A Different Approach—Virginia's Consumer Data Protection Act

With Virginia Gov. Ralph Northam's signature on March 2, 2021, Virginia, a bit surprisingly, became the second state to set comprehensive rules for how companies handle and share personal information. Virginia's Consumer Data Protection Act (CDPA) will go into effect on Jan. 1, 2023, incidentally the same day as the California Privacy Rights Act (CPRA), a ballot measure that will strengthen the landmark California Consumer Privacy Act (CCPA). While Virginia's CDPA and California's CCPA share several features, each law takes a somewhat different approach.

As a starting point, Virginia's CDPA will largely avoid the "moving target" issue created by multiple rounds of rulemaking and revisions in California and may provide a clearer model for other states considering similar legislation. However, the CDPA certainly adds some complexity to the confusing and, at times, contradictory patchwork of data and information privacy laws. For businesses that fall within its