Virginia Consumer Data Protection Act

Applies to entities controlling/processing data of 100,000+ Virginia consumers, or 25,000+ if 50%+ of revenue comes from selling personal data. SB 338 (signed Apr 13, 2026, effective Jul 1, 2026) replaced the VCDPA's prior consent-based treatment of precise geolocation with an outright ban on selling or offering to sell it — consent no longer cures the sale. "Precise geolocation" means a location identified within a 1,750-foot radius. Virginia joined Maryland and Oregon as the states banning these sales outright; Connecticut follows on Oct 1, 2026.