The Virginia Consumer Data Protection Act (CDPA)

Defines “personal data” as “any information that is linked or reasonably linkable to an identified or identifiable natural person”

Provides consumers with rights to confirmation of processing and access to personal data, correction of personal data, deletion , portability  and opt-out of processing for targeted ads, sale of personal data, or  profiling   

Requires controllers to carry out data protection assessments of processing activities that involve personal data used for targeted advertising, the sale of personal data, profiling, the use of sensitive data, and the use of any data that presents a heightened risk of harm to consumers

Defines “consent” as “a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer”

Applies to organizations that conduct business in Virginia or produce products or services targeted at Virginia residents and that control or process personal data of at least 100k consumers annually, or   control or process personal data of at least 25K consumers and get over 50% of gross revenue from the sale of personal information  

Allows Attorney General to enforce the law, as there is no provision for a private right of action