Virginia Consumer Data Protection Act: cookie rules for Virginia visitors

What is the VCDPA?

The Virginia Consumer Data Protection Act (Code of Virginia, Title 59.1, Chapter 53) was adopted in March 2021 and became the second comprehensive consumer privacy law in the United States after California's. It took effect on 1 January 2023. Its structure, with controllers and processors, consumer rights, data protection assessments and enforcement by the attorney general alone, became the template that most later state laws copied, from Colorado and Connecticut to Texas and Oregon. The overview of US state privacy laws compares them.

Virginia has amended the Act several times. Amendments in 2024 strengthened the rules on children's data, a 2025 amendment added section 59.1-577.1 on minors' use of social media, and a 2026 amendment (2026, chapter 820) bars controllers from selling or offering for sale a consumer's precise geolocation data.

Who does the VCDPA apply to?

Section 59.1-576 applies the Act to persons that conduct business in Virginia or produce products or services targeted to Virginia residents and that, during a calendar year, either:

• control or process the personal data of at least 100,000 consumers, or
• control or process the personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.

There is no revenue-only threshold, so a large company with few Virginia customers can be outside the Act while a mid-sized website with 100,000 Virginia visitors a year can be inside it. A consumer is a Virginia resident acting in an individual or household context, so employee and business-to-business data are excluded. The Act also exempts state bodies, non-profit organizations, institutions of higher education, financial institutions subject to the Gramm-Leach-Bliley Act and entities covered by HIPAA.

What does the VCDPA require for cookies and trackers?

The Act regulates what personal data is used for, not the cookie itself. Cookie identifiers and IP addresses are personal data when they are linked or reasonably linkable to a person. Three uses matter for websites:

• Targeted advertising: showing ads selected on the basis of personal data obtained from a consumer's activities over time and across non-affiliated websites or apps. Retargeting pixels and ad network cookies fall here. Consumers can opt out (section 59.1-577 A 5).
• Sale of personal data: in Virginia, only the exchange of personal data for monetary consideration to a third party. That definition is narrower than in Colorado, Connecticut, Texas or Oregon, where other valuable consideration also counts. Data passed to ad tech partners without payment may not be a sale in Virginia, but it is usually targeted advertising anyway, which carries the same opt-out right.
• Profiling in furtherance of decisions that produce legal or similarly significant effects, such as decisions about credit, housing or employment. Consumers can opt out.

First-party analytics used to measure the site's own audience is none of these, and needs no opt-out or consent, only a description in the privacy notice.

Sensitive data needs consent. Section 59.1-578 A 5 forbids processing sensitive data without the consumer's consent: data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, personal data collected from a known child, and precise geolocation data. Consent means a clear affirmative act signifying freely given, specific, informed and unambiguous agreement. Data about a known child under 13 must be processed under the federal Children's Online Privacy Protection Act, with parental consent before targeted advertising, sale or profiling. Since 1 July 2026, precise geolocation data may not be sold at all.

The notice. Section 59.1-578 requires a reasonably accessible, clear and meaningful privacy notice listing the categories of data processed, the purposes, how to exercise rights and appeal, the categories of data shared with third parties and the categories of those third parties. A controller that sells personal data or uses it for targeted advertising must clearly and conspicuously disclose that processing and how to opt out.

Requests and appeals. Controllers answer rights requests within 45 days, extendable once by another 45 days, and must offer an appeal process; a refused appeal must tell the consumer how to complain to the Attorney General. Data protection assessments are required for targeted advertising, sales, profiling and sensitive data processing.

Must I honor Global Privacy Control in Virginia?

The statute does not require it. Unlike Colorado, Connecticut, Texas and Oregon, the VCDPA contains no provision on universal opt-out mechanisms or browser preference signals. In practice most businesses that honor Global Privacy Control in other states apply it to Virginia visitors too, because a browser signal does not reveal the state reliably and a uniform rule is simpler to run. Doing so is allowed. See Global Privacy Control for how the signal works.

What must a compliant notice do for Virginia visitors?

• Publish a privacy notice with the disclosures listed above.
• If the site uses advertising cookies or pixels, say so and give a clear way to opt out of targeted advertising and sale, such as a "Your privacy choices" or "Do not sell or share my personal information" link.
• Stop the advertising tags once a visitor opts out, and keep a record of the request.
• Ask for opt-in consent before collecting sensitive data, for example a health questionnaire or precise location.

An EU-style consent banner is not required, and it does not replace the opt-out link or the notice.

Enforcement and penalties

The Attorney General has exclusive authority under section 59.1-584. Before starting an action, the office must send the controller or processor 30 days' written notice identifying the violations; if the business cures them within that period and gives an express written statement that it has done so and that no further violations will occur, no action follows. This cure period has no expiry date, which makes Virginia one of the more lenient states. If the business continues or breaches its statement, the Attorney General can seek an injunction and civil penalties of up to $7,500 for each violation, plus reasonable expenses, including attorney fees. There is no private right of action.

We found no announced fine or settlement under the Act's general consumer data provisions as of October 2026. The newer social media provision, which limits users under 16 to one hour a day per platform unless a parent agrees otherwise, was challenged in federal court by the tech association NetChoice, and a federal judge blocked its enforcement against NetChoice members in February 2026.

How Cookiequiet handles Virginia

With geo-targeting, which is included on every plan including Free, Cookiequiet can show visitors from Virginia an opt-out notice with a "Do not sell or share my personal information" link instead of an EU-style consent banner, while visitors from the EEA or the UK still get the opt-in banner. Global Privacy Control is honored as an opt-out, and marketing tags held by the category system stop when a visitor opts out. It is set up with one script tag in about five minutes; see pricing for the plans. The privacy policy templates are written for the CCPA/CPRA rather than for Virginia specifically, so check the Virginia disclosures with your advisor.