Virginia VCDPA: Your Data-Broker Opt-Out Rights

calendar Jun 16, 2026 · 9 min read · data broker opt out state privacy laws  ·
Share on: linkedin copy

The Virginia Consumer Data Protection Act gives residents a statutory right to control broker data

The Virginia Consumer Data Protection Act (VCDPA) gives Virginia residents a statutory right to find out what personal data a company holds about them, to demand its deletion, and to order that company to stop selling that data or using it to target advertising. The law took effect on January 1, 2023, and it reaches the same marketing databases that feed the catalog mail piling up in your mailbox. It is codified at Title 59.1, Chapter 53 of the Code of Virginia, beginning at § 59.1-575.

These are not courtesy requests. The VCDPA defines specific obligations that a "controller" — any business that determines how and why personal data is processed — must honor within a fixed timeframe. Data brokers that compile and sell consumer profiles fall squarely inside that definition when they meet the law's volume thresholds. The rights enumerated at § 59.1-577 include access, correction, deletion, data portability, and the right to opt out of three specific kinds of processing: targeted advertising, the sale of personal data, and profiling that produces significant effects.

There is an important boundary to understand up front, because overstating it leads to wasted effort. The VCDPA has no private right of action. You cannot sue a broker yourself for ignoring your request. Enforcement belongs exclusively