Virginia Consumer Data Protection Act (VCDPA) Compliance Guide

VCDPA compliance emphasizes consumer rights, sensitive-data consent, profiling opt-out controls, and practical governance for Virginia data operations.

This page is designed for privacy, legal, security, and engineering teams implementing controls in production systems.

Key Legal Requirements

• • Publish transparent privacy disclosures and rights intake channels
• • Support rights to access, correction, deletion, and data portability
• • Enable opt-out for targeted advertising, sale, and profiling decisions
• • Perform data protection assessments for high-risk processing

• • Businesses controlling or processing personal data of Virginia residents at covered thresholds
• • Organizations involved in targeted advertising, data sale, or profiling use cases
• • Teams handling sensitive data requiring explicit consent

• • Require opt-in consent before processing sensitive personal data
• • Store evidence of consent and policy state at collection time
• • Synchronize revocation across integrated systems

Cookie Governance Implications

• • Marketing and analytics identifiers require category-aware governance
• • Tracking execution should reflect profiling and targeted ad opt-outs
• • Script governance should include change monitoring and exception handling

• • Provide rights response workflows and request verification
• • Maintain appeal mechanism for denied requests
• • Capture audit evidence for each request lifecycle stage

Exposure: Enforcement by Virginia authorities can include civil penalties and corrective obligations for non-compliance.

Enforcement Authority: Virginia Attorney General

• • Automating profiling-related opt-out controls across modern growth stacks
• • Harmonizing sensitive-data consent behavior with other state frameworks
• • Reducing manual evidence collection for rights and assessments

• • Routes VCDPA opt-out and consent choices to policy enforcement in real time
• • Automates rights and appeal workflows with traceable evidence
• • Maps Virginia obligations to implementation controls and testing cadences