VCDPA: Virginia's law explained for those with ads

Show clearly how to opt out

If the site does targeted advertising or sells data, it must say so clearly and visibly, along with how to opt out. The law does not define the link text.

Publish a complete privacy notice

The notice lists the categories of data, the purposes, how to exercise rights and appeal, the data shared with third parties and the types of third parties.

Do not require a new account

The channels for exercising rights must be secure and reliable and cannot require the visitor to create an account.

Ask for consent for sensitive data

Sensitive data can only be processed with consent. For a known child, parental consent in the format of the COPPA law applies, and the law prohibits selling precise location.

Respond and accept appeals

The response comes within 45 days, extendable once by another 45, and is free up to twice a year. The appeal gets a response in 60 days, with the path to complain to the attorney general.

Do the data protection assessment

Targeted advertising, sale of data, risky profiling and sensitive data require a documented assessment, for activities created after January 1, 2023.

Do not treat people worse for exercising rights

The site cannot deny service or charge a different price to someone who used the rights in the law.

Pass the opt-out to Google

In the Virginia section or the US National section of the GPP string, an opt-out of sale or targeted advertising turns on RDP. Google's US states message also covers Virginia.

// GPT: liga o processamento restrito de dados (RDP)
// para quem recusou a venda ou a publicidade direcionada
googletag.cmd.push(function () {
  googletag.pubads().setPrivacySettings({
    restrictDataProcessing: true
  });
});