Virginia's privacy law and your data: what the VCDPA lets you ask a data broker to delete

If you live in Virginia, the Consumer Data Protection Act (VCDPA, Code of Virginia 59.1-575 and following, in effect since January 1, 2023 per the Attorney General) says a covered company "shall comply with an authenticated consumer request" to "delete personal data provided by or obtained about the consumer." The company has 45 days to answer, may extend once by 45 days, and must offer an appeal it answers within 60 days. Only the Attorney General can enforce the law. Two limits matter for data brokers: the law covers only companies above a size threshold, and "personal data" excludes "publicly available information," which includes government records. A people-search listing built from public records may be outside the law's reach.

What the VCDPA lets you ask for

Section 59.1-577 lists five things a "consumer" (a "natural person who is a resident of the Commonwealth acting only in an individual or household context," per the definitions) can ask a "controller" to do. A controller "shall comply with an authenticated consumer request to exercise the right":

1. "To confirm whether or not a controller is processing the consumer's personal data and to access such personal data;"
2. "To correct inaccuracies in the consumer's personal data";
3. "To delete personal data provided by or obtained about the consumer;"
4. "To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable" format;
5. "To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer."

The deletion wording matters for data brokers: "provided by or obtained about the consumer" is not limited to data you handed over yourself. A 2022 amendment (history line "2022, c. 423", enacted as HB 381) added subdivision B 5 for that case. A controller "that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer's request to delete such data" by either "retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer's personal data remains deleted" or "opting the consumer out of the processing of such personal data for any purpose except for those exempted." In plain terms, a broker that bought your data can satisfy a deletion request with a suppression record, or by opting you out of everything but the exempt purposes. It does not have to wipe every trace.

A "known child's parent or legal guardian may invoke such consumer rights on behalf of the child." A "child" is "any natural person younger than 13 years of age."

How to send a request

The statute prescribes no form. It describes the company's side.

Where. Section 59.1-578 says a controller "shall establish, and shall describe in a privacy notice, one or more secure and reliable means for consumers to submit a request," and "shall not require a consumer to create a new account." Start with the broker's privacy policy; it should name the channel.

What to write. A consumer invokes the rights "by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke." Name the rights (delete, and if you want, opt out of sale and a copy) and give the identifiers the broker would hold: name, past addresses, email addresses, phone numbers.

Authentication. If a controller "is unable to authenticate the request using commercially reasonable efforts," it "shall not be required to comply" and "may request that the consumer provide additional information reasonably necessary to authenticate." The statute does not say what. Our own rule is never to send an ID document to a data broker; How to remove your information from the internet covers what we send instead.

The clock. The controller "shall respond to the consumer without undue delay, but in all cases within 45 days of receipt." The period "may be extended once by 45 additional days when reasonably necessary," if the controller tells you within the first 45 days "together with the reason." Responses are "free of charge, up to twice annually per consumer"; for "manifestly unfounded, excessive, or repetitive" requests the controller may charge a fee or decline.

Refusal and appeal. A controller that declines "shall inform the consumer" within the same 45 days "of the justification for declining to take action and instructions for how to appeal." "Within 60 days of receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken," with reasons. If the appeal is denied, the controller "shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint."

Complaint and enforcement. The Attorney General's summary says consumers "can file complaints with the Virginia Attorney General's Office if an appeal by the controller is declined," at the File a Complaint page (hotline 1-800-552-9963 from Virginia, (804) 786-2042 otherwise). Section 59.1-584: "The Attorney General shall have exclusive authority to enforce the provisions of this chapter." Before any action, the Attorney General "shall provide a controller or processor 30 days' written notice"; if the company cures and promises in writing not to repeat it, "no action shall be initiated." After that come injunctions and "civil penalties of up to $7,500 for each violation." Subsection E: "Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action." You cannot sue under this law. The Attorney General's March 4, 2026 news release names no enforcement action under the VCDPA.

Who the law covers and who it does not

Thresholds. Section 59.1-576 applies the chapter to persons that do business in Virginia or target its residents "and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data." A small site below both lines is out, and only the broker or the Attorney General can say which side it is on.

Exempt entities and data. The chapter "shall not apply" to government bodies, Gramm-Leach-Bliley financial institutions, HIPAA covered entities, nonprofits, and institutions of higher education. Exempt data includes consumer-report activity "regulated by and authorized under the federal Fair Credit Reporting Act" and data handled "in compliance with the federal Driver's Privacy Protection Act."

