{ "jurisdiction_id": "US-VA", "jurisdiction": "United States – Virginia", "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-06", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 57, "sub_modules": 57, "source_register": 17 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "amber", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Comprehensive statute in force but enforcement rests solely with a general-purpose AG office lacking rulemaking power or a dedicated registration regime.", "claims": [ { "statement": "The Virginia Attorney General's Office is the exclusive enforcer of the VCDPA and there is no private right of action for violations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Virginia Consumer Data Protection Act (VCDPA) went into effect on January 1, 2023.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "In 2022 the Virginia General Assembly enacted three amendment bills to the VCDPA that converted the right to delete data-broker-sourced personal data into a right to opt out of its processing, expanded the nonprofit exclusion to political organizations, and repealed the VCDPA Consumer Privacy Fund.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/vcdpa-amendment-process-complete-text-finalized-ahead-of-jan-1-effective-date", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA governs 'personal data' of natural persons who are Virginia residents acting only in an individual or household context, expressly excluding data about individuals acting in an employment or commercial context.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA applies to persons conducting business in Virginia or producing products/services targeted to Virginia residents that, during a calendar year, either control or process personal data of at least 100,000 consumers, or control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/opinion/virginia-cdpa-track-be-signed-law-governor", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Unlike California's CCPA/CPRA, the VCDPA's final text does not grant the Attorney General rulemaking authority, and the statute imposes no controller registration or filing obligation with the Commonwealth.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/vcdpa-amendment-process-complete-text-finalized-ahead-of-jan-1-effective-date", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Consent-for-sensitive-data regime is clear and Confirmed, but the Act lacks a GDPR-equivalent enumerated lawful-basis structure.", "claims": [ { "statement": "The VCDPA does not enumerate GDPR Article-6-style lawful processing bases; general processing of non-sensitive personal data is permitted subject to purpose- and data-minimization limits, with consumers instead granted opt-out rights against targeted advertising, sale, and certain profiling.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers must obtain a consumer's affirmative consent prior to processing that consumer's sensitive data under the VCDPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "VCDPA sensitive data includes racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed for unique identification, and personal data collected from a known child under 13.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2971-attorney-general-jay-jones-reminds-virginians-of-their-data-privacy-rights", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Senate Bill 338, enacted as Chapter 820 of the 2026 Acts of Assembly and signed 13 April 2026, amends the VCDPA to prohibit controllers from selling or offering to sell a consumer's precise geolocation data, entering into force 1 July 2026.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://prod.iapp.org/news/a/virginia-governor-signs-legislation-banning-precise-cellular-location-data/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA exempts de-identified and pseudonymized data from the definition of personal data and from consumer-rights obligations, provided the controller maintains technical and organizational controls preventing re-identification.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/vcdpa-amendment-process-complete-text-finalized-ahead-of-jan-1-effective-date", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "green", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Rights framework is comprehensive, statutorily explicit, and well-documented by the regulator itself.", "claims": [ { "statement": "Consumers have the right to confirm whether a controller is processing their personal data and to access that personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers have the right to correct inaccuracies in their personal data and to delete personal data provided by or obtained about them; for data obtained from a source other than the consumer, the 2022 amendments deem a controller compliant by instead opting the consumer out of further processing of that data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/vcdpa-amendment-process-complete-text-finalized-ahead-of-jan-1-effective-date", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers have the right to opt out of the processing of their personal data for purposes of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2971-attorney-general-jay-jones-reminds-virginians-of-their-data-privacy-rights", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers have the right to obtain a copy of their personal data held by a controller.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2971-attorney-general-jay-jones-reminds-virginians-of-their-data-privacy-rights", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A controller must respond to a consumer rights request within 45 days of receipt, with one 45-day extension available where reasonably necessary provided the consumer is notified within the initial response period; if a request is refused, the controller must offer an appeal process and inform the consumer of the right to complain to the Attorney General if the appeal is denied.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Core accountability tools (DPIA, processor contracts) are present and Confirmed, but structural gaps exist versus GDPR (no DPO, no distinct ROPA, no VCDPA-specific retention schedule).", "claims": [ { "statement": "Controllers must conduct data protection assessments (DPIAs) for processing activities involving targeted advertising, the sale of personal data, profiling presenting a reasonably foreseeable risk of unfair/deceptive treatment or unlawful disparate impact, processing of sensitive data, or other processing presenting a heightened risk of harm to consumers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA contains no statutory requirement to appoint a Data Protection Officer or equivalent independent privacy role.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA does not impose a distinct Article-30-style comprehensive Records of Processing Activities obligation on controllers, though data protection assessments must document the processing context and controller-consumer relationship.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://legacy.dataguidance.com/resource/ultimate-guide-virginia-consumer-data-protection", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Where a processor acts on a controller's behalf, the VCDPA requires a data processing agreement clearly setting out instructions for processing, the nature and purpose of processing, the type of data, duration of processing, and the rights and obligations of both parties, mirroring GDPR Article 28-style processor terms.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers must establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of personal data at issue.