California and Virginia share several privacy-program controls, but their scope tests, sale definitions, sensitive-data rules, assessments, and enforcement routes differ.
Apply each law to the same entity, consumer, purpose, data category, recipient, and system before deciding what evidence can be reused.
The CCPA as amended by the CPRA and the core (VCDPA) took effect on January 1, 2023. Virginia has since amended the VCDPA, including by adding rules for known children's data and social media services used by minors. They remain separate state laws: California regulates qualifying businesses and defined recipient roles, while Virginia regulates qualifying controllers and processors. Coverage or compliance under one law does not establish coverage or compliance under the other.
Side-by-side comparison
CPRA vs Virginia VCDPA
Apply every row to the same entity and processing activity. Keep separate conclusions where definitions, exemptions, or duties diverge.
California regulates qualifying businesses and defined recipients under its own sale, sharing, rights, sensitive-information, and enforcement rules.
Second framework
Virginia VCDPA
Virginia regulates qualifying controllers and processors and has separate consent, appeal, assessment, contract, and Attorney General enforcement rules.
A qualifying for-profit entity doing business in California is a business if it meets a statutory route: annual gross revenue above the adjusted threshold; buying, selling, or sharing personal information of 100,000 or more consumers or households; or deriving at least 50% of annual revenue from selling or sharing consumers' personal information. Other affiliate, joint-venture, and voluntary-certification routes can apply.
Subdivision (d) defines a California business and its threshold routes.
The VCDPA covers a person conducting business in Virginia or producing products or services targeted to Virginia residents if it controls or processes personal data of at least 100,000 consumers in a calendar year, or at least 25,000 consumers and derives more than 50% of gross revenue from selling personal data.
Section 59.1-576 states the VCDPA scope thresholds and entity exemptions.
Virginia has no standalone gross-revenue route. California's volume route includes households and buying, selling, or sharing, while Virginia's count is tied to Virginia consumers and controlling or processing personal data.
California's consumer definition is tied to California residency and is not restricted to a personal or household context. California includes multiple activity- and data-specific exemptions, including provisions involving regulated health and financial information.
The statute defines consumer and lists California exemptions and limitations.
A Virginia consumer is a Virginia resident acting only in an individual or household context, not an employment or commercial context. Virginia also exempts listed entities, including state bodies, financial institutions or data subject to the GLBA, HIPAA-covered entities and business associates, and nonprofit organizations.
The Virginia Code defines consumer and identifies excluded entities.
A Virginia entity exemption may remove the entity from the VCDPA while a narrower California data exemption leaves other California processing in scope.
California provides rights to know or access, delete, correct, opt out of sale or sharing, limit certain uses and disclosures of sensitive personal information, and receive non-discriminatory treatment. California's detailed response and verification rules vary by request.
Virginia provides confirmation and access, correction, deletion, portability, and opt-outs from targeted advertising, sale, and specified profiling. A controller must provide a conspicuous appeal process and explain how a denied appeal can be taken to the Attorney General.
California sale includes specified disclosures for monetary or other valuable consideration. Sharing separately covers cross-context behavioral advertising whether or not consideration is exchanged. California's current automated-decisionmaking duties must be assessed under the applicable regulations and triggers.
The statute separately defines California sale and sharing.
Virginia sale is an exchange of personal data for monetary consideration, subject to listed exclusions. Consumers can also opt out of targeted advertising and profiling used to further decisions that produce legal or similarly significant effects.
The Virginia Code defines sale, targeted advertising, profiling, and the related opt-outs.
A transfer can fall outside Virginia sale yet remain Virginia targeted advertising, California sharing, or California sale. Record each classification separately.
California defines sensitive personal information and provides a right to limit uses and disclosures outside specified permitted purposes. The right is not a general requirement to obtain consent before every sensitive-information use. California separately requires affirmative authorization before selling or sharing the personal information of a consumer the business knows is under 16, with parental or guardian authorization for a consumer under 13.
Subdivision (c) establishes the affirmative-authorization rules for sale or sharing when the business knows the consumer is under 16.
Virginia prohibits processing sensitive data without the consumer's consent. For a known child's sensitive data, the controller must comply with COPPA. Virginia also prohibits selling or offering to sell precise geolocation data and now imposes additional conditions on specified processing of known children's personal data and on social media platforms used by minors.
The current chapter includes the known-child processing, parental-consent, child-focused assessment, and social-media-minor provisions.
Use separate state rules for sensitive data and age-related processing. Record the consumer's age or knowledge trigger, the activity, the required consent or authorization, the decision right, and any service-specific condition under each law.
California requires role-specific terms for service providers, contractors, and third parties. California risk assessments apply under separate regulatory triggers and cannot be presumed identical to another state's assessment.
The CPPA regulations establish current California recipient-contract and risk-assessment requirements.
Virginia controller-processor contracts must cover instructions, nature and purpose, data type, duration, rights and duties, confidentiality, deletion or return, assessment support, audits, and subcontractors. Controllers must assess targeted advertising, sale, sensitive data, specified profiling, and other processing that presents a heightened risk of harm. The assessment requirement applies to processing created or generated after January 1, 2023.
