# Automate your CDPA Compliance with CookieYes > For the complete site index, see [llms.txt](/llms.txt). Every page is also available as Markdown: replace the trailing slash with `.md` (`/pricing/` becomes `/pricing.md`), or send `Accept: text/markdown` to the page URL itself. > Virginia's new data privacy law CDPA is here! Get ready to meet CDPA compliance requirements and mitigate your legal risks. **Source:** https://www.cookieyes.com/cdpa-compliance/ --- # Privacy-proof your website for CDPA compliance Implement all your CDPA compliance requirements under one roof! Display an opt-out notice and provide privacy disclosures for foolproof compliance. [Become CDPA Compliant](https://app.cookieyes.com/trial?plan=pro-monthly&ref=lp_CDPA_hero) 14-day free trial Cancel anytime ![Privacy-proof your website for CDPA compliance](https://assets.cookieyes.com/cdpa_hero_2c96d573c8.svg) ## The #1 cookie consent solution, trusted by 1.5 Million+ websites ![Decathlon](https://assets.cookieyes.com/decathlon_a23456d440.svg) ![KFC](https://assets.cookieyes.com/kfc_73dc90db22.svg) ![Dominos](https://assets.cookieyes.com/dominos_9ce9dc7569.svg) ![Heineken](https://assets.cookieyes.com/heineken_f0fca7d239.svg) ![Forbes](https://assets.cookieyes.com/forbes_b76200d4a5.svg) ![Toyota](https://assets.cookieyes.com/toyota_71a8106b6a.svg) ![Renault](https://assets.cookieyes.com/renault_d254f28337.svg) ## Check your CDPA Compliance CookieYes will scan your website and keep you informed on the personal data your website collects through cookies. ![Cookie Scanner](https://assets.cookieyes.com/cookie_scanner_img_dbb23c8c7a.svg) ![CDPA compliance overview](https://assets.cookieyes.com/cdpa_launch_e5b47937d9.svg) The Virginia Consumer Data Protection Act (CDPA) is a state-wide data privacy law that applies to businesses that process the personal information of Virginia residents. The CDPA regulates how businesses process consumers' personal information and provides them with rights over their data. Virginia CDPA came into effect on January 1, 2023. ## CDPA Compliance Checklist for Websites - Provide opt-out from the sale of personal data, targeted advertising and profiling - Include an up-to-date and accessible privacy policy and cookie policy - Limit data collection only for relevant data and legitimate purposes ## Prepare for CDPA compliance with CookieYes ### Implement an opt-out notice Under CDPA, when businesses sell personal data or use it for targeted advertising (including the use of third-party cookies) or profiling, they should disclose this information in a clear and conspicuous way and inform consumers how to opt-out. With CookieYes you can - Scan your website for cookies against a 100,000+ cookie database - Display an accessible and user-friendly opt-out banner on your website - Geo-target opt-out banner for US visitors only ![Implement an opt-out notice](https://assets.cookieyes.com/cookie_consent_banner_0c27e01aac.svg) ### Automate consent management To respect users’ right to opt-out under CDPA, it’s necessary to ensure that websites set third-party cookies only based on users’ consent preferences and ensure continuous compliance. With CookieYes you can - Select cookie categories to block when the user opts out - Schedule cookie scanning for up-to-date information on cookies - Record consent logs for proof of consent during audits ![Automate consent management](https://assets.cookieyes.com/consent_management_730052a633.svg) ### Generate a compliant privacy policy Under the CDPA, businesses should implement an accessible, clear, and meaningful privacy notice on their website and include information on the personal data collected, the purpose of collection, how to exercise user rights, and more. - Use our pre-built, legally-compliant policy templates - Generate your privacy policy and cookie policy in minutes - Simply copy-paste the legal policies to your website ![Generate a compliant privacy policy](https://assets.cookieyes.com/policy_generators_dc10b32d81.svg) ## Achieve regulatory compliance with ease with our no-code cookie consent solution [Become CDPA Compliant](https://app.cookieyes.com/trial?plan=pro-monthly&ref=lp_CDPA_center) 14-day free trial Cancel anytime ## Learn more and take the first step towards compliance ![What is CDPA?](https://assets.cookieyes.com/cdpa_icon_601188f1a1.svg) ### What is CDPA? The Consumer Data Protection Act (CDPA) is a data protection legislation from Virginia, United States. Virginia CDPA imposes obligations on companies for processing personal data and grants rights to individuals regarding their personal data. The CDPA was passed on March 2, 2021 and enforcement began on January 1, 2023. Virginia is the second US state after California to enact a comprehensive consumer privacy legislation officially. ![Who does CDPA apply to?](https://assets.cookieyes.com/apply_to_icon_c0205ce9f2.svg) ### Who does CDPA apply to? The CDPA applies to for-profit businesses that conduct business in Virginia or market their goods and services to Virginia residents and either controls or processes the