The VA CDPA took effect on January 1, 2023, making Virginia the second US state with a comprehensive consumer privacy law after California.
Solutions / By Regulation
Stand up consent, sensitive data opt-ins, DPIAs, and consumer rights workflows tailored to Virginia's CDPA — and reuse them across every other US state law.
What is VA CDPA?
The VA CDPA, effective January 1, 2023, was the second comprehensive US state privacy law. It applies to entities that conduct business in Virginia and meet specific thresholds, granting consumers rights to access, correct, delete, port, and opt out of targeted advertising, sale of personal data, and certain profiling. The Virginia Attorney General has exclusive enforcement authority.
Typical applicability thresholds
Key requirements
Provide rights to access, correct, delete, obtain a portable copy, and opt out of targeted ads, sale, and profiling with legal/significant effects.
Obtain consent before processing sensitive data including racial/ethnic origin, religion, health, sexual orientation, citizenship, biometric, precise geo, and children's data.
Conduct DPAs for targeted advertising, sale of PI, sensitive data processing, profiling with risk of harm, and other heightened-risk activities.
Publish a clear notice describing categories processed, purposes, sharing, and how consumers may exercise their rights and appeal denials.
Bind processors with contracts specifying instructions, confidentiality, security, sub-processors, and audit rights.
Establish an appeals mechanism for consumers whose rights requests are denied, with response within 60 days.
Penalties & enforcement
The Virginia AG has exclusive enforcement authority. Civil penalties of up to $7,500 per violation, plus attorney's fees and investigative costs. Businesses receive a 30-day right to cure before enforcement action — but only if cure is possible.
How Clarip helps
Clarip unifies consent, data discovery, subject rights, and regulatory reporting — with workflows pre-configured for VA CDPA.
Quick answers to the questions privacy, legal, and engineering teams most often ask about VA CDPA.
The VA CDPA took effect on January 1, 2023, making Virginia the second US state with a comprehensive consumer privacy law after California.
Persons that conduct business in Virginia or produce products/services targeted to Virginia residents, and that during a calendar year either: (1) control or process personal data of 100,000+ Virginia consumers, or (2) control or process personal data of 25,000+ consumers and derive over 50% of gross revenue from the sale of personal data.
No. The CDPA defines 'consumer' as a Virginia resident acting in an individual or household context, explicitly excluding individuals acting in a commercial or employment context.
Sensitive data includes racial/ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship/immigration status, genetic or biometric data processed to identify a person, precise geolocation, and personal data of a known child. Processing requires opt-in consent.
No. The Virginia Attorney General has exclusive enforcement authority. There is no private right of action for consumers.
Clarip provides sensitive data opt-in flows, a Virginia-specific consumer rights portal with built-in appeals, automated Data Protection Assessment workflows, processor contract management, and a unified data map you can reuse across every other US state privacy law.
Book a 30-minute walkthrough and a custom gap assessment against VA CDPArequirements — mapped to the systems and vendors you already use.