These sections specify processor contracts, assessment triggers, required analysis, regulator access, reuse, and the January 1, 2023 non-retroactivity rule.
A shared contract or assessment can reuse processing facts, but it must satisfy each state's role, trigger, content, and timing rules.
The California Privacy Protection Agency can bring administrative actions, and the California Attorney General can bring civil actions. California has a limited private cause of action for specified security incidents, not for every CCPA violation.
Sections 1798.150, 1798.155, and 1798.199.10 et seq. establish California remedies and enforcement authority.
The Virginia Attorney General has exclusive VCDPA enforcement authority. Before bringing an action, the Attorney General must give 30 days' written notice; if the controller or processor cures the alleged violation within that period and gives the required written statement, no action is initiated for that notice.
Section 59.1-584 gives the Attorney General exclusive authority and states the 30-day notice-and-cure procedure.
Do not import Virginia's cure process into a California response plan or describe either law as creating a general consumer right to sue for every violation.
The Attorney General summary explains the VCDPA enforcement and cure process.
Scope thresholds
California CCPA as amended by CPRA
A qualifying for-profit entity doing business in California is a business if it meets a statutory route: annual gross revenue above the adjusted threshold; buying, selling, or sharing personal information of 100,000 or more consumers or households; or deriving at least 50% of annual revenue from selling or sharing consumers' personal information. Other affiliate, joint-venture, and voluntary-certification routes can apply.
Subdivision (d) defines a California business and its threshold routes.
Virginia VCDPA
The VCDPA covers a person conducting business in Virginia or producing products or services targeted to Virginia residents if it controls or processes personal data of at least 100,000 consumers in a calendar year, or at least 25,000 consumers and derives more than 50% of gross revenue from selling personal data.
Section 59.1-576 states the VCDPA scope thresholds and entity exemptions.
Operational implication
Virginia has no standalone gross-revenue route. California's volume route includes households and buying, selling, or sharing, while Virginia's count is tied to Virginia consumers and controlling or processing personal data.
The Virginia definitions and scope provision control the threshold calculation.
Consumers and exemptions
California CCPA as amended by CPRA
California's consumer definition is tied to California residency and is not restricted to a personal or household context. California includes multiple activity- and data-specific exemptions, including provisions involving regulated health and financial information.
The statute defines consumer and lists California exemptions and limitations.
Virginia VCDPA
A Virginia consumer is a Virginia resident acting only in an individual or household context, not an employment or commercial context. Virginia also exempts listed entities, including state bodies, financial institutions or data subject to the GLBA, HIPAA-covered entities and business associates, and nonprofit organizations.
The Virginia Code defines consumer and identifies excluded entities.
Operational implication
A Virginia entity exemption may remove the entity from the VCDPA while a narrower California data exemption leaves other California processing in scope.
The provision distinguishes entity exemptions from listed data exemptions.
Consumer rights and appeals
California CCPA as amended by CPRA
California provides rights to know or access, delete, correct, opt out of sale or sharing, limit certain uses and disclosures of sensitive personal information, and receive non-discriminatory treatment. California's detailed response and verification rules vary by request.
Virginia provides confirmation and access, correction, deletion, portability, and opt-outs from targeted advertising, sale, and specified profiling. A controller must provide a conspicuous appeal process and explain how a denied appeal can be taken to the Attorney General.
The regulations supply California request and verification procedures.
Sale, sharing, advertising, and profiling
California CCPA as amended by CPRA
California sale includes specified disclosures for monetary or other valuable consideration. Sharing separately covers cross-context behavioral advertising whether or not consideration is exchanged. California's current automated-decisionmaking duties must be assessed under the applicable regulations and triggers.
The statute separately defines California sale and sharing.
Virginia VCDPA
Virginia sale is an exchange of personal data for monetary consideration, subject to listed exclusions. Consumers can also opt out of targeted advertising and profiling used to further decisions that produce legal or similarly significant effects.
The Virginia Code defines sale, targeted advertising, profiling, and the related opt-outs.
Operational implication
A transfer can fall outside Virginia sale yet remain Virginia targeted advertising, California sharing, or California sale. Record each classification separately.
The regulations govern California opt-out signals and applicable automated-decisionmaking requirements.
Sensitive data and consent
California CCPA as amended by CPRA
California defines sensitive personal information and provides a right to limit uses and disclosures outside specified permitted purposes. The right is not a general requirement to obtain consent before every sensitive-information use. California separately requires affirmative authorization before selling or sharing the personal information of a consumer the business knows is under 16, with parental or guardian authorization for a consumer under 13.
Subdivision (c) establishes the affirmative-authorization rules for sale or sharing when the business knows the consumer is under 16.
Virginia VCDPA
Virginia prohibits processing sensitive data without the consumer's consent. For a known child's sensitive data, the controller must comply with COPPA. Virginia also prohibits selling or offering to sell precise geolocation data and now imposes additional conditions on specified processing of known children's personal data and on social media platforms used by minors.
The current chapter includes the known-child processing, parental-consent, child-focused assessment, and social-media-minor provisions.
