Virginia CDPA Becomes First Comprehensive State Privacy Law in Effect
The Virginia Consumer Data Protection Act (CDPA) became the first comprehensive state privacy law outside California to take effect, establishing consumer rights including access, correction, deletion, portability, and the right to opt out of targeted advertising, sale of personal data, and profiling. The law applies to entities that control or process personal data of at least 100,000 Virginia residents, or 25,000 residents if deriving over 50% of gross revenue from data sales. Enforcement is exclusively through the Virginia Attorney General.
Key Analytics
Impact Analysis
Virginia's law established a model that several subsequent state privacy laws have followed, creating a de facto national baseline for states without their own legislation. Unlike the CCPA, the CDPA does not include a private right of action, reducing litigation risk but not eliminating regulatory enforcement exposure. Organizations operating nationally now face the challenge of harmonizing compliance across multiple state privacy regimes with varying definitions, thresholds, and consumer rights.
Recommended Actions
- Map your organization's data processing activities against the Virginia CDPA's applicability thresholds and consumer rights requirements.
- Implement universal opt-out mechanisms that can be extended to additional state laws as they take effect, rather than building state-by-state solutions.
- Conduct and document data protection assessments for processing activities involving targeted advertising, sale of personal data, profiling, sensitive data, and activities presenting a heightened risk of harm.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›CDPA threshold analysis and processing activity mapping
- ›Extensible universal opt-out implementation across states
- ›Data protection assessments for targeted advertising and profiling
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 80 to 175 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.