VCDPA requirements
Virginia's law took effect January 1, 2023 and became the template most later states copied. It applies to controllers handling data on 100,000 Virginia consumers, or 25,000 if more than half of revenue comes from selling personal data. Consumers may opt out of targeted advertising, the sale of personal data, and profiling with significant effects, and controllers need opt-in consent before processing sensitive data. Since July 1, 2026 the sale of precise geolocation data has been prohibited outright. Virginia does not require recognition of a browser-level opt-out signal, so compliance rests on the site's own opt-out link and the vendors it actually controls. The Attorney General enforces, with a 30-day cure period and civil penalties of up to $7,500 per violation. The practical exposure is a tag that keeps firing to an ad platform after the consumer has opted out.
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.