Does Virginia's Privacy Law Give Consumers the Right to Opt Out of Targeted Advertising?

Yes. Under the Virginia Consumer Data Protection Act (VCDPA), Virginia residents have the right to opt out of targeted advertising — advertisements selected based on personal data obtained from a consumer's activity over time and across nonaffiliated websites or apps to predict their interests. Businesses that run this kind of ad targeting must disclose it and offer a clear, verifiable opt-out method.

What Counts as "Targeted Advertising" Under the Law

The VCDPA's definition turns on cross-context tracking, not advertising generally. Ads built from a consumer's direct, first-party activity on a business's own website or app don't qualify as targeted advertising under the statute — only data gathered across unaffiliated sites and apps does. That distinction matters for marketers: retargeting a visitor based on your own site behavior sits outside the opt-out right, while audience data stitched together from third-party pixels, ad networks, or data co-ops sits squarely inside it.

Opt-Out, Not Opt-In, for Ordinary Data

The VCDPA takes an opt-out approach for ordinary personal data used in targeted advertising — businesses can process it by default until a consumer exercises their right to decline. That flips to an opt-in requirement only for sensitive data categories, such as precise geolocation, health diagnoses, or data revealing religious beliefs or sexual orientation. For most standard ad-tracking use cases, the obligation is to provide the opt-out mechanism and honor it, not to secure consent up front.

What Compliance Actually Requires

• Disclosure: Businesses processing data for targeted advertising must disclose that practice, typically in the privacy policy, along with a clear and accessible way to opt out.
• Pass-through to partners: When a business shares tracking data with third parties for targeted ads, it must also communicate a consumer's opt-out request to those downstream parties.
• Non-discrimination: A business cannot penalize a consumer for opting out — for example, by degrading service quality or pricing in retaliation.

Enforcement Has No Private Lawsuit Risk — Yet

Unlike some newer state privacy laws, the VCDPA is enforced solely by the Virginia Attorney General; there's no private right of action letting individual consumers sue over a violation. The VCDPA took effect January 1, 2023, and the statute's civil penalty provision, § 59.1-584, caps fines at $7,500 per violation for a controller or processor that keeps violating after the AG's mandatory 30-day cure period expires without the issue being fixed. That lowers the litigation exposure compared to statutes like the TCPA, but AG enforcement authority still carries real penalty risk, and marketers running cross-site retargeting into Virginia should treat the opt-out obligation as a compliance requirement, not a legal afterthought.

Bottom Line

If your campaigns use data tracked across third-party sites or apps to target Virginia residents, you need a disclosed, working opt-out path for targeted advertising — audit your privacy policy and ad-tech vendor contracts now rather than after an AG inquiry.

Sources: Virginia Consumer Data Protection Act, Va. Code §§ 59.1-577, 59.1-584, as summarized in legal analyses from Davis Wright Tremaine ("Virginia Consumer Data Protection Act," dwt.com), Usercentrics' VCDPA knowledge-hub overview (usercentrics.com), and Troutman Pepper's VCDPA litigation and enforcement series (troutman.com).