iQ Cookie State Law Series
Cookie & Privacy Law in Virginia
Educational purposes only — not legal advice. This guide is intended to help you understand Virginia’s privacy and cookie consent laws. Laws change, and your situation may vary. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
The short version
Virginia was the second state in the country to pass a comprehensive privacy law — and arguably the most influential. The Virginia Consumer Data Protection Act (VCDPA) was signed in March 2021 and took effect January 1, 2023. While California built a heavyweight regulatory machine, Virginia built a cleaner, business-friendlier model — and that model is the one most other states copied. If you understand the VCDPA, you understand the skeleton of nearly every state law in this series.
Virginia is not standing still, though. Amendments in 2024 added strong protections for minors under 18, and in 2026 Virginia became just the third state to flat-out ban the sale of consumers’ precise geolocation data — a ban that took effect July 1, 2026 and applies no matter what consent you collected.
Virginia Consumer Data Protection Act (VCDPA)
SB 1392 · In effect since January 1, 2023
Precise Geolocation Sale Ban (SB 338)
Signed April 13, 2026 · In effect since July 1, 2026
Who does it apply to?
The VCDPA covers any business that operates in Virginia or targets products or services to Virginia residents and meets at least one of these two thresholds in a calendar year:
Controls or processes personal data of 100,000 or more Virginia consumers per year.
Controls or processes data of 25,000 or more consumers AND derives over 50% of gross revenue from the sale of personal data.
There is no revenue-only trigger — unlike California, a big company with few Virginia users can be out of scope. Exemptions are broad and entity-level: state agencies, nonprofits, higher education, HIPAA-covered entities and business associates, and GLBA financial institutions are exempt as whole organizations.
That 100,000 threshold counts cookie data. Roughly 275 Virginia visitors a day puts a website over it in a year — and “processing” includes browsing data collected by analytics and advertising cookies, not just customer accounts. Ecommerce and content sites serving the mid-Atlantic hit this number faster than they think.
Consumer rights
Virginia residents have six core rights — the set that became the national template:
Controllers must respond within 45 days, extendable once by 45 more when reasonably necessary. Denied requests must come with instructions for filing an appeal — and denied appeals must tell the consumer how to contact the Attorney General.
What makes Virginia different
The blueprint state. Most of the state laws in this series — from Connecticut to Texas to the 2026 wave — are built on Virginia’s model, not California’s. Same rights, same controller/processor structure, same opt-out framework. Learn Virginia once and the rest of the map gets easier.
Selling precise geolocation data is now banned outright. As of July 1, 2026, controllers may not sell — or offer to sell — a consumer’s precise geolocation data (location within a 1,750-foot radius). Consent does not cure it. Virginia is only the third state to do this, after Maryland and Oregon.
“Sale” means money changed hands. Virginia defines a sale narrowly: an exchange of personal data for monetary consideration. Sharing data with ad platforms for value-in-kind is not a “sale” here the way it is in California — but it usually still counts as targeted advertising, which consumers can opt out of.
No GPC mandate. Unlike California, Colorado, and Connecticut, Virginia does not require you to honor universal opt-out signals like Global Privacy Control. You still need a clear opt-out method — and if you serve multiple states, honoring GPC everywhere is the simpler play anyway.
A permanent 30-day cure period. Before the Attorney General can act, businesses get 30 days’ written notice to fix the violation. Most states sunset their cure periods; Virginia’s has no expiration date. That makes Virginia one of the friendliest enforcement environments in the series — but only for businesses that actually fix things when notified.
Sensitive data & children
Virginia takes the opt-in approach to sensitive data: you must get affirmative consent before processing any of these categories — and remember, precise geolocation can no longer be sold at all:
Minors get extra protection: data from a known child under 13 must be handled under federal COPPA consent rules, and 2024 amendments (in effect since January 1, 2025) bar processing a known minor’s data — anyone under 18 — for targeted advertising, sale, or significant profiling without consent.
What this means for your cookies
| Cookie / data type | Requirement | What to do |
|---|---|---|
| Sensitive data cookies (health, biometric, geolocation) | Opt-in required | Block these until affirmative consent is received. No pre-ticked boxes. |
| Precise geolocation data | Sale banned | As of July 1, 2026, no selling location data pinned within 1,750 feet — consent or not. Audit your ad-tech and data-broker relationships. |
| Targeted advertising cookies | Opt-out required | Provide a clear method to opt out of targeted advertising and data sales, and disclose it in your privacy policy. |
| Any cookies — known minors under 18 | Opt-in required | No targeted advertising, sale, or profiling of a known minor’s data without consent (parental consent under 13). |
| GPC / opt-out signals | Recommended | Not legally required under Virginia law, but recommended for multi-state compliance. |
| Analytics & functional cookies | No specific requirement | Disclose clearly in your privacy notice. Third-party analytics sharing usually is not a “sale” under Virginia’s money-only definition. |
Enforcement
The Virginia Attorney General has exclusive enforcement authority, and penalties feed the state’s Consumer Privacy Fund, which finances future enforcement. The permanent 30-day cure window softens the blow — but it only helps if you can actually fix a violation in 30 days. Untangling three years of unlawful geolocation data sales in a month is not a plan. Compliance up front is.
Your action checklist
The VCDPA has been live since 2023 and the geolocation ban is already in effect — this list is for right now:
Check your thresholds. Do you process personal data of 100,000+ Virginia consumers — or 25,000+ with over half your revenue from data sales? Remember that cookie and analytics data counts toward the number.
Stop any sale of precise geolocation data. This is the new one — effective July 1, 2026, no consent mechanism makes it legal. Audit ad-tech partners, SDKs, and data-broker feeds for location data leaving your hands for money.
Gate sensitive data behind opt-in consent. Health, biometric, immigration status, known-child data, and precise geolocation all require affirmative consent before processing — your cookie banner needs a real opt-in category for these.
Offer a working opt-out. Targeted advertising, data sales, and significant profiling all require a clear opt-out method. Test that it actually stops the cookies — a link that does nothing is worse than no link.
Protect known minors. Since January 1, 2025, no targeted ads, sales, or profiling of anyone you know is under 18 without consent — parental consent under 13.
Update your privacy policy and appeal process. Virginia requires disclosure of categories collected, purposes, third-party sharing, and how to exercise each right — including a documented appeal process for denied requests.
Run data protection assessments. Targeted advertising, data sales, sensitive data processing, and risky profiling each require a documented assessment. The AG can request them — have them ready before anyone asks.
iQ Cookie scans your site for compliance gaps and deploys a lightweight US-built consent banner with real opt-in and opt-out controls.
iQ Cookie State Law Series · Guide 22 of 25 · Next: Louisiana →