personal data of at least 100,000 consumers in a year or controls or processes the personal data of at least 25,000 consumers and derives at least 50% of its gross revenue from the sale of personal data. The CDPA does not apply to certain government agencies, non-profit organizations higher education institutions, financial institutions subject to the GBLA, covered entities or business associates governed by HIPAA and HITECH. ![What are consumer rights in CDPA?](https://assets.cookieyes.com/consumer_rights_icon_f33a6ebd2b.svg) ### What are consumer rights in CDPA? ![Right to access](https://assets.cookieyes.com/icon_access_2e8b82213f.svg) #### Right to access The right to confirm whether a controller is processing the consumer’s personal data and to access the personal data. ![Right to opt-out](https://assets.cookieyes.com/icon_optout_ee96d6bad1.svg) #### Right to opt-out The right to opt out of the processing of personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling. ![Right to correct](https://assets.cookieyes.com/icon_correction_d30a9d9c52.svg) #### Right to correct The right to request to correct, update, or complete personal data about them. ![Right to delete](https://assets.cookieyes.com/icon_delete_ba1643b859.svg) #### Right to delete The right to delete personal information that a business has collected from them. ![Right to data portability](https://assets.cookieyes.com/icon_portable_2eda1b0600.svg) #### Right to data portability The right to obtain a copy of their personal data in a portable and readily usable format and transfer it to another data controller. ![What is the penalty for non-compliance?](https://assets.cookieyes.com/penalty_icon_b3a2c9445d.svg) ### What is the penalty for non-compliance? Businesses can get civil penalties of up to $7500 for each violation including Attorney fees. Businesses will have a 30-day cure period to rectify violations before the Virginia Attorney General takes action. Virginia’s CDPA also opens for financial recovery of legal fees and investigative costs, and violations are not limited to “intentional violations”. Unlike California’s CCPA, the law explicitly excludes a private right of action. ## FAQ on CDPA Compliance **What is Virginia data privacy law 2023?** The Virginia Consumer Data Protection Act (CDPA) is a data privacy law that regulates data processing in the state of Virginia. It was signed on March 2021 and took effect on January 2023. This makes Virginia the second US state to enact a consumer privacy law, following in the footsteps of California. The Virginia CDPA builds on frameworks of California's CCPA and the European Union's GDPR. **What is personal data under CDPA?** The CDPA defines personal data broadly as any information that is linked or can be reasonably linkable to an identified or identifiable natural person. Data available in the public domain and anonymised data are excluded from the definition of personal data. Personal data, therefore, can be identifiers such as name, identification number, IP addresses, biometric information or characteristics such as race, ancestry, religion, age, sex, sexual orientation, gender, medical condition etc. The CDPA protects a "sensitive" category of personal data. This includes data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation or citizenship or immigration status, genetic or biometric data for the purpose of uniquely identifying a natural person, and personal data collected from minors or precise geolocation data. **Who is the regulatory authority for Virginia CDPA?** The Virginia Attorney General is the exclusive regulatory authority to enforce CDPA and has the power to impose a civil penalty of up to $7,500 per violation. **What is the difference between Virginia's CDPA and California's CCPA?** The Virginia CDPA has many similarities with the California Consumer Privacy Act (CCPA). Despite similarities, they have key distinctions in scope and enforcement. Some notable differences are: - CCPA considers revenue as one basis for its applicability, while CDPA applies if a business controls or processes at least 100,000 consumers' personal data. - Unlike the CCPA, the CDPA does not have the provision for a private right of action for non-compliance. - The CCPA gives users the right to opt out of businesses from the sale of their personal data. The CDPA broadens the scope to include targeted advertising and user profiling. **Where can I find additional resources on CDPA?** Here are some links you can refer to for additional reading: - [Official Text of Virginia Consumer Data Protection Act](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/) - [Simplified Guide on Virginia CDPA](https://www.cookieyes.com/blog/vcdpa-virginia-consumer-data-protection-act/) ## Fast-track your CDPA compliance in minutes Set up a cookie consent banner in 3 simple steps and automate your compliance. [Become CDPA Compliant](https://app.cookieyes.com/trial?plan=pro-monthly&ref=lp_CDPA_bottom) 14-day free trial Cancel anytime **Form** - Enter your website URL (`url`, text, required) Submit: "Scan website"