Virginia Consumer Data Protection Act (VCDPA) compliance implementation. Covers 5 consumer rights, controller obligations, processor requirements, opt-in for sensitive data, data protection impact assessments, AG enforcement, and cure period provisions. Effective January 1, 2023.
Virginia Consumer Data Protection Act (VCDPA) compliance implementation. Covers 5 consumer rights, controller obligations, processor requirements, opt-in for sensitive data, data protection impact assessments, AG enforcement, and cure period provisions. Effective January 1, 2023.
The Virginia Consumer Data Protection Act (VCDPA), codified as Va. Code §59.1-575 through §59.1-585, was signed into law on March 2, 2021, and became effective on January 1, 2023. Virginia was the second state to enact comprehensive consumer privacy legislation after California. The VCDPA follows the controller-processor model used in the GDPR rather than the business-service provider framework of the CCPA.
The VCDPA is enforced exclusively by the Virginia Attorney General — there is no private right of action and no dedicated privacy enforcement agency. The AG must provide a 30-day cure period before initiating enforcement action under §59.1-584.
Applicability (§59.1-576)
The VCDPA applies to persons that conduct business in Virginia or produce products or services targeted to Virginia residents AND:
During a calendar year, control or process personal data of at least 100,000 Virginia consumers; OR
Control or process personal data of at least 25,000 Virginia consumers AND derive over 50% of gross revenue from the sale of personal data.
Exemptions (§59.1-576(B)):
Virginia governmental entities
Financial institutions subject to GLBA (Title V of Gramm-Leach-Bliley Act, 15 U.S.C. §6801 et seq.)
Covered entities and business associates under HIPAA (42 U.S.C. §1320d et seq.)
Nonprofit organizations
Institutions of higher education
Data subject to GLBA, HIPAA, FERPA, FCRA, DPPA, or Farm Credit Act
Liberty Commerce Inc. Assessment:
Liberty Commerce Inc. processes personal data of approximately 145,000 Virginia consumers through its e-commerce platform. It meets threshold (1) and is subject to the VCDPA.
Five Consumer Rights (§59.1-577)
1. Right to Access (§59.1-577(A)(1))
Consumers have the right to confirm whether a controller is processing their personal data and to access such personal data.
Liberty Commerce Inc. Implementation:
Consumers access their data profile through the privacy portal at privacy.libertycommerce.com/virginia. The system generates a comprehensive data access report including all categories of personal data processed, sources, purposes, and any third-party recipients.
2. Right to Correct (§59.1-577(A)(2))
Consumers have the right to correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes of the processing.
3. Right to Delete (§59.1-577(A)(3))
Consumers have the right to delete personal data provided by or obtained about the consumer.
Liberty Commerce Inc. Implementation:
Deletion requests propagate to all processors within 30 days. Retained data for legal compliance is documented with specific legal basis.
4. Right to Data Portability (§59.1-577(A)(4))
Consumers have the right to obtain a copy of their personal data previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance.
5. Right to Opt Out (§59.1-577(A)(5))
Consumers have the right to opt out of:
Targeted advertising — displaying advertisements to a consumer based on personal data obtained from the consumer's activities across nonaffiliated websites, applications, or online services
Sale of personal data — exchange of personal data for monetary consideration
Profiling — in furtherance of decisions that produce legal or similarly significant effects concerning the consumer
Liberty Commerce Inc. Implementation:
Liberty Commerce Inc. provides a unified opt-out mechanism on its Virginia privacy page. Consumers can opt out of each category independently. GPC signals are recognized and honored as opt-out of targeted advertising and sale, consistent with multi-state compliance.
Sensitive Data Processing (§59.1-578(A)(5))
The VCDPA requires opt-in consent before processing sensitive data. This is a stricter standard than CCPA/CPRA (which allows collection without consent but provides a limit right).
Sensitive Data Categories (§59.1-575)
Personal data revealing racial or ethnic origin
Religious beliefs
Mental or physical health diagnosis
Sexual orientation
Citizenship or immigration status
Genetic or biometric data processed for identification
Personal data collected from a known child
Precise geolocation data (within 1,750 feet / 533 meters)
Key difference from CPRA: VCDPA requires prior consent; CPRA permits collection with a post-collection limit right.
