VCDPA
Virginia Consumer Data Protection Act
Virginia was the second US state with a comprehensive data protection law — and the template for many more. Aiara covers them all through the same mechanism.
VCDPA at a glance
- In force
- Since 1 January 2023
- Supervision
- Attorney General of Virginia
- Penalty
- Up to USD 7,500 per violation
- Model
- Opt-out of targeted advertising
What is the VCDPA?
The Virginia Consumer Data Protection Act gives consumers rights to access, correction, deletion and portability, as well as a right to object to targeted advertising, the sale of data and certain profiling.
Unlike California there is a cure period: anyone put on notice has 30 days to correct the issue before a fine can follow. Since 2025, universal opt-out signals such as Global Privacy Control must also be honoured.
The model has caught on. Colorado, Connecticut, Utah, Texas, Oregon and further states have enacted comparable laws — with differing thresholds, but the same underlying mechanics.
Who does the VCDPA apply to?
Data on 100,000 people in Virginia
The threshold refers to residents of the state, not to your overall business.
25,000 people plus data sales
Anyone earning more than half of their gross revenue from selling personal data is covered from 25,000 affected people.
Comparable thresholds in other states
The successor laws work with similar magnitudes but differ in detail — which is why nationwide implementation is more practical than state-by-state.
What does the VCDPA require of a website?
Opt-out of targeted advertising
A clearly recognisable route to object to personalised advertising is mandatory.
Honour universal signals
Since 2025, browser-side opt-out signals must be treated as an effective objection.
Consent for sensitive data
For health, origin or location data the reverse applies: the consent principle governs.
A route to appeal
Data subjects must be able to have a rejected request reviewed.
How does Aiara meet the VCDPA?
Aiara does not treat Virginia as a special case but as part of a single US model.
One mechanism for every state
Aiara uses the national section of the Global Privacy Platform, which maps the requirements of all US states. New state laws therefore require no changeover.
No geolocation needed
Because the same panel applies nationwide, the question of whether someone is in Virginia or Colorado never arises — a frequent source of error among competitors.
Browser signals are honoured
Global Privacy Control is evaluated before anything is displayed and applies immediately as an objection.
The objection targets advertising only
Targeted advertising is switched off, your own audience measurement stays — exactly the line the law draws.
Frequently asked questions about VCDPA
Official sources
This page summarises the legal position in plain language and is no substitute for legal advice.