Virginia Consumer Data Protection Act (“CDPA”)
Virginia passed the Consumer Data Protection Act (“CDPA”), which took effect on January 1, 2023. With the passing of this new law, Virginia becomes the second state to enact a consumer data privacy law. The CDPA is similar to the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”). Unlike the California laws, the CDPA uses terminology and data protection assessment requirements that is closer to the European Union’s General Data Protection Regulation (“GDPR”). The CDPA gives Virginia residents the rights to access, correct, delete, know, and opt-out of the sale and processing for targeted advertising purposes of their personal information, which is similar to the CCPA and CPRA. The enforcement is entirely up to the Attorney General and there is no private right of action for consumers.
