Your Virginia consumer data rights
In effect
The Virginia Consumer Data Protection Act gives Virginia residents rights over the personal data that covered businesses collect about them. It has been in effect since January 1, 2023.
- Who or what it protects
- Virginia residents, in their dealings with businesses that target Virginia consumers and process the personal data of at least 100,000 consumers, or of at least 25,000 while earning more than half of their gross revenue from selling personal data. State and local government, nonprofits and colleges and universities are among those exempt, and some data, such as health information covered by HIPAA, is not covered.
- What you can do
- You can confirm whether a business processes your personal data, correct it, delete data you provided or that it obtained about you, and get a copy. You can opt out of targeted advertising, the sale of your data, and profiling. A business needs your consent to process sensitive data. Use the method in the company's privacy notice; you get two free responses a year. The company must respond within 45 days, which it can extend by 45 days. If it declines, it must tell you how to appeal; it has 60 days to answer, and if it denies the appeal it must give you a way to contact the Attorney General. You can then file a complaint with the Attorney General's Office.
- Limits and eligibility
- The Attorney General is the only enforcer, and there is no private right to sue. A business gets 30 days to fix a violation after notice.
- Who oversees it
- Virginia Attorney General
- The law
- Virginia Consumer Data Protection Act
More official places to go
Checked against the official sources on October 6, 2026. Links last checked November 1, 2026.