Virginia Consumer Data Protection Act (2021 Sp. Sess. I, c. 35; Va. Code 59.1-575 et seq.): profiling opt-out and data protection assessments

Summary

Virginia's comprehensive consumer privacy law, approved on March 2, 2021 (HB 2307, 2021 Special Session I, chapter 35) and in force since January 1, 2023. It applies to persons doing business in Virginia or targeting its residents that control or process personal data of at least 100,000 consumers in a calendar year, or of at least 25,000 consumers while deriving over half of gross revenue from selling personal data. Financial institutions and data subject to Title V of the Gramm-Leach-Bliley Act are exempt, as are HIPAA covered entities, nonprofits and public bodies. Consumers may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, defined as decisions on financial and lending services, housing, insurance, education, criminal justice, employment, health care or access to basic necessities. Controllers must conduct and document a data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury. The Attorney General enforces it exclusively, after a 30-day written notice and cure opportunity, with civil penalties of up to $7,500 per violation; there is no private right of action.

Key dates

1. March 2, 2021Enacted
2. January 1, 2023Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. relating to Consumer Data Protection Act. [H 2307] Approved March 2, 2021

   Supports: Act name, bill number and approval date

   That the provisions of the first and third enactments of this act shall become effective on January 1, 2023.

   Supports: Effective date

   2021 Special Session I, Chapter 35 (HB 2307): Consumer Data Protection Act Virginia General Assembly, Legislative Information System Primary source

2. control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data

   Supports: Applicability thresholds

   financial institution or data subject to Title V of the federal Gramm-Leach-Bliley Act

   Supports: Entity-level GLBA exemption

   Va. Code 59.1-576, Scope; exemptions Virginia General Assembly (Code of Virginia) Primary source

3. means a decision made by the controller that results in the provision or denial by the controller of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities

   Supports: Decisions with legal or similarly significant effects include financial and lending services

   "Profiling" means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation

   Supports: Profiling definition

   Va. Code 59.1-575, Definitions Virginia General Assembly (Code of Virginia) Primary source

4. To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

   Supports: Profiling opt-out

   Va. Code 59.1-577, Personal data rights; consumers Virginia General Assembly (Code of Virginia) Primary source

5. The processing of personal data for purposes of profiling, where such profiling presents a reasonably foreseeable risk of (i) unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (ii) financial, physical, or reputational injury to consumers

   Supports: Assessment duty for risky profiling

   Va. Code 59.1-580, Data protection assessments Virginia General Assembly (Code of Virginia) Primary source

6. The Attorney General shall have exclusive authority to enforce the provisions of this chapter.

   Supports: Attorney General enforcement

   the Attorney General shall provide a controller or processor 30 days' written notice identifying the specific provisions of this chapter the Attorney General alleges have been or are being violated

   Supports: Notice and cure

   civil penalties of up to $7,500 for each violation under this chapter

   Supports: Penalty

   Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action

   Supports: No private right of action

   Va. Code 59.1-584, Enforcement; civil penalty; expenses Virginia General Assembly (Code of Virginia) Primary source