Attorney General Jay Jones is reminding Virginians of their rights under the Virginia Consumer Data Protection Act (VCDPA) during National Consumer Protection Week. Virginia became the second state in the United States to enact a comprehensive data privacy law, aiming to give residents more control over their personal information.
“Virginians have the right to their personal data under Virginia law,” said Attorney General Jones. “Standing up for every Virginian means using every tool at our disposal to put Virginians first, protect them from bad actors, and ensure that their rights are protected, including the right to protect their data and privacy.”
The VCDPA addresses concerns about how companies collect and sell personal data. According to the Electronic Privacy Information Center, thousands of data brokers in the U.S. buy and sell large amounts of Americans’ information with little oversight. As more transactions occur online, companies are able to gather increasing amounts of consumer data.
Under this law, businesses that handle significant volumes of Virginians’ personal information must comply with certain requirements. Personal data is broadly defined as any information linked or reasonably linkable to an identifiable person that is not publicly available—examples include addresses, phone numbers, Social Security numbers, birth dates, order histories, and search histories.
The legislation also introduces stricter rules for sensitive categories such as racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship status, genetic or biometric identifiers used for unique identification purposes, children’s information (for those under 13), and precise geolocation details. Companies must obtain consent before processing such sensitive information.
For example, if a company holds personal data on more than 100,000 Virginians—such as a grocery store chain or social media platform—it generally must honor requests from individuals who want their data deleted or wish to receive copies of all stored personal information. Additionally, explicit consent is required before processing sensitive details like religious beliefs or racial origin.
Companies covered by the VCDPA are also required to provide clear privacy notices explaining how consumers can exercise their rights and what happens with collected data. If a company sells personal information for targeted advertising purposes this must be clearly disclosed.
If residents believe their rights under the VCDPA have been violated they can file complaints with the Virginia Attorney General’s Office at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.
The Attorney General has enforcement authority over these matters; violators are given 30 days after notification to address issues before potential lawsuits may be filed seeking civil penalties up to $7,500 per violation.
In addition to enforcing civil rights laws and supporting victim assistance programs across Virginia (official website), the Attorney General provides legal counsel for state agencies while working on public safety initiatives and defending constitutional rights (official website). The office also offers resources related to identity theft prevention and fraud reporting (official website) and supports efforts against human trafficking and domestic violence through legal advocacy (official website). The Attorney General serves all residents throughout the Commonwealth of Virginia (official website).
For further assistance regarding consumer protection issues call 1-800-552-9963 from within Virginia or (804) 786-2042 from Richmond or outside Virginia.
