The long wait to see if any state would join California in
passing a comprehensive privacy law is finally coming to an end, as
the Virginia Senate passed the Virginia Consumer Data Protection
Act (CDPA) on February 3. An identical version of the bill
had already passed the Virginia House of Delegates on January 29,
which means that reconciling the two versions of the bill before
the February 11 deadline will likely be a mere formality. The bill
will then be sent to the governor of Virginia for his signature.
Should it be signed into law, the Virginia CDPA will go into effect
on January 1, 2023, the same day as the California Privacy Rights
Act (CPRA).
The CDPA borrows principles from the CPRA, the California
Consumer Privacy Act (CCPA) and the General Data Protection
Regulation (GDPR) but also differs from all three in key respects.
Below we have summarized the key provisions of the CDPA. We will
continue to provide updates as the bill moves through the
