← ALL REGULATIONS
Virginia Consumer Data Protection Act cookie rules, explained.
Virginia’s Consumer Data Protection Act does not require opt-in consent for cookies. It gives consumers the right to opt out of targeted advertising, the sale of their data and profiling, and it requires opt-in consent for sensitive data.
VCDPA at a glanceOpt-out, opt-in for some data
- Applies to
- Controllers that process data of 100,000+ Virginia residents a year, or 25,000+ while earning over half their revenue from selling it
- In force
- January 2023
- Enforced by
- Virginia Attorney General
- Penalties
- Up to $7,500 per violation, after a 30-day period to cure
WHAT VCDPA REQUIRES
What Virginia asks of a site that uses advertising cookies.
THE RULEAn opt-out of targeted advertising and saleConsumers can opt out of targeted advertising, the sale of their personal data and profiling, and the site has to give them a way to do it.
WITH KATLAIn US State Laws (CCPA) mode, the banner’s main button is "Do Not Sell or Share My Personal Information", and the marketing category is labelled as the sale or sharing of personal information. The wording follows California’s law; there is no Virginia-specific label.
THE RULEConsent for sensitive dataProcessing sensitive data, such as health information, religious beliefs or precise location, needs opt-in consent.
WITH KATLAA site that processes sensitive data can run Katla in GDPR mode, so nothing non-essential is set before an opt-in.
THE RULEA privacy noticeThe notice must say what is collected and why, what is shared, and how to exercise the right to opt out.
WITH KATLAKatla generates the cookie policy from the scan, with CCPA disclosures in CCPA mode. Virginia-specific wording is not generated, so check the notice against the Act.
THE RULEOpt-out signals are not requiredUnlike Colorado and Connecticut, Virginia does not require honouring opt-out preference signals such as Global Privacy Control.
WITH KATLAKatla honours them anyway. Katla honours Global Privacy Control: a visitor whose browser sends it is recorded as opted out, unless they have already made a choice.
VCDPA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Does Virginia require honouring Global Privacy Control?
- No. Virginia’s Act does not require honouring opt-out preference signals, unlike the laws of Colorado, Connecticut and California.
- Who does the Act apply to?
- Controllers that process the personal data of at least 100,000 Virginia residents a year, or of 25,000 while earning more than half their gross revenue from selling personal data.
- Is there a cure period?
- Yes. The Attorney General must give notice and 30 days to cure before bringing an action.
- Can consumers sue?
- No. There is no private right of action; only the Attorney General enforces the Act.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.