On March 2, 2021, the Virginia Consumer Data Protection Act (CDPA) was signed into law, joining California as the only states to have passed comprehensive privacy legislation to date. The CDPA goes into effect on January 1, 2023. Notably, this date coincides with the effective date of the new substantive obligations set forth in the California Privacy Rights Act (CPRA), the recently passed law that amends the California Consumer Privacy Act (CCPA).

The new Virginia law bears many similarities to the CCPA and CPRA, as well as the EU's General Data Protection Regulation (GDPR), although it has enough differences to increase compliance challenges for affected businesses moving forward.