Virginia
VCDPA Consumer Rights: Exercise Your Virginia Privacy Rights
Independently fact-checked against primary sources (last audited August 15, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 15, 2026. · 16 primary sources cited on this page. How we verify our legal content
Virginia residents have five enforceable rights over their personal data under the Virginia Consumer Data Protection Act (VCDPA): the right to access, correct, delete, port, and opt out. Companies must respond within 45 days, and if they refuse, you have a statutory right to appeal and then escalate to the Virginia Attorney General.
The VCDPA took effect January 1, 2023, and covers any business that processes the personal data of at least 100,000 Virginia consumers annually, or at least 25,000 consumers where more than 50 percent of gross revenue comes from selling personal data. If a covered business holds data about you, the rights described below apply. For a broader overview of how the law works, see Virginia Data Privacy Laws.
What the VCDPA Covers and Who It Protects
Under Va. Code Ann. § 59.1-575, a "consumer" is a natural person who is a Virginia resident acting in an individual or household capacity. The definition expressly excludes people acting in a commercial or employment context, which means data your employer holds about you as an employee is not covered by these rights.
The VCDPA applies to controllers, the businesses that determine how and why personal data is processed. Covered controllers must provide at least one secure, reliable means for you to submit rights requests under § 59.1-578(E). When you contact them, you may be asked to verify your identity using commercially reasonable methods. If the controller cannot authenticate your request despite reasonable efforts, it is not required to comply under § 59.1-577(B.4), but it may ask for additional information to verify you instead of simply refusing outright.
Your rights under § 59.1-577 do not extend to data that has been de-identified or to data processed solely for certain exempt purposes, such as research, journalism, fraud prevention, or compliance with a legal obligation. That said, most everyday consumer data held by apps, retailers, data brokers, and online services falls squarely within scope.
Your Right to Access and Confirm Processing
Under Va. Code Ann. § 59.1-577(A)(1), you can ask any covered company to confirm whether it is processing personal data about you and, if so, to give you a copy of that data. This right has two components: the confirmation right (does the company hold your data at all?) and the access right (show me what you have).
How to exercise it: Look for a "Privacy Rights," "Consumer Request," or "Data Access Request" link in the company's website footer. Submit your request through the company's designated channel. Companies must maintain at least one secure, reliable submission method under § 59.1-578(E). You may need to provide identifying information such as an email address, account number, or answers to security questions.
The company must respond within 45 days of receiving your request, or within 90 days if it notifies you of an extension before the first deadline expires. Responses are free up to twice per calendar year. If your requests become manifestly unfounded, excessive, or repetitive, the company may charge a reasonable fee or decline to act under § 59.1-577(B.3).
Your Right to Correct Inaccurate Data
Virginia Code § 59.1-577(A)(2) lets you require a correction of inaccuracies in personal data a company holds about you, taking into account the nature of the data and the purpose of processing. This right matters most for data that directly affects decisions about you, such as financial profiles, credit-adjacent data, health-related records, or contact information used for customer communications.
How to exercise it: Submit a correction request through the company's privacy rights channel. Clearly identify the specific information you believe is inaccurate and, if possible, provide supporting evidence of the correct information. The company has 45 days to respond and must tell you what action it took or why it declined to act.
The company is not required to adopt every correction you propose. The standard, "taking into account the nature of the personal data," gives the controller discretion on implementation. If a company disputes your correction, its refusal triggers the appeal right described below.
Your Right to Delete Personal Data
Under Va. Code Ann. § 59.1-577(A)(3), you can request deletion of personal data the company collected from you or obtained about you from other sources. This is the broadest erasure right the VCDPA provides, covering both data you directly supplied (account information, purchase history) and data the company acquired about you (behavioral profiles, inferred attributes).
How to exercise it: Submit a deletion request through the company's privacy portal or designated email address. Be as specific as you can about the categories of data you want deleted. The 45-day response clock starts when the company receives your authenticated request.
Deletion is not absolute. The VCDPA preserves several exemptions: a controller may retain data to complete a transaction, to detect security incidents, to exercise free speech, to comply with a legal obligation, or to carry out certain research functions. The company must tell you if it is declining your deletion request and must explain which exemption applies.
