Virginia Consumer Data Protection Act takes effect

The Virginia Consumer Data Protection Act (VCDPA) took effect on January 1, 2023, making Virginia the second U.S. state after California to enforce a comprehensive consumer privacy law. The VCDPA grants Virginia residents a suite of rights over their personal data, including the right to access, correct, delete, and obtain a copy of their data, as well as the right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, and profiling in furtherance of solely automated decisions. The law applies to businesses that control or process personal data of at least 100,000 Virginia consumers annually, or those that derive over 50% of gross revenue from the sale of personal data and process data of at least 25,000 consumers. The VCDPA is enforced exclusively by the Virginia Attorney General, with no private right of action for consumers. Businesses are given a 30-day cure period to remedy violations before enforcement action can be taken, and civil penalties can reach up to $7,500 per intentional violation. The law requires data controllers to conduct and document data protection assessments for high-risk processing activities, including targeted advertising, and mandates clear privacy notices disclosing data practices to consumers. The significance of the VCDPA in the AdTech ecosystem is substantial. It represents a growing patchwork of state-level privacy regulations in the United States — following California's CCPA/CPRA and preceding similar laws in Colorado, Connecticut, Utah, and others — that collectively reshape how advertisers, publishers, data brokers, and ad tech platforms collect, process, and share consumer data. The opt-out right for targeted advertising directly challenges the behavioral advertising model that underpins much of the programmatic ecosystem, requiring industry participants to build opt-out signal infrastructure and reconsider data flows.

The VCDPA's enforcement accelerates a broader fragmentation of the U.S. privacy regulatory landscape, forcing AdTech companies to invest in compliance infrastructure that can handle state-by-state variations in consumer rights and opt-out mechanisms. Demand-side platforms (DSPs), data management platforms (DMPs), supply-side platforms (SSPs), and data brokers operating in Virginia must implement mechanisms to honor opt-out signals — increasingly transmitted via the IAB Tech Lab's Global Privacy Platform (GPP) and its Multi-State Privacy Agreement (MSPA) framework — or risk enforcement action. This compliance burden disproportionately affects smaller AdTech vendors with fewer resources to adapt. For large programmatic players such as The Trade Desk, Google, LiveRamp, and Oracle Advertising, the VCDPA reinforces the urgency of transitioning away from third-party cookie-dependent targeting toward first-party data strategies, contextual advertising, and privacy-preserving identity solutions. Publishers must update consent management platforms (CMPs) and privacy notices, while advertisers face potential audience scale reductions in Virginia as consumers exercise opt-out rights. The law also increases scrutiny on data broker practices, as the sale of personal data triggers opt-out rights, pressuring the data brokerage segment. Strategically, the VCDPA — alongside Colorado's CPA, Connecticut's CTDPA, and Utah's UCPA, all effective in 2023 — signals to the AdTech industry that a de facto national privacy standard is emerging through state legislation. This environment strengthens the competitive position of companies that have proactively built privacy-first infrastructure and first-party data capabilities, while creating headwinds for those reliant on opaque third-party data ecosystems. It also increases the likelihood of federal privacy legislation, which could eventually harmonize these requirements.