Virginia Data Privacy Law (VCDPA): What Virginia Residents Need to Know

Virginia was the second state to pass a comprehensive consumer data privacy law. The Virginia Consumer Data Protection Act (VCDPA) took effect on January 1, 2023. If you live in Virginia, it gives you real rights over your personal information — including the ability to demand that data brokers delete what they have on you.

What Is the VCDPA?

The Virginia Consumer Data Protection Act was signed by Governor Glenn Youngkin on March 2, 2021, and took effect January 1, 2023. Its structure — consumer rights plus business obligations plus AG-only enforcement — became the template many other states copied.

The VCDPA applies to businesses that either (a) control or process personal data of at least 100,000 Virginia consumers per year, or (b) control or process personal data of at least 25,000 Virginia consumers and derive more than 50% of gross revenue from selling personal data. This means most large data brokers, people-search sites, and data aggregators operating in Virginia are covered.

Importantly, the law includes several categories of exemptions. Nonprofit organizations, higher education institutions, and businesses regulated under HIPAA, GLBA, or FERPA are largely exempt. But for the vast majority of commercial data brokers collecting and selling consumer profiles, the VCDPA applies.

Your Rights Under the VCDPA

The VCDPA gives Virginia residents five data rights, each enforceable against covered businesses operating in the Commonwealth:

Businesses must respond to consumer rights requests within 45 days of receipt. They may extend this by an additional 45 days when reasonably necessary, but must notify you of the extension and the reason within the initial 45-day window. There is no fee for submitting requests, and businesses cannot retaliate against you for exercising your rights.

How the VCDPA Compares to California's CCPA

The VCDPA and California's CCPA cover similar ground but differ in a few practical ways that affect what you can actually demand and who enforces it.

One practical difference: Virginia's law has no revenue-only threshold. Under CCPA, a business with $25M annual revenue is covered regardless of how much data it processes. Under the VCDPA, data volume and revenue source are what matter. In practice, this excludes some smaller businesses that CCPA would catch, but it covers virtually all large data brokers.

What Data Brokers Must Do Under the VCDPA

Under the VCDPA, data controllers — including data brokers — have a set of mandatory obligations that go beyond simply responding to consumer requests:

• Publish a privacy notice: Controllers must provide a clear and accessible privacy notice that describes the categories of personal data processed, the purposes for processing, the categories of data shared with third parties, and how consumers can exercise their rights.
• Limit data collection: Controllers may only collect personal data that is adequate, relevant, and reasonably necessary for the disclosed purposes of processing. They cannot use data collected for one purpose in a materially different way without additional notice and consent.
• Implement data security: Controllers must implement reasonable administrative, technical, and physical security measures to protect personal data from unauthorized access, acquisition, or disclosure.
• Conduct data protection assessments: For processing that presents heightened risk — such as targeted advertising, sale of data, or profiling — controllers must conduct and document data protection assessments.
• Process deletion requests: Upon receiving a verified deletion request, controllers must delete the consumer's personal data and direct their processors to do the same. Certain exceptions apply, such as data needed to complete a transaction, data protected by legal hold, or data retained for security purposes.
• Provide an appeal mechanism: If a controller refuses to act on a consumer request, they must provide a clear and conspicuous method for the consumer to appeal that refusal.

Step-by-Step: How to Submit a VCDPA Deletion Request

If you are a Virginia resident and want to submit a deletion request to a data broker, the process follows these steps:

1. 1. Find the data broker's privacy notice. Every VCDPA-covered business must publish a privacy notice, typically linked in the website footer as "Privacy Policy" or "Your Privacy Rights." This document tells you what data they hold and how to submit rights requests.
2. 2. Locate the consumer rights request process. Look for a web form, email address, or toll-free number designated for privacy requests. The privacy notice is required to describe this mechanism clearly. Search for "[site name] delete my data" or "opt out" if you cannot find it easily.
3. 3. Submit your deletion request. Provide your full name, email address, mailing address, and confirmation that you are a Virginia resident. Be as specific as possible — include any identifiers the broker may have used, such as usernames, phone numbers, or addresses associated with your profile.
4. 4. Verify your identity if requested. The VCDPA allows businesses to require identity verification before processing a request. This is typically done via email confirmation, a government-issued ID comparison, or a verification code. Provide what is requested, but be aware that businesses cannot require you to create an account solely to submit a rights request.
5. 5. Wait for the 45-day response window. The business has 45 days from receipt of a verified request to respond. They may extend this to 90 days total if they notify you within the initial 45-day window and explain why more time is needed.
6. 6. Appeal if your request is denied. If the business denies your request, they must provide instructions for appealing the decision. If the appeal is denied, you can file a complaint with the Virginia Attorney General at ag.virginia.gov.

The Practical Reality: Why Manual Requests Are Tedious

Virginia's law gives you real leverage. The problem is scale. The data broker industry includes hundreds of companies — people-search sites, background check services, marketing aggregators, identity verification providers — each with their own opt-out process. Some use web forms. Some require emailed requests. Some ask for ID verification. Some have buried their opt-out links five clicks deep. Even if you spend a full weekend on deletion requests, you will probably miss dozens of brokers.

Data brokers also regularly re-acquire information from public records and other brokers. Remove your profile today and it can reappear in weeks or months as the broker re-ingests from its sources. Staying off these sites long-term requires ongoing monitoring and recurring deletion requests.

That's what authorized agent services like GhostVault handle. Instead of submitting individual requests yourself, you authorize GhostVault to do it across 500+ data brokers at once, and we keep re-submitting as profiles reappear. For more on how CCPA and similar state laws work for authorized agents, see our guide to California CCPA rights.

Frequently Asked Questions