The newly enacted Virginia Consumer Data Protection Act (VCDPA), which goes into effect on January 1, 2023, gives consumers certain rights with respect to their personal data. The VCDPA applies to all persons that conduct business in Virginia or produce products or services that are targeted to Virginia residents and that 1. Control or process persona data of at least 25,000 consumers during a calendar year or 2. Control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data. While the VCDPA does not create a private right of action for consumers, it does provide the AG an opportunity to seek injunctive relief and impose civil penalties of up to $7,500 per violation.
