The Virginia legislature, which adjourned its annual legislative session last week, passed the second state-level consumer data privacy law in the nation. The Virginia Consumer Data Protection Act (CDPA) was signed into law by Virginia Governor Ralph Northam on March 2, 2021, and will go into effect January 1, 2023. Virginia joins California as the second state to enact comprehensive data privacy protections for its residents.
The Virginia Attorney General (AG) will be the main interpreter and enforcer of the new law. The CDPA gives the AG exclusive enforcement authority–there is no private right of action. Without a private right of action, the AG alone will control how the CDPA will be enforced.