Your Right to Data Portability
Section 59.1-577(A)(4) gives you the right to obtain a copy of the personal data you previously provided to the controller, in a portable and, to the extent technically feasible, readily usable format. Portability lets you take your data to a competing service, archive it locally, or share it with an advisor.
How to exercise it: Request a data export through the company's privacy rights channel. Common formats include CSV, JSON, or structured spreadsheets. The "technically feasible" qualifier means the company can provide data in a reasonable format rather than a custom API; it cannot use technical complexity as an excuse to provide nothing.
As with access requests, portability responses are free up to twice per year and must arrive within 45 days. Note the limit written into the text: § 59.1-577(A)(4) reaches only "a copy of the consumer's personal data that the consumer previously provided to the controller." Data the company observed about you, or inferred or derived about you internally, falls outside the portability right, though it may still be reachable through the access right under § 59.1-577(A)(1).
Your Right to Opt Out: Targeted Ads, Data Sales, and Profiling
Virginia Code § 59.1-577(A)(5) is the broadest VCDPA right. You can opt out of three distinct uses of your data:
- Targeted advertising. Ads selected for you based on your behavior across different websites, apps, or services not under common ownership.
- Sale of personal data. Transferring your data to a third party in exchange for money. Under the VCDPA, "sale" means a monetary exchange, which is narrower than California's CPRA definition.
- Profiling in furtherance of significant decisions. Automated processing that produces legal or similarly significant effects, such as decisions affecting your credit, insurance, employment, housing, or access to essential services.
How to exercise it: Look for a "Do Not Sell My Personal Data," "Opt Out of Targeted Advertising," or "Privacy Choices" link. Companies are required to disclose these opt-out paths in their privacy notice. You must submit a separate request to each company whose data practices you want to limit. The company has 45 days to confirm it has processed your opt-out.
One critical distinction: unlike Colorado and Connecticut, Virginia does not require companies to honor the Global Privacy Control (GPC) browser signal or any universal opt-out mechanism. This is addressed in detail in the next section.
Virginia Does Not Require Companies to Honor the Global Privacy Control (GPC)
The Global Privacy Control is a browser-level signal that users can enable to automatically broadcast an opt-out preference to every website they visit. Colorado and Connecticut have enacted laws requiring controllers to recognize this signal. Virginia has not.
The VCDPA (Va. Code Ann. §§ 59.1-575 through 59.1-585) contains no mandate for controllers to recognize GPC or any other universal opt-out signal. This is a verified feature of the statute, not an oversight that will be automatically corrected. Through the 2026 Virginia legislative session, no amendment has added a GPC requirement. The most recent amendment to § 59.1-578 (2026, c. 820) added restrictions on processing children's personal data; it did not add a universal opt-out or browser-signal obligation.
What this means for you as a Virginia resident: even if you have GPC enabled in your browser, a Virginia-only controller is not legally required to treat that signal as an opt-out. To exercise your opt-out rights under the VCDPA, you must submit a request directly through each company's privacy rights portal.
For a comparison, see Colorado Data Privacy Laws, which details Colorado's approach requiring GPC recognition.
Sensitive Data: When You Must Give Opt-In Consent
For certain categories of personal data, the VCDPA flips the default: companies cannot process this data at all without your affirmative opt-in consent under Va. Code Ann. § 59.1-578(A)(5). You do not need to opt out; the opt-in must happen first.
Under § 59.1-575, sensitive data includes:
- Data revealing your racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status
- Genetic data or biometric data processed to uniquely identify you
- Personal data collected from a known child
- Precise geolocation data (typically within a radius of 1,750 feet)
For data concerning known children, the controller must comply with COPPA parental consent requirements rather than simply obtaining the child's own consent.
If a company is processing your sensitive data without having obtained your affirmative consent, that is a violation of § 59.1-578(A)(5) and a basis for a complaint to the Virginia AG.
How to Submit a VCDPA Rights Request
Under Va. Code Ann. § 59.1-578(E), every covered controller must establish at least one secure and reliable submission method for privacy requests. In practice, most companies offer one or more of the following:
- An online privacy portal or webform (most common, often linked as "Privacy Rights" or "Your Privacy Choices" in the site footer)
- A dedicated email address such as privacy@company.com or dpo@company.com
- A toll-free phone number
Step-by-step process:
- Locate the company's privacy policy or footer and find the link for consumer rights requests.
