VCDPA compliance for websites
Under Virginia’s VCDPA, visitors can opt out of targeted ads.
Virginia’s privacy law lets websites collect data by default, but visitors must be able to opt out of targeted advertising, the sale of their data, and profiling. ConsentBit adds the opt-out, blocks the trackers behind it, and records every choice.
Key facts
Virginia’s privacy law, enforced by the Attorney General.
The Virginia Consumer Data Protection Act (VCDPA) protects the personal data of Virginia residents. It applies to businesses that sell to or target people in Virginia and meet a data threshold. Only the Attorney General can enforce it, and consumers can’t sue a business directly under this law.
$7,500
per violation, after a 30-day notice to fix the problem.
Requirements
Five things VCDPA expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
Tell visitors what you collect and how to opt out
The banner explains that data is collected, as soon as visitors land.
Offer an opt-out of targeted advertising and sale
The banner shows a “Do Not Share My Personal Information” link, and you can edit the label.
Act on the opt-out
Tracking scripts are blocked the moment a visitor opts out.
Get consent before processing sensitive data
Not covered by the banner. If you collect sensitive data, such as a health diagnosis or precise location, get the visitor’s consent where you collect it.
Keep a record of requests
Every opt-out is logged with the date and time, ready to export.
How it works
What a visitor sees, step by step
Nothing is blocked by default. The visitor decides whether the tracking continues.
They land on your site
A notice explains that data is collected. Your scripts run as normal.
They click the opt-out link
“Do Not Share My Personal Information” opens the opt-out panel, with a single checkbox.
They opt out
Analytics, Marketing and Preferences scripts are blocked straight away. Necessary cookies keep running.
Or their browser does it for them
Virginia doesn’t require it, but ConsentBit still treats a Global Privacy Control signal as an opt-out.
What counts as a sale
Virginia’s “sale” is narrow. The ad opt-out isn’t.
Virginia defines a sale as giving personal data to a third party for money. That’s narrower than California, where passing data on for cross-context advertising counts too, with or without money. It doesn’t let ad trackers off the hook, because Virginia gives visitors a separate right to opt out of targeted advertising, and that covers the pixels and tags that follow people across sites.
Runs until they opt out
For US visitors, ConsentBit uses an opt-out model. Here’s what runs by default in Virginia, and what changes when a visitor opts out.
Virginia rules for Virginia visitors
ConsentBit has state-specific rules for California, Virginia, Colorado, Connecticut and Utah, so a visitor from Richmond gets Virginia’s, not California’s.
GPC honored anyway
Virginia’s law doesn’t require websites to honor Global Privacy Control. ConsentBit treats it as an opt-out regardless, which is simpler than switching the behavior on at the state line.
California works differently, with a wider definition of sharing. See what CCPA requires →
Add a Virginia-ready opt-out to your site, free.
Records
A record of every opt-out, ready if the Attorney General asks
Every choice is recorded with when it was made and whether the visitor opted out. You can export the log as a CSV file whenever you need it.
The visitor opted out, so targeted advertising and sale scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
FAQ
Virginia privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies to businesses that sell to or target people in Virginia and, in a calendar year, either control or process the personal data of at least 100,000 Virginia consumers, or control or process the data of at least 25,000 consumers while making more than half of their gross revenue from selling personal data. The business doesn’t have to be based in Virginia.
Virginia residents can ask to see, correct, delete or take a copy of their personal data, and they can opt out of targeted advertising, the sale of their data, and profiling that has legal or similarly significant effects. Businesses also need opt-in consent before processing sensitive data.
No. Unlike California, Colorado and Connecticut, Virginia’s law doesn’t require websites to honor a browser opt-out signal. ConsentBit honors Global Privacy Control for Virginia visitors anyway, so an opt-out works the same way wherever a visitor is.
The Attorney General can seek up to $7,500 for each violation, but only after giving the business 30 days’ written notice to fix it. If it’s fixed within that window and the business confirms it in writing, no action follows. Virginia’s cure period, unlike Colorado’s and Connecticut’s, has no expiry date.
No. The Attorney General has exclusive authority to enforce the law, and it gives consumers no private right of action.
Both are opt-out laws, but Virginia’s definition of a sale only covers data exchanged for money, while California also counts sharing for cross-context advertising. California requires websites to honor Global Privacy Control and lets consumers sue over certain data breaches. Virginia does neither. See what CCPA requires →
Virginia doesn’t require opt-in consent for cookies the way GDPR does. It does require a clear privacy notice and a way to opt out of targeted advertising and sale, and a banner is a common way to offer both. See what GDPR requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Give Virginia visitors an easy way to opt out
Add a clear opt-out, block the trackers behind it, and keep a record of every choice.
This page is a general overview of the Virginia Consumer Data Protection Act, not legal advice. Virginia has other privacy rules that sit outside this law, including separate protections for reproductive and sexual health data.