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Virginia's personal information breach notification statute (Va. Code §18.2-186.6, outside the VCDPA itself) requires notification of a breach of unencrypted, unredacted personal information to affected residents and, where notice is given to more than 1,000 persons, to the Attorney General and nationwide consumer reporting agencies.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/virginia", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA's data-minimization principle limits collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes of processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/what-the-virginia-consumer-data-protection-act-means-for-your-privacy-program", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "No fixed statutory data-retention-period or disposal-schedule requirement beyond the general data-minimization principle was identified for controllers under the VCDPA.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/what-the-virginia-consumer-data-protection-act-means-for-your-privacy-program", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "No comprehensive cross-border transfer or adequacy regime exists in this jurisdiction; only a generic processor-contract requirement applies.", "claims": [ { "statement": "The VCDPA contains no dedicated cross-border data-transfer mechanism (no adequacy-decision framework, SCCs, or BCR approval regime); the only transfer-relevant control is the mandatory controller-processor data processing agreement applicable regardless of the processor's location.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Sectoral carve-outs are clear and Confirmed for finance/health/credit/education, but coverage relies on displacement to federal sectoral statutes rather than an integrated overlay.", "claims": [ { "statement": "The VCDPA exempts information subject to the federal Gramm-Leach-Bliley Act (GLBA) and GLBA-regulated financial institutions' data-handling activities from its scope, leaving GLBA as the operative privacy framework for that data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Protected health information governed by HIPAA and data held by HIPAA-covered entities/business associates is exempted from VCDPA scope, leaving HIPAA as the operative health-data framework.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://legacy.dataguidance.com/resource/ultimate-guide-virginia-consumer-data-protection", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A separate Virginia statute restricting the sharing of reproductive or sexual health data without consumer consent entered into effect July 1, 2025, supplementing the VCDPA's sensitive-data consent regime for this category of health information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/virginia", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA's definition of 'consumer' expressly excludes a natural person acting in an employment context, so employee and job-applicant personal data generally falls outside VCDPA obligations, unlike California's CPRA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Data regulated by the federal Fair Credit Reporting Act (FCRA) is exempted from VCDPA scope, leaving FCRA as the operative framework for consumer credit-reporting and scoring data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Data governed by the federal Family Educational Rights and Privacy Act (FERPA) and Virginia's institutions of higher education are exempted from VCDPA scope.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/opinion/virginia-cdpa-track-be-signed-law-governor", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Opt-out rights are Confirmed and functional, but the Act lacks GPC-signal recognition and dark-pattern prohibitions found in some peer states.", "claims": [ { "statement": "The VCDPA does not impose a dedicated cookie-consent regime; tracking for targeted advertising is instead addressed through the Act's opt-out right rather than an ePrivacy-style prior-consent-for-cookies rule.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2971-attorney-general-jay-jones-reminds-virginians-of-their-data-privacy-rights", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "During the VCDPA implementation work group, stakeholders discussed—but the enacted VCDPA text did not adopt—a Colorado-style universal opt-out mechanism (e.g., Global Privacy Control) requirement; no such signal-recognition mandate was identified in the current statute.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/recap-of-virginia-consumer-data-protection-work-group", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "No VCDPA-specific statutory prohibition on 'dark patterns' in consent interfaces was identified, in contrast to California's CPRA.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA's opt-out right covers 'sale' of personal data (defined narrowly as exchange for monetary consideration) and 'targeted advertising' across non-affiliated sites and applications, a narrower construct than CPRA's 'sale'/'share' dichotomy.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-passes-the-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Core profiling opt-out and biometric/genetic consent rules are Confirmed, but the flagship cross-sectoral AI risk-assessment bill was vetoed and several adjacent AI bills remain unverified.", "claims": [ { "statement": "Consumers have the right to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects on the consumer, and controllers must conduct a data protection assessment for such profiling where it presents a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/what-the-virginia-consumer-data-protection-act-means-for-your-privacy-program", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA does not include a GDPR Article 22-style express right to obtain an explanation of automated-decision logic; transparency is addressed indirectly through the privacy-notice and opt-out-right provisions.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2971-attorney-general-jay-jones-reminds-virginians-of-their-data-privacy-rights", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Virginia's Governor vetoed House Bill 2094, the High-Risk Artificial Intelligence Developer and Deployer Act, which would have imposed risk-disclosure and algorithmic-discrimination-prevention duties on developers and deployers of high-risk AI systems, leaving Virginia without a comprehensive cross-sectoral AI risk-assessment statute as of the veto.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/virginia-governor-vetoes-ai-bill", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A Virginia AI-related enactment (distinct from the vetoed High-Risk AI Developer and Deployer Act) is reported by an aggregator to mandate AI impact assessments and establish an AI advisory commission; the specific bill number and full compliance scope were not independently verified against primary legislative text.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/virginia", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Virginia's House Bill 1642 restricts sole reliance on artificial intelligence in criminal-justice decision-making, requiring human oversight of AI-informed determinations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/virginia", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Biometric data processed for the purpose of uniquely identifying a natural person is classified as VCDPA sensitive data requiring prior consumer consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2971-attorney-general-jay-jones-reminds-virginians-of-their-data-privacy-rights", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "House Bill 654 (2026 session), which would mandate consent for processing biometric data and add COPPA-aligned children's-data provisions, was reported in a legislative-tracking timeline; its final enactment status and effective date were not independently confirmed against a primary legislative record.