The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and Virginia’s Consumer Data Protection Act (VCDPA) both give consumers rights over their personal data.

CCPA vs VCDPA: Overview

The CCPA took effect on January 1, 2020, and the CPRA’s amendments on January 1, 2023. The VCDPA was enacted in 2021 and took effect on January 1, 2023.

CCPA vs VCDPA: Key Differences

  1. Coverage: The CCPA applies to for-profit businesses doing business in California that meet at least one threshold: annual gross revenue over $26,625,000; buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or deriving 50% or more of revenue from selling or sharing personal information. The VCDPA applies to those doing business in Virginia, or targeting products or services to Virginia residents, that in a calendar year control or process the personal data of at least 100,000 Virginia consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data. It has no revenue-only threshold and excludes, among others, Virginia public bodies, non-profit organizations and higher education institutions.
  2. Who is a consumer: Under the VCDPA, a consumer is a Virginia resident acting in an individual or household context, not in a commercial or employment context. The CCPA defines a consumer as any natural person who is a California resident.
  3. Sale and opt-out: The CCPA defines selling as making personal information available to a third party for money or other valuable consideration, and its opt-out also covers sharing for cross-context behavioral advertising. The VCDPA defines a sale as an exchange for monetary consideration, and lets consumers opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.
  4. Sensitive data: The VCDPA requires consent before processing sensitive data, such as data revealing health diagnoses or religious beliefs, biometric data used to identify a person, and precise geolocation; data about a known child must instead be processed in line with the federal Children’s Online Privacy Protection Act. The CCPA instead gives consumers the right to limit a business’s use and disclosure of sensitive personal information to purposes the law permits, such as providing the goods or services the consumer requested (sensitive personal information collected or processed without the purpose of inferring characteristics about the consumer is outside this right), and requires opt-in authorization before selling or sharing personal information of consumers known to be under 16.
  5. Enforcement: Only the Virginia Attorney General can enforce the VCDPA. The Attorney General must first give 30 days’ written notice, and cannot sue a business that cures the violation in that time and gives a written statement saying so, unless that statement is later breached. Otherwise, civil penalties of up to $7,500 per violation are available. The VCDPA gives no private right of action. The CCPA is enforced by the California Privacy Protection Agency and the Attorney General, with fines and civil penalties of up to $2,663 per violation, or $7,988 per intentional violation or violation involving minors’ personal information (for administrative fines, where the business actually knows the consumer is under 16), and consumers can sue only over certain data breaches caused by inadequate security.

Conclusion

Both laws rely mainly on notice and opt-out rights. The VCDPA requires consent for sensitive data and is enforced only by the Attorney General; the CCPA has its own enforcement agency and allows lawsuits over certain data breaches.

This article is general information, not legal advice.