Virginia
Virginia privacy law: a permanent chance to fix it
Virginia was the second state with a comprehensive law and still has no requirement to honor a browser opt-out signal. What it does have is a permanent 30-day right to cure — which makes self-discovered, dated findings worth a lot.
At a glance
- Applies if
- You do business in Virginia or supply products or services targeted to Virginia residents, and during a calendar year you either process personal data of at least 100,000 consumers, or process data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data (§59.1-576(A)).
- Opt-out signal
- No general requirement to honor an opt-out preference signal for sale or targeted advertising; the Act prescribes consumer request methods instead (§§59.1-577, 59.1-578(E)). A separate rule requires social-media operators to treat users as minors when their device signals that status (§59.1-577.1(C)), which is not signal recognition.
- Response deadline
- 45 calendar days, extendable by 45 additional days (§59.1-577(B)(1)). An appeals process is required, with a decision within 60 days (§59.1-577(C)).
- Right to cure
- Permanent. The Attorney General must give 30 days' written notice, and curing within that period plus an express written assurance prevents an enforcement action from being initiated (§59.1-584(B)). Continued violations or a broken assurance reopen enforcement (§59.1-584(C)).
- Max penalty
- Up to $7,500 per violation, enforced exclusively by the Attorney General (§59.1-584(A), (C)).
- Consumer rights
- access · correction · deletion · portability · opt out of sale · opt out of targeted advertising · opt out of profiling with legal or similarly significant effects · consent for sensitive data
Consumer Data Protection Act, Va. Code §59.1-575 et seq. — in force January 1, 2023.
No signal mandate — but still a real opt-out duty
Virginia does not require you to detect a browser-level opt-out signal. You still have to provide a working way to opt out of sale, targeted advertising, and profiling, and answer requests inside the deadline (§59.1-577). A link that leads to a dead page is a violation even without a signal rule.
Two things Virginia added that catch sites out
Employment and commercial-context individuals are outside the definition of consumer (§59.1-575).
- Selling or offering for sale precise geolocation data is prohibited (§59.1-578(A)(6), as amended by 2026 ch. 820).
- Data protection assessments are required for targeted advertising, sales, sensitive data, and qualifying profiling (§59.1-580(A)).
Where Virginia sites usually break
A dealership has to work out whether its lead forms sit inside a GLBA-exempt financing flow; retail and restaurant loyalty programs remain subject to the notice and rights duties, though bona fide loyalty-program pricing flexibility is expressly allowed (§§59.1-576(B)(ii), 59.1-578(A)(4), (C)). Applicant screening is generally outside consumer scope, while e-commerce pixels trigger advertising opt-outs and assessments, and selling leads for money can trigger the sale rights and the revenue-based coverage test (§§59.1-575, 59.1-576(A), 59.1-577(A)(5), 59.1-580(A)).
Use the 30-day window on your own terms
Virginia's cure right is the strongest in the country: fix it inside 30 days and give written assurance, and the Attorney General does not initiate an action (§59.1-584(B)). That only works if you find the problem first, which is what a monthly scan with a dated evidence pack is for.
Primary sources
Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.