geolocation (59.

1-578(A)(6)) is reported to take effect on 1 July 2026 by a law-firm report; not confirmed from an official page. (3) The social media minors section (59.

1-577. 1, 2025 c.

703): its effective date and any court challenge were not verified, so the row is marked recommended. (4) The 59.

1-580(B) assessment for online services directed to known children was summarized, not quoted. General information for compliance work, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Virginia Consumer Data Protection Act (VCDPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Virginia Consumer Data Protection Act (VCDPA) compliance

Most of Virginia Consumer Data Protection Act (VCDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Virginia Consumer Data Protection Act (VCDPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Virginia Consumer Data Protection Act (VCDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Virginia Consumer Data Protection Act (VCDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.