Liberty Commerce Inc. Implementation:
Liberty Commerce Inc. obtains opt-in consent before processing sensitive data from Virginia consumers. The consent mechanism presents each sensitive data category separately with clear affirmative action (unticked checkbox). Consent records include: consumer ID, category, consent text version, timestamp, and mechanism.
Controller Obligations (§59.1-578)
Data Minimization (§59.1-578(A)(1))
Limit collection to what is adequate, relevant, and reasonably necessary in relation to the purposes.
Purpose Limitation (§59.1-578(A)(2))
Do not process personal data for purposes not reasonably necessary to or compatible with the disclosed purposes.
Security (§59.1-578(A)(3))
Establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data at issue.
Non-Discrimination (§59.1-578(A)(4))
Do not process personal data in violation of state and federal antidiscrimination laws.
Consent for Sensitive Data (§59.1-578(A)(5))
Obtain consent before processing sensitive data.
Privacy Notice (§59.1-578(B))
Provide a reasonably accessible, clear, and meaningful privacy notice that includes:
Categories of personal data processed
Purpose for processing
How consumers may exercise their rights (including appeal)
Categories of personal data shared with third parties
Categories of third parties with whom data is shared
Contact information for the controller
Response Timeline (§59.1-578(C))
Respond within 45 days of receipt
Extension: Up to 45 additional days (90 total) with notice to consumer
Data Protection Impact Assessments (§59.1-580)
Controllers must conduct and document DPIAs for processing activities that present a heightened risk of harm to consumers. Required for:
Targeted advertising processing
Sale of personal data
Profiling where it presents a reasonably foreseeable risk of:
Unfair or deceptive treatment or unlawful disparate impact
Financial, physical, or reputational injury
Physical intrusion or surveillance creating offense to a reasonable person
Other substantial injury
Sensitive data processing
Any processing activity involving personal data that presents a heightened risk of harm
DPIA Content Requirements
Identify and weigh the benefits from the processing against potential risks
Consider use of de-identified data
Factor in the reasonable expectations of consumers
Consider the context of processing and the relationship between controller and consumer
Liberty Commerce Inc. Implementation:
Liberty Commerce Inc. has completed DPIAs for:
Targeted advertising program (AdReach Network partnership)
Marketplace seller data sale to analytics partners
Consumer credit scoring for buy-now-pay-later feature
Precise geolocation processing for delivery optimization
Sensitive data processing (optional diversity surveys)
Each DPIA is reviewed annually and upon material changes. DPIAs are retained for five years.
Processor Requirements (§59.1-579)
Processing must be governed by a contract between the controller and processor that includes:
Instructions for processing data
Nature and purpose of processing
Type of data subject to processing and duration
Rights and obligations of both parties
Requirement that the processor ensure persons processing data are subject to a duty of confidentiality
Requirement to delete or return all personal data at controller's direction upon end of services
Requirement to make available information to demonstrate compliance (upon reasonable request)
Requirement to allow and cooperate with reasonable assessments by the controller or the controller's designated assessor
Requirement that the processor engage sub-processors only pursuant to a written contract with obligations no less protective than the controller-processor contract
Enforcement (§59.1-584)
Attorney General Authority
Exclusive enforcement authority under the VCDPA
May investigate potential violations
May issue civil investigative demands (CIDs)
Must provide 30-day written notice of alleged violations before bringing action
30-Day Cure Period
Controller or processor has 30 days after receiving AG notice to cure the alleged violation
If cured: AG may not bring action for that violation
If not cured: AG may bring action under the Virginia Consumer Protection Act (§59.1-196 et seq.)
Penalties
Civil penalties up to $7,500 per violation
Reasonable expenses including attorney fees
Injunctive relief
Key Regulatory References
Va. Code §59.1-575 — Definitions
Va. Code §59.1-576 — Applicability and exemptions
Va. Code §59.1-577 — Consumer rights
Va. Code §59.1-578 — Controller obligations
Va. Code §59.1-579 — Processor requirements
Va. Code §59.1-580 — Data protection impact assessments
Va. Code §59.1-581 — De-identified data
Va. Code §59.1-582 — Limitations
Va. Code §59.1-583 — Consumer rights request procedures
Va. Code §59.1-584 — Enforcement, 30-day cure period
