Laws
Virginia Consumer Data Protection Act (VCDPA): your rights and how to use them
Quick answer
If you live in Virginia, the Consumer Data Protection Act lets you ask a covered company to show you, correct or delete your personal data, including data it bought or got from someone else, and to stop selling it or using it for targeted ads. Send the request through the method in the company's privacy notice: it has 45 days to answer, and it's free up to twice a year. If the company refuses, appeal to it first, then complain to the Virginia Attorney General.
All privacy laws“A controller shall comply with an authenticated consumer request to exercise the right: ... To delete personal data provided by or obtained about the consumer”
- Applies in
- Virginia
- In force since
- Companies must answer within
- Without undue delay and within 45 days of receiving your request. The company can extend once by 45 more days if it tells you why within the first 45 days (Va. Code § 59.1-577(B)). Appeals get a written answer within 60 days (§ 59.1-577(C)).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: law.lis.virginia.gov, oag.state.va.us
Last verified against the official page:
Virginia residents acting as individuals or households, not as employees or in a business role. The law applies to companies that do business in Virginia or target Virginians and, in a calendar year, handle the personal data of at least 100,000 Virginians, or of at least 25,000 while making more than half their gross revenue from selling personal data. Government bodies, nonprofits, colleges, HIPAA covered entities and financial institutions covered by the Gramm-Leach-Bliley Act are exempt, and so is data covered by HIPAA, the Fair Credit Reporting Act, FERPA and the Driver's Privacy Protection Act.
Your rights
-
Confirm and access
Ask a company whether it processes your personal data, and see that data (Va. Code § 59.1-577(A)(1)).
-
Correct
Have inaccurate data fixed. The company can take into account what kind of data it is and why it processes it (Va. Code § 59.1-577(A)(2)).
-
Delete
Have a company delete personal data you gave it and data it obtained about you elsewhere. If it got your data from someone else, it can comply by keeping a minimal record so the data stays deleted, or by opting you out of all its non-exempt processing (Va. Code § 59.1-577(A)(3), (B)(5)).
-
Get a portable copy
If the processing is automated, get a copy of the data you gave the company in a portable format that, where technically feasible, you can easily use elsewhere (Va. Code § 59.1-577(A)(4)).
-
Opt out
Stop the company using your data for targeted advertising, selling it, or profiling you for decisions with legal or similarly significant effects (Va. Code § 59.1-577(A)(5)).
-
Appeal
Appeal a refusal. The company must answer in writing within 60 days and, if it still says no, give you a way to complain to the Attorney General (Va. Code § 59.1-577(C)).
-
Consent for sensitive data
A company needs your consent before it processes sensitive data about you (Va. Code § 59.1-578(A)(5)).
-
No retaliation
A company can't refuse you goods or services, charge you more or give you worse quality because you used these rights. Genuine loyalty programs are the exception (Va. Code § 59.1-578(A)(4)).
General information, not legal advice.
How to use it
- 1
Find the request method in the privacy notice
Covered companies must explain in their privacy notice how to use your rights and how to appeal. Look for a Virginia or VCDPA section and use the secure method listed there.
The company can't make you create a new account just to send a request.
- 2
Say which rights you want to use
Name them plainly: access, correction, deletion, a copy or an opt-out. A line like "Under the Virginia Consumer Data Protection Act, please delete the personal data you hold about me, including data you obtained from other sources" is enough to start.
The company may ask for information that's reasonably necessary to confirm it's you.
- 3
Wait up to 45 days
The company has 45 days to respond. It can extend once by 45 more days if it tells you, with a reason, inside the first 45 days. If it decides not to act, it must tell you within 45 days and explain how to appeal. Answers are free up to twice a year.
- 4
Appeal if the company refuses
Use the company's appeal process. It must answer in writing within 60 days. If it denies the appeal, it has to give you a way to contact the Attorney General.
- 5
Complain to the Virginia Attorney General
File a complaint with the Attorney General's Consumer Protection Section on its complaint page. Only the Attorney General enforces the VCDPA: you can't sue a company under it yourself. After a written notice and a 30-day cure period, the Attorney General can ask a court for an injunction and civil penalties of up to $7,500 per violation.
No answer in time? Complain to Office of the Attorney General of Virginia, Consumer Protection Section .
Who has to follow the VCDPA
The law covers companies that do business in Virginia or target Virginians and handle the personal data of at least 100,000 Virginians a year. A smaller company is covered too if it handles data on 25,000 or more Virginians and makes over half its gross revenue from selling personal data. Below those numbers, the VCDPA doesn't apply at all.
It protects you as a person or household member. Data about you as an employee or job applicant is outside it.
How far deletion goes in Virginia
This is the strong part. Your right to delete covers data you gave a company and data it "obtained about" you, so it reaches information a company bought from a data broker or collected from somewhere else. Utah and Iowa only cover data you provided yourself.
There's a catch for that second kind of data. The company can keep a minimal record of you so it doesn't add your data back, or it can opt you out of all its non-exempt processing instead of erasing everything.
The VCDPA defines a "sale" as an exchange for money only. A company that trades your data for something other than cash may say that isn't a sale, which is why asking for deletion is often stronger than opting out of sales. Since July 1, 2026, according to the Attorney General's summary, companies may not sell or offer for sale precise geolocation data.
No browser opt-out signal
Some states make companies honor Global Privacy Control, a browser setting that opts you out everywhere at once. Virginia doesn't. You have to send each opt-out to each company.
Why a company can say no
Some companies and some data sit outside the VCDPA. Government bodies, nonprofits, colleges and HIPAA covered entities are exempt, and so are financial institutions covered by the Gramm-Leach-Bliley Act (GLBA). Data covered by federal laws is exempt too, including GLBA (banking), HIPAA (health), the Fair Credit Reporting Act (credit reports), FERPA (school records) and the Driver's Privacy Protection Act.
If a company points to one of these, that's probably the reason it's refusing. You can still appeal and, if you think the refusal is wrong, complain to the Attorney General. Our guide on what to do when a company won't delete your data goes through the options.
Where Serus fits
The VCDPA works one company at a time, and you first need to know which companies have your data. Serus finds the data brokers that operate where you live, sends the deletion and opt-out requests for you and checks whether your data shows up again. Everything above is free to do yourself.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
Does the VCDPA let me delete data a company bought about me?
Yes. The deletion right covers personal data "provided by or obtained about" you. If the company got it from someone else, it can comply by keeping a minimal record so the data stays deleted, or by opting you out of all its non-exempt processing.
How long does a company have to respond?
45 days from receiving your request. It can extend once by 45 more days if it tells you why within the first 45 days.
Do Virginia companies have to honor Global Privacy Control?
No. The VCDPA doesn't require companies to honor browser opt-out signals such as Global Privacy Control. To opt out, send the request to each company.
Can I sue a company under the VCDPA?
No. The Attorney General has exclusive enforcement authority and the law gives you no right to sue.
Is there a fee?
No, up to twice a year. A company can charge a reasonable fee for, or refuse, requests that are manifestly unfounded, excessive or repetitive.
Sources
- law.lis.virginia.gov/vacodefull/title59.1/chapter53/
- oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-7-1-26.pdf
- oag.state.va.us/media-center/news-releases/2971-attorney-general-jay-jones-reminds-virginians-of-their-data-privacy-rights
- oag.state.va.us/consumer-protection/index.php/file-a-complaint
Something wrong or out of date? Tell us and we'll re-check it.