Data Protection Atlas

Virginia

Tier 1 Comprehensive law United States

Virginia was the second US state to enact a comprehensive privacy law and is the template for the "business-friendly" state model: AG-only enforcement, no private right of action, and a permanent cure period. Under the patchwork (no-floor) US model it legislates independently; displacesFederal is FALSE because there is no comprehensive federal consumer privacy statute for a state law to displace. The contrast with California — dedicated regulator plus private suit versus AG-only plus cure period — makes Virginia and California the most structurally divergent pair of US state regimes.

At a glance

Principal law
Virginia Consumer Data Protection Act (Va. Code sec. 59.1-575 et seq.)
Regulator
Virginia Attorney General (no dedicated agency)
Maximum penalty
Up to $7,500 per violation after an uncured 30-day notice; no private right of action

How it relates to the national law

Model
fully-independent
Displaces national law
No
Parent jurisdiction
United States

Independently substantive. There is no national floor to derogate from, so this act stands on its own — its thresholds, rights and enforcement are its own.

Regulators

  • Virginia Attorney General

    Exclusive VCDPA enforcement via the Consumer Privacy Unit.

Instruments

VCDPA

Tier 1

Va. Code sec. 59.1-575 et seq.

Sources

Never independently verified — seeded from the prototype.