- Select the right you want to exercise (access, correction, deletion, portability, or opt-out).
- Provide identifying information so the company can authenticate you under § 59.1-577(B.4). This typically means your name, email address on file, and possibly account details.
- Submit and save confirmation of your submission (screenshot or confirmation email).
- The 45-day response clock starts from the date of authenticated receipt.
If the company cannot authenticate your request using commercially reasonable efforts, it may ask for additional verification rather than outright denying the request. You are not required to provide information beyond what is reasonably necessary for authentication.
What to Do If a Company Denies Your Request: The VCDPA Appeal Right
Virginia's appeal process is one of the most structured consumer escalation paths among state privacy laws. It operates in two steps under Va. Code Ann. § 59.1-577(C).
Step 1: Internal appeal to the controller. After you receive a denial (or no response within 45 days), you can appeal directly to the company. The company must have established a conspicuous appeal process. Submit your appeal in writing through whatever channel the company designates, typically the same privacy portal used for initial requests or a separate appeal email. There is no set form required; clearly state that you are appealing the denial, identify the original request, and explain why you believe the denial was improper.
The company must respond to your appeal in writing within 60 days of receiving it, along with a written explanation of the reasons for its decision. Note the different timelines: 45 days for initial requests, 60 days for appeals.
Step 2: Escalation to the Virginia Attorney General. If the company denies your appeal, § 59.1-577(C) requires it to provide you with an online mechanism (or another method if no online mechanism exists) through which you can contact the Virginia AG to submit a complaint. Do not skip this step; the AG contact information should come from the company with its appeal denial.
You cannot sue the company yourself. The VCDPA expressly states in § 59.1-584 that there is no private right of action. Only the Virginia AG can file enforcement actions.
How to File a Complaint with the Virginia Attorney General
After a company has denied your appeal, you can file a complaint with the Virginia AG's Consumer Protection Section.
Contact options:
- Online complaint form: https://www.oag.state.va.us/consumercomplaintform/start
- Mailing address: Office of the Attorney General, Consumer Protection Section, 202 North Ninth Street, Richmond, Virginia 23219
- Consumer hotline: 1-800-552-9963 (Virginia toll-free) or 804-786-2042
When filing, include the name of the company, the date you submitted your original request, the date you received the denial, the date you submitted your appeal, the date you received the appeal denial, and copies of any written correspondence. The more documentation you provide, the stronger your complaint file.
The AG has exclusive enforcement authority under § 59.1-584 and can seek civil penalties up to $7,500 per violation after first providing the company a 30-day opportunity to cure. While the AG cannot guarantee enforcement in every individual case, documented patterns of violations are a key trigger for AG investigations.
If the company ignored your initial request entirely without responding within 45 days, you can skip the appeal step and file a complaint directly, since there is no response to appeal.
No Retaliation: Your Right Against Discrimination
Virginia Code § 59.1-578(A)(4) prohibits controllers from penalizing you for exercising your VCDPA rights. A company cannot:
- Deny you goods or services because you submitted a privacy request
- Charge you a higher price or different rate because you opted out
- Provide you a lower quality of service because you asked for your data or requested deletion
Section 59.1-578(A)(4) writes in two carve-outs, and both are narrower than they are often described. First, nothing in the provision requires a controller to provide a product or service that requires personal data the controller does not collect or maintain. Second, a controller may offer a different price, rate, level, quality, or selection of goods or services, including offering them for no fee, if you have exercised your right to opt out under § 59.1-577 or if the offer relates to your voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program. So a loyalty program may restrict member discounts to people who join it. The statute does not condition either carve-out on the value the company derives from your data, on the difference being proportionate, or on upfront disclosure. Those are conditions found in other states' laws, not in Virginia's.
If you believe a company has penalized you for exercising your VCDPA rights, document the treatment and include it in an AG complaint.
Related guides
- What Is the VCDPA? Virginia's Data Privacy Law Explained
- VCDPA Compliance Checklist for Businesses (2026)
- Virginia Data Privacy Laws: VCDPA Consumer Rights Guide (2026)
- Virginia Biometric Privacy Laws: Collection, Consent & Penalties (2026)
- US State Privacy Laws Comparison Chart (2026)
More Virginia Laws
Frequently Asked Questions
How do I find the privacy rights request form for a specific company?
