Virginia Consumer Data Privacy Act Becomes Law

On March 2, 2021, the Virginia Legislature adopted and Governor Ralph Northam signed the Virginia Consumer Data Privacy Act (CDPA), which goes into effect on January 1, 2023. The law applies to companies that conduct business in the state of Virginia or whose products or services are directed to residents of Virginia and either: (1) process or control the personal data of 100,000 consumers (Virginia residents) or more, or (2) derive over 50 percent of its revenue from the sale of personal data and process or control personal data of at least 25,000 consumers. (59.1-572.)

The CDPA also features some key differences from the California Consumer Privacy Act that businesses should be aware of, discussed below.