As part of National Consumer Protection Week, Virginia Attorney General Jay Jones is emphasizing the protections offered by the Virginia Consumer Data Protection Act (VCDPA). Virginia was the second state in the U.S. to adopt a comprehensive data privacy law.
“Virginians have the right to their personal data under Virginia law,” said Attorney General Jones. “Standing up for every Virginian means using every tool at our disposal to put Virginians first, protect them from bad actors, and ensure that their rights are protected, including the right to protect their data and privacy.”
Data brokers in the United States collect and sell large amounts of personal information with limited oversight. The Electronic Privacy Information Center notes that “[t]housands of data brokers in the United States buy, aggregate, disclose, and sell billions of data elements on Americans with virtually no oversight.” As more business is conducted online, companies can gather increasing amounts of consumer information without direct input from individuals.
The VCDPA grants Virginians several rights regarding their personal information held by businesses. These include confirming if their data is being processed, correcting inaccuracies, deleting their data, obtaining copies of it, and opting out of its use for targeted advertising or sale.
Personal data under this law includes any information linked or reasonably linkable to an identifiable person that is not publicly available. Examples include addresses, email addresses, phone numbers, Social Security numbers, birth dates, order histories, and search histories.
Stronger protections exist for sensitive categories such as racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation or citizenship status; genetic or biometric identifiers; children’s information; and precise geolocation. Businesses must obtain consent before processing this type of sensitive information.
Companies holding personal data on more than 100,000 Virginians—such as grocery chains or social media platforms—are generally required to honor requests from individuals who want their personal data deleted or wish to receive a copy. Consent is also necessary if a company wants to process sensitive details like religious beliefs or racial origin.
Businesses must provide clear privacy notices explaining how consumers can exercise these rights and whether personal data is sold for targeted advertising purposes.
Virginians who believe their VCDPA rights have been violated may file complaints with the Attorney General’s Office at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.
The Attorney General has enforcement authority over VCDPA violations. Entities found violating the law have 30 days after notification to address issues in writing; failure to do so may result in lawsuits seeking civil penalties up to $7,500 per violation. More details about VCDPA are available on the official website.
Additional services provided by the Attorney General’s office include consumer protection resources for identity theft and fraud reporting as well as legal advocacy addressing issues such as human trafficking and domestic violence. The office also offers victim assistance programs and supports civil rights enforcement throughout Virginia (official website). The office serves all residents across the Commonwealth while providing legal counsel to state agencies (official website).
For further assistance regarding consumer protection matters in Virginia call 1-800-552-9963 (in-state) or (804) 786-2042 (Richmond area/outside Virginia).
