Virginia Attorney General Jay Jones has emphasized the data privacy rights of residents during National Consumer Protection Week. He highlighted the Virginia Consumer Data Protection Act (VCDPA), which positions Virginia as one of the first states in the country to enact a comprehensive data privacy law.
“Virginians have the right to their personal data under Virginia law,” said Attorney General Jones. “Standing up for every Virginian means using every tool at our disposal to put Virginians first, protect them from bad actors, and ensure that their rights are protected, including the right to protect their data and privacy.”
Attorney General Jones pointed out that as technology advances, companies can collect and sell significant amounts of personal information with little oversight. The Electronic Privacy Information Center notes that “[t]housands of data brokers in the United States buy, aggregate, disclose, and sell billions of data elements on Americans with virtually no oversight.” As online activity increases, so does the potential for companies to gather more consumer information without direct consent.
The VCDPA gives residents certain rights over their personal information held by businesses. The law broadly defines personal data as any information linked or reasonably linkable to an identifiable person that is not publicly available. This includes details such as home address, email address, phone number, Social Security number, birth date, order history, and search history.
There are additional protections for sensitive data categories such as racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship status, genetic or biometric identifiers used for unique identification, children’s data (under 13), and precise geolocation. Businesses must obtain explicit consent before processing this type of information.
For example, companies holding personal data from more than 100,000 Virginians—such as grocery chains or social media platforms—must comply with requests from individuals who want their information deleted or wish to receive a copy of what is stored about them. If sensitive personal data is involved—for instance relating to religious beliefs or racial origin—the company must get consumer consent before processing it.
Businesses covered by the law are also required to provide clear privacy notices explaining how consumers can exercise their rights and how their information will be used. They must also disclose if they sell personal data for targeted advertising purposes.
Residents who believe their VCDPA rights have been violated can file complaints with the Virginia Attorney General’s Office through its official complaint portal: https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.
The Attorney General has enforcement authority under the VCDPA. If violations occur, businesses have 30 days after notification to correct them; otherwise legal action may be taken and civil penalties up to $7,500 per violation may be imposed.
The office also provides resources on civil rights enforcement and victim assistance programs as described on its website. In addition to protecting consumer privacy rights under laws like VCDPA,the office addresses issues such as human trafficking and domestic violence through legal advocacy efforts.It offers services including identity theft protection resources for residents across Virginia.The Attorney General serves all regions within the Commonwealth while providing counsel to state agencies,promoting public safety and defending constitutional rights.Miyares currently holds the position as Virginia’s 48th Attorney General.
Consumers seeking further assistance can call the Consumer Protection Hotline at 1-800-552-9963 (within Virginia) or (804) 786-2042 (from Richmond area or outside Virginia).
