California was the first US state in which the personal data privacy law became effective on January 1, 2020. Virginia is the second state after California to officially instrument comprehensive consumer privacy legislation, which will take effect on January 1, 2023.
Even the scope and purposes of California's CCPA and Virginia's VCDPA share similarities and were developed to protect consumers' private data, there are several differences between them:
- The opt-out right of VCDPA is broader. Unlike California’s CCPA, the VCDPA’s opt-out right is much broader and includes not only prohibiting the selling of personal data but also includes opting out of targeted advertisement, profiling, and more.
- VCDPA protects Virginia residents' privacy stricter. Unlike California’s CCPA, the VCDPA requires businesses to delete personal data upon user request that also includes data concerning a Virginia resident, not only collected directly from him.
- Under the CCPA, consumers have a private right of action, while under the VCDPA they do not have. Under California’s CCPA, any company, organization, or individual has the right of action, while Virginia residents themselves under the VCDPA do not have a private right of action. Virginia residents themselves cannot sue companies for VCDPA violations, only Virginia Attorney General could enforce violations.
- VCDPA has more exemptions. Unlike California’s CCPA, the VCDPA includes more exemptions to compliance for small businesses, financial institutions, health and insurance sectors.
- Businesses in Virginia must satisfy a threshold to fall within the scope of the law. Under California’s CCPA, small entities were left to question whether the processing of data subjected them, while the VCDPA clearly defines the threshold for small entities, based on annual gross revenue.
- Different treatment of consumers enrolled in loyalty programs. California’s CCPA states that its residents have the right to equal services and prices, and the consumers could not be discriminated against based on different dealings with the privacy law. Unlike California’s CCPA, the VCDPA explicitly allows businesses to offer different prices and levels of service to consumers enrolled in loyalty programs without having to comply with the law.
Not sure if your website complies with the data privacy laws of different US states? Use CookieScript Consent Management Platform, which uses geo-targeting and could detect the consumer's geographical location and apply the adequate privacy law. We regularly update the latest privacy regulations, so you do not miss new privacy laws coming into force.