Operational implication
Use separate state rules for sensitive data and age-related processing. Record the consumer's age or knowledge trigger, the activity, the required consent or authorization, the decision right, and any service-specific condition under each law.
The California statute supplies the under-16 authorization rule and the definitions used to apply it.
Processor contracts and assessments
California CCPA as amended by CPRA
California requires role-specific terms for service providers, contractors, and third parties. California risk assessments apply under separate regulatory triggers and cannot be presumed identical to another state's assessment.
The CPPA regulations establish current California recipient-contract and risk-assessment requirements.
Virginia VCDPA
Virginia controller-processor contracts must cover instructions, nature and purpose, data type, duration, rights and duties, confidentiality, deletion or return, assessment support, audits, and subcontractors. Controllers must assess targeted advertising, sale, sensitive data, specified profiling, and other processing that presents a heightened risk of harm. The assessment requirement applies to processing created or generated after January 1, 2023.
These sections specify processor contracts, assessment triggers, required analysis, regulator access, reuse, and the January 1, 2023 non-retroactivity rule.
Operational implication
A shared contract or assessment can reuse processing facts, but it must satisfy each state's role, trigger, content, and timing rules.
Virginia permits one assessment for comparable processing and recognizes assessments under other laws when scope and effect are reasonably comparable.
Enforcement and cure
California CCPA as amended by CPRA
The California Privacy Protection Agency can bring administrative actions, and the California Attorney General can bring civil actions. California has a limited private cause of action for specified security incidents, not for every CCPA violation.
Sections 1798.150, 1798.155, and 1798.199.10 et seq. establish California remedies and enforcement authority.
Virginia VCDPA
The Virginia Attorney General has exclusive VCDPA enforcement authority. Before bringing an action, the Attorney General must give 30 days' written notice; if the controller or processor cures the alleged violation within that period and gives the required written statement, no action is initiated for that notice.
Section 59.1-584 gives the Attorney General exclusive authority and states the 30-day notice-and-cure procedure.
Operational implication
Do not import Virginia's cure process into a California response plan or describe either law as creating a general consumer right to sue for every violation.
What should a California-Virginia comparison decide?
First decide scope. California has a for-profit business test with three main threshold routes. Virginia applies to a person doing business in Virginia or targeting Virginia residents if it controls or processes personal data of at least 100,000 Virginia consumers in a calendar year, or at least 25,000 consumers while deriving more than 50% of gross revenue from personal-data sales.
Then classify the same processing under both laws. Virginia's consumer definition excludes employment and commercial contexts, its sale definition requires monetary consideration, and its sensitive-data rule requires consent. California uses broader sale and separate sharing concepts and gives consumers a conditional right to limit certain sensitive-personal-information uses.
Calculate each state's threshold with its own consumer, household, revenue, sale, and sharing definitions.
Record whether an entity-level or data-level exemption applies and why; the exemption structures are different.
Classify each recipient as a California service provider, contractor, or third party and as a Virginia processor or third party.
Separate sale, sharing, targeted advertising, profiling, sensitive data, and child-data decisions.
Identify which request, consent, opt-out, appeal, contract, assessment, or enforcement branch the processing triggers.
The official Virginia Code provides the VCDPA definitions, scope, exemptions, rights, controller and processor duties, assessments, and enforcement provisions.
2
Section 2
How should a shared privacy program branch by state?
Reuse the facts, not the legal conclusion. One data inventory, rights portal, vendor register, consent service, and assessment library can support both states, but the workflow must apply the correct definitions and exceptions before closing either requirement.
Virginia requires an appeal process after a controller refuses a consumer request and gives the Attorney General exclusive enforcement authority with a statutory 30-day notice-and-cure process. California does not use that Virginia appeal or cure structure and has both CPPA administrative enforcement and Attorney General civil enforcement.
Rights workflow: support access, correction, deletion, portability, and relevant opt-outs, then add Virginia's appeal and complaint route.
Advertising workflow: test California sale and sharing separately from Virginia sale and targeted advertising.
Sensitive-data workflow: obtain Virginia consent where required; for California, determine whether the use triggers the right to limit.
Contract workflow: use a common processing schedule but add the terms required for the recipient's role in each state.
Assessment workflow: apply Virginia's listed data-protection-assessment triggers, including targeted advertising, sale, sensitive data, specified profiling, and other heightened-risk processing.
Evidence: retain the state finding, request or signal, consumer response, downstream action, exception, test result, owner, and review date.
Current official Virginia statutory text for the VCDPA.
The official Virginia Code provides the VCDPA definitions, scope, exemptions, rights, controller and processor duties, assessments, and enforcement provisions.
Sections 59.1-577 through 59.1-584 establish Virginia rights, appeals, duties, contracts, assessments, and enforcement.
Show 3 more
The Virginia definitions and scope provision control the threshold calculation.
The current chapter includes the known-child processing, parental-consent, child-focused assessment, and social-media-minor provisions.
These sections specify processor contracts, assessment triggers, required analysis, regulator access, reuse, and the January 1, 2023 non-retroactivity rule.