Check the company's website footer for links labeled Privacy Rights, Do Not Sell My Personal Information, Consumer Privacy Request, or Your Privacy Choices. Under Va. Code Ann. § 59.1-578(E), every covered controller must maintain at least one secure, conspicuous channel for submitting requests. If you cannot find a link, contact the company's customer service department and ask for the VCDPA privacy rights submission method.
Can I submit a VCDPA request on behalf of someone else, like a child or elderly parent?
For a child, yes. For another adult, the VCDPA does not give you that right. Va. Code Ann. § 59.1-577(A) provides that a parent or legal guardian may invoke these rights on behalf of a known child, and the company must apply COPPA parental consent standards under § 59.1-578(A)(5). Virginia has no authorized-agent provision at all; the phrase does not appear in the statute, unlike California and Colorado law. For an elderly parent or another adult, a company may accept a request from an agent under its own policy, and presenting a guardianship order or power of attorney is worth trying, but the VCDPA does not require the company to honor it. The most reliable route is for the consumer to submit the request in their own name.
What happens if a company ignores my VCDPA request entirely?
Failing to respond within 45 days (or 90 days with a timely-noticed extension) is a violation of Va. Code Ann. § 59.1-577(B). Because there is no response to appeal, you can proceed directly to filing a complaint with the Virginia AG's Consumer Protection Section at oag.state.va.us/consumercomplaintform/start or by calling 1-800-552-9963.
Does the VCDPA cover employee data or data related to my job?
No. The VCDPA definition of consumer in § 59.1-575 expressly excludes natural persons acting in a commercial or employment context. Data your employer holds about you in your capacity as an employee, such as payroll records, HR files, and work email, is not subject to the VCDPA consumer rights described in this article.
Is the VCDPA opt-out of sale the same as the CCPA Do Not Sell right?
They are similar but not identical. Under the VCDPA, sale means an exchange of personal data for monetary consideration. It does not extend to sharing data for advertising purposes the way California's CPRA does. Virginia's separate opt-out of targeted advertising covers cross-context behavioral advertising, which California handles under its sharing opt-out. The two rights are structurally parallel but have different statutory definitions.
How long does a company have to respond to my appeal?
The company must respond to your appeal in writing within 60 days of receiving it under Va. Code Ann. § 59.1-577(C). The response must include a written explanation of the reasons for the decision. If the appeal is denied, the company must also provide a method to contact the Virginia Attorney General. This 60-day window is longer than the 45-day window for initial requests.
Does Virginia require companies to honor the Global Privacy Control browser signal?
No. The VCDPA contains no mandate requiring controllers to recognize the Global Privacy Control (GPC) or any other universal opt-out signal. This distinguishes Virginia from Colorado and Connecticut, which do require GPC recognition. In Virginia, you must submit your opt-out request directly to each company through its designated privacy rights channel.
What is the difference between opt-out and opt-in consent under the VCDPA?
For ordinary personal data processing, including targeted ads and data sales, the default is opt-out: the company can do it unless you object. For sensitive data categories such as health, biometric, precise location, race, religion, sexual orientation, immigration status, and children's data, the default flips to opt-in under § 59.1-578(A)(5). The company cannot process that data at all without your affirmative consent first.
Updates
Corrected the data portability and non-discrimination sections to match the text of Va. Code Ann. 59.1-577(A)(4) and 59.1-578(A)(4), removed an incorrect statement that the VCDPA lets an authorized agent submit requests for another adult, and updated the Global Privacy Control discussion through the 2026 Virginia legislative session.
Independently fact-checked against the cited primary sources; governing law re-checked for recent changes
Governing law re-checked for recent changes
Reviewed and approved by an editor
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
Code of Virginia, Title 59.1: Trade and Commerce
§ 59.1-577Personal data rights; consumersIn forcecited in 7 of our articles
A. A consumer may invoke the consumer rights authorized pursuant to this subsection at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A known child's parent or legal guardian may invoke such consumer rights on behalf of the child regarding processing personal data belonging to the known child. A controller shall comply with an authenticated consumer request to exercise the right: 1. To confirm whether or not a controller is processing the consumer's personal data and to access such personal data; 2. To correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data; 3. To delete personal data provided by or obtained about the consumer; 4. To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and 5.
Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at law.lis.virginia.gov
Cited in 1 court opinionsMost recently applied by a court: 2025
Leading cases:
- Eweka (District Court, E.D. Virginia 2025)“…e the VCDPA protects consumer’s private personal data, see Va Code Ann. § 59.1-577, it explicitly gives Virginia’s Attorne…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: How to Submit a Data Deletion Request (2026), Virginia Data Privacy Laws: VCDPA Consumer Rights Guide (2026), Virginia Biometric Privacy Laws: Collection, Consent & Penalties (2026)
§ 59.1-578Data controller responsibilities; transparencyIn forcecited in 5 of our articles
A. A controller shall: 1. Limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer; 2. Except as otherwise provided in this chapter, not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which such personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent; 3. Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. Such data security practices shall be appropriate to the volume and nature of the personal data at issue; 4. Not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers.
Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at law.lis.virginia.gov
Also relied on in: VCDPA Compliance Checklist for Businesses (2026), What Is the VCDPA? Virginia's Data Privacy Law Explained
§ 59.1-575DefinitionsIn forcecited in 8 of our articles
As used in this chapter, unless the context requires a different meaning: "Affiliate" means a legal entity that controls, is controlled by, or is under common control with another legal entity or shares common branding with another legal entity. For the purposes of this definition, "control" or "controlled" means (i) ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company; (ii) control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or (iii) the power to exercise controlling influence over the management of a company. "Authenticate" means verifying through reasonable means that the consumer, entitled to exercise his consumer rights in § 59.1-577, is the same consumer exercising such consumer rights with respect to the personal data at issue. "Biometric data" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that is used to identify a specific individual.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at law.lis.virginia.gov
Also relied on in: Virginia Smart Glasses Recording Laws, Virginia Employee Monitoring Laws: Workplace Surveillance and Social Media (2026), Virginia Ring Doorbell Laws: What You Need to Know in 2026
§ 59.1-584Enforcement; civil penalty; expensesIn forcecited in 6 of our articles
A. The Attorney General shall have exclusive authority to enforce the provisions of this chapter. B. Prior to initiating any action under this chapter, the Attorney General shall provide a controller or processor 30 days' written notice identifying the specific provisions of this chapter the Attorney General alleges have been or are being violated. If within the 30-day period the controller or processor cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action shall be initiated against the controller or processor. C. If a controller or processor continues to violate this chapter following the cure period in subsection B or breaches an express written statement provided to the Attorney General under that subsection, the Attorney General may initiate an action in the name of the Commonwealth and may seek an injunction to restrain any violations of this chapter and civil penalties of up to $7,500 for each violation under this chapter.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at law.lis.virginia.gov
Cited in 1 court opinionsMost recently applied by a court: 2025
Leading cases:
- Eweka (District Court, E.D. Virginia 2025)“…neral the “exclusive authority” to enforce its provisions, Va. Code Ann. § 59.1-584. Second, Plaintiff has not plausi…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- Va. Code Ann. § 59.1-577(A)(1). Right to confirm processing and access personal data(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-577(A)(2). Right to correct inaccuracies in personal data(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-577(A)(3). Right to delete personal data(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-577(A)(4). Right to data portability(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-577(A)(5). Right to opt out of targeted advertising, sale, and profiling(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-577(B). 45-day response requirement; free twice annually(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-577(B.3). Free response up to twice annually; fee for excessive requests(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-577(B.4). Authentication requirement; controller not required to comply if unable to authenticate(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-577(C). Consumer appeal right; 60-day response; AG escalation path(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-578(A)(4). Non-discrimination for exercising privacy rights(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-578(A)(5). Opt-in consent required for sensitive data(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-578(E). Controller must provide secure, reliable means to submit requests(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-575. VCDPA definitions including consumer and sensitive data(law.lis.virginia.gov).gov
- Va. Code Ann. § 59.1-584. AG exclusive enforcement; no private right of action; $7,500 per violation; 30-day cure(law.lis.virginia.gov).gov
- Virginia Attorney General. Consumer Protection Section, File a Complaint(oag.state.va.us).gov
- Virginia AG Online Complaint Form(oag.state.va.us).gov
- Va. Code Ann. tit. 59.1, ch. 53 (Consumer Data Protection Act). Section list and amendment history, including § 59.1-577.1 and the 2026, c. 820 amendments(law.lis.virginia.gov)