Virginia data privacy and data broker removal

Virginia has a comprehensive privacy law that gives you the right to access, delete, and control your personal data. Here is how those rights work in practice, and how to remove yourself from data brokers.

Your rights in Virginia

Virginia residents are protected by the Virginia Consumer Data Protection Act (VCDPA).

• Right to access and know: request a copy of the personal information a company holds about you.
• Right to correct: request corrections to inaccurate personal information.
• Right to delete: ask a company to delete your personal information.
• Right to data portability: get your data in a portable format you can take to another service.
• Right to opt out of sale: tell a company to stop selling your personal information.
• Right to opt out of targeted advertising: stop companies from targeting you with ads based on your personal data.
• Right to opt out of profiling: stop companies from building a behavioral profile about you.
• Right to appeal: challenge a company's decision to deny your privacy request.

Does this cover the company that has my data?

Most companies that collect or sell personal data in Virginia are likely covered. The VCDPA applies to a business if it controls or processes the personal data of at least 100,000 Virginia consumers in a year, or the data of at least 25,000 consumers while making more than half of its revenue from selling personal data. That threshold became the "Virginia model" many later state laws copied.

How to remove yourself from data brokers in Virginia

Virginia law gives you the right to request deletion, but exercising it everywhere your data shows up takes real effort. Here are the most effective steps, in order.

1. Enable Global Privacy Control

Global Privacy Control is a free browser setting that automatically tells every website you visit not to sell or share your data. It takes two minutes to turn on and works quietly in the background. Virginia does not mandate it yet, but most major companies honor it voluntarily because they already comply with California's law.

2. Submit direct opt-out requests

For brokers that don't honor GPC, you can submit requests directly. Look for the "Do not sell my personal information" link in each company's website footer. You can also file access, deletion, or correction requests through each company's privacy page.

Under Virginia's law, covered companies must respond within the statutory deadline. If they don't, you have grounds to file a complaint with the Virginia Attorney General.

3. Automate ongoing removal

Here is the part nobody tells you: even after you finish every step above, brokers re-ingest your information from public records, data-sharing networks, and commercial databases. Within a few months, your profiles reappear. Staying removed is not a one-time task; it is ongoing work that is hard to keep up with by hand.

Virginia's data broker law: what it means for you

Virginia does not have a dedicated data-broker registry. Most national data brokers are registered in California and honor opt-out requests from residents of any state. But without a Virginia law requiring it, you have little recourse if a broker ignores your request. Delist works across states and brokers so you don't have to chase each one.

Other privacy protections in Virginia

Beyond the comprehensive privacy law, Virginia has additional protections that may apply to you:

• A 2025 law (effective July 1, 2025) requires your consent before a company collects or shares reproductive or sexual-health information.
• An Address Confidentiality Program, run by the Virginia Office of the Attorney General, gives survivors of domestic violence, stalking, and sexual assault a substitute address to shield their real one.
• Virginia has no equivalent to New Jersey's Daniel's Law for public officials.
• Biometric data: Virginia has no standalone biometric-privacy statute, but biometric data counts as "sensitive data" under the VCDPA, so companies need your consent to collect it.

How to file a privacy complaint in Virginia

File with the Virginia Attorney General, Consumer Protection Section: oag.state.va.us/consumer-protection

Most state agencies enforce privacy laws in the aggregate. They investigate patterns of violations rather than resolving individual disputes. Filing a complaint still matters: it creates a record that can help trigger enforcement.

Frequently asked questions

Sources

• law.lis.virginia.gov
• oag.state.va.us
• huschblackwell.com