Publicly available information. This is the big one for people-search sites. "'Personal data' does not include de-identified data or publicly available information," and the latter means "information that is lawfully made available through federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience." The Attorney General's summary puts it shorter: personal data "does not include publicly available information such as public records held by the government." A listing assembled from property, court or voter records may fall outside "personal data" as defined, in which case the deletion right does not attach to it. Where a broker has mixed public records with data it bought (email addresses, phone numbers, inferred interests), that part is a different question, and the broker decides first.

Data the broker cannot match or does not sell. Section 59.1-581 says a controller need not comply when it "is not reasonably capable of associating the request with the personal data," does not use it "to recognize or respond to the specific consumer," and "does not sell the personal data to any third party." A broker that sells the data cannot use this exemption. Section 59.1-582 lets a controller keep data to "comply with federal, state, or local laws," "defend legal claims," or respond to "identity theft, fraud"; the controller "bears the burden of demonstrating that such processing qualifies for the exemption."

No registry. No section of the chapter creates a data broker registry or a central deletion mechanism. To learn who holds data on you, you search for yourself; our data broker directory is one place to start, and What is a data broker explains the companies involved.

Amendments since 2023. Section 59.1-578 F (the section's history line includes "2024, cc. 840, 844") bars processing "personal data collected from a known child" for targeted advertising, sale or profiling without parental consent under COPPA. Section 59.1-577.1 (history "2025, c. 703") tells social media platforms to screen for users under 16 and "limit a minor's use of such social media platform to one hour per day"; the bill summary for SB 854 gives it "a delayed effective date of January 1, 2026." Section 59.1-578 A 6 (the history line includes "2026, c. 820") says a controller shall "Not sell or offer for sale precise geolocation data concerning a consumer," which the Attorney General's summary dates to July 1, 2026. None of these touch the deletion process.

Virginia vs California

California has a data broker registry and, since January 1, 2026, DROP, one free request sent to over 600 registered data brokers; see California's Delete Act and DROP. Virginia has neither. The VCDPA gives Virginians one request per company, a 45-day clock per company, and an appeal per company, with no registration duty, no public list, and a 30-day cure period before the Attorney General can act.

Practical order

1. Search your name and list the sites that show you. That is the people-search layer. Our people-search directory has a per-site guide for the sites we have tested.
2. Use each people-search site's own opt-out first. It is faster than a statutory request, works wherever you live, and sidesteps the public-records question: the site removes a listing instead of deciding what counts as "personal data."
3. Send VCDPA requests to brokers that hold more than public records. Marketing-data brokers, identity-resolution vendors, sites showing email addresses, phone numbers or inferred interests. Find the channel in the privacy notice, name the rights, give the identifiers they would match on.
4. Keep records. Date sent, channel, what you asked for, the reply, the 45-day date, any extension and its reason. A refusal must come with appeal instructions; appeal, and note the 60-day date.
5. Complain if the appeal is denied. The Attorney General's summary says that is the point at which to file.
6. Re-check. A broker that kept a suppression record under 59.1-577 B 5 should not re-add you, but a public-records listing can return when the records refresh. Search your name again on a schedule; the routine is in How to remove your information from the internet.

None of this guarantees a result. A broker below the threshold, an exempt entity, or a public-records listing can each say no with the statute on their side.

If you are at risk

If someone is using your address or phone number to stalk, harass or threaten you, do not wait on a 45-day clock. Contact local law enforcement first. The VCDPA is a consumer-rights process with an Attorney General complaint at the end, not an emergency tool, and the consumer hotline above is not a crisis line.

FAQ

Can I make a company delete my data in Virginia? The VCDPA says a controller shall comply with an authenticated consumer request to delete personal data provided by or obtained about the consumer. That applies only to companies that meet the law's thresholds and are not exempt, and personal data by definition excludes publicly available information. Read section 59.1-577 before relying on it.

How long does a company have to answer a VCDPA request? The statute says a controller shall respond without undue delay, but in all cases within 45 days of receipt. It may extend once by 45 additional days when reasonably necessary, if it tells you within the first 45 days and gives a reason. An appeal gets a written answer within 60 days.

Does the VCDPA cover people-search sites? It depends on the site. The law covers persons that control or process personal data of at least 100,000 consumers, or 25,000 consumers plus over 50 percent of revenue from selling personal data. Personal data excludes publicly available information, which includes government records. Many people-search listings are built from such records, so a request may not reach them.

Can I sue a data broker under the VCDPA? No. The statute says the Attorney General shall have exclusive authority to enforce it and that nothing in the chapter shall be construed as providing the basis for a private right of action. You can file a complaint with the Virginia Attorney General, who can seek civil penalties of up to $7,500 per violation after a 30-day cure period.