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/virginia", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Genetic data processed for the purpose of uniquely identifying a natural person is classified as VCDPA sensitive data requiring prior consumer consent, and a separate Virginia genetic-testing-privacy statute requires direct-to-consumer genetic testing companies to obtain express consent for collection, use, and disclosure of genetic data, with rights to revoke consent and require destruction of biological samples within 30 days.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia General Assembly (hosted via DataGuidance)", "source_url": "https://www.dataguidance.com/sites/default/files/legp604_7.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA contains standard exemptions for state and local government entities, but no comprehensive national-security or state-surveillance carve-out framework specific to the Act was identified beyond its general government-and-nonprofit entity-level exemptions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/opinion/virginia-cdpa-track-be-signed-law-governor", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Strong and Confirmed 2026 minors'-social-media protections are counterbalanced by active constitutional litigation and several unverified adjacent bills.", "claims": [ { "statement": "Effective January 1, 2026, Virginia law requires social media platforms to use commercially reasonable methods, such as a neutral age-screening mechanism, to determine whether a user is a minor younger than 16.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2961-attorney-general-jay-jones-takes-steps-to-keep-virginias-children-safe-from-predatory-social-media-companies", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Under the same 2026 provision, social media platforms must limit a minor's use of the platform to one hour per day, per service or application, unless a parent provides verifiable consent to increase or decrease that daily limit.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2961-attorney-general-jay-jones-takes-steps-to-keep-virginias-children-safe-from-predatory-social-media-companies", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "NetChoice has sued the Virginia Attorney General alleging the minors'-social-media-use provisions (Senate Bill 854) violate the First Amendment and the Commerce Clause; the Attorney General's office has filed a motion to dismiss and announced its intent to fully enforce the law.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2961-attorney-general-jay-jones-takes-steps-to-keep-virginias-children-safe-from-predatory-social-media-companies", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Virginia's House Bill 1593 grants parents access to a minor's records unless access is restricted by a court or due to potential harm to the minor.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Uncertain", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/virginia", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Personal data collected from a known child under 13 is classified as VCDPA sensitive data requiring consent before processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2971-attorney-general-jay-jones-reminds-virginians-of-their-data-privacy-rights", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Virginia's institutions of higher education are entity-level exempt from the VCDPA, leaving federal FERPA as the operative privacy framework for most student education records in education settings.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/opinion/virginia-cdpa-track-be-signed-law-governor", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-virginia/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Enforcement powers and penalty caps are Confirmed and modest relative to peer states, redress avenues are narrow (no PRA/class action), and several 2026-session bills' final status remains unverified.", "claims": [ { "statement": "The Attorney General may seek civil penalties of up to $7,500 per violation of the VCDPA where a controller or processor fails to cure a notified violation within 30 days, plus injunctive relief, with penalties and attorney fees deposited into the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund since the 2022 amendments.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2971-attorney-general-jay-jones-reminds-virginians-of-their-data-privacy-rights", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "In February 2026, Attorney General Jay Jones announced his office's intent to fully enforce the VCDPA's new minors'-social-media-use-limitation provisions and filed a motion to dismiss NetChoice's challenge to the law.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/media-center/news-releases/2961-attorney-general-jay-jones-takes-steps-to-keep-virginias-children-safe-from-predatory-social-media-companies", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "During the VCDPA work group process, the Office of the Attorney General noted that the self-funding dynamic of the (now-repealed) Consumer Privacy Fund was not feasible because no funds were available to support enforcement at the initial implementation stage.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/recap-of-virginia-consumer-data-protection-work-group", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA precludes class-action enforcement of its provisions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/what-the-virginia-consumer-data-protection-act-means-for-your-privacy-program", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The VCDPA does not grant consumers a private right of action; enforcement is exclusively vested in the Attorney General.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Virginia Office of the Attorney General", "source_url": "https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-2-2-23.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Within the 180 days preceding this run, Virginia enacted Senate Bill 338 (signed 13 April 2026, in force 1 July 2026) banning the sale of precise geolocation data, and Attorney General Jay Jones announced (February 2026) enforcement of the new minors' social-media time-limit provisions amid ongoing NetChoice litigation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://prod.iapp.org/news/a/virginia-governor-signs-legislation-banning-precise-cellular-location-data/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Additional 2026-session Virginia bills affecting the VCDPA framework include Senate Bill 232 (verified parental consent for minors' online agreements and expanded parental rights), Senate Bill 85 (interoperability interfaces for social-media/AI data sharing), Senate Bill 245 (social-media/AI regulations addressing minor protection and algorithmic discrimination), and Senate Bill 615 (restrictions on online device-based pricing practices); the enactment status of each was not independently confirmed against primary legislative records at the time of this research.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/virginia", "source_tier": null, "observed_at": "2026-08-06" } ] } ] }