Virginia Information Technologies Agency (VITA) establishes accessibility standards aligned with Section 508 for Virginia state agencies.
Virginia Accessibility & Privacy Laws
Virginia was the second state after California to enact a comprehensive consumer privacy law. The Virginia Consumer Data Protection Act (VCDPA), effective January 1, 2023, provides important privacy rights to Virginia residents alongside VITA's accessibility requirements for state agencies.
→
Accessibility Standards
VITA Requirements
→
Privacy Law
VCDPA
Consumer data protection rights including access, correction, deletion, portability, and opt-out of targeted advertising.
VITA Accessibility Standards
The Virginia Information Technologies Agency requires all state agencies to meet digital accessibility standards aligned with Section 508 and WCAG 2.0 Level AA.
Covered Entities
- Virginia state government agencies
- State contractors and vendors
- Public educational institutions
- Local government entities receiving state funding
Virginia Consumer Data Protection Act (VCDPA)
Virginia's VCDPA became effective January 1, 2023, making Virginia the second state with a comprehensive consumer privacy law after California.
Who Must Comply?
Businesses that conduct business in Virginia or target Virginia residents AND:
- Control or process personal data of at least 100,000 Virginia consumers, OR
- Control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data
Consumer Rights Under VCDPA
| Right | Description |
|---|---|
| Right to Access | Confirm whether data is being processed and access that data |
| Right to Correct | Correct inaccuracies in personal data |
| Right to Delete | Delete personal data provided by or obtained about the consumer |
| Right to Portability | Obtain a copy of data in portable, readily usable format |
| Right to Opt Out | Opt out of targeted advertising, sale of data, and profiling |
Sensitive Data
VCDPA requires opt-in consent before processing sensitive personal data, including:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexual orientation
- Citizenship or immigration status
- Genetic or biometric data
- Personal data from children
- Precise geolocation data
Enforcement
| Aspect | Details |
|---|---|
| Enforcing Authority | Virginia Attorney General (exclusive enforcement) |
| Cure Period | 30 days to cure violations after notice |
| Penalties | Up to $7,500 per violation |
| Private Right of Action | No private right of action |