The Virginia Consumer Data Protection Act (VCDPA) took effect on January 1, 2023, making Virginia the second state, after California, to enact a comprehensive privacy law. California set the strongest standard, but many of the states that came after have followed Virginia's more limited model rather than California's. It lets Virginians access, correct, delete, and obtain a copy of their data and opt out of targeted advertising, data sales, and certain profiling.
This survey analyzes and compares data breach notification laws across all 50 U.S. states and the District of Columbia. Using a standardized framework of 50 questions, we examined each jurisdiction's requirements for breach notification timing, covered data types, notification recipients, enforcement mechanisms, and consumer remedies.
The survey reflects statutes enacted as of January 1, 2026.
The survey reflects statutes enacted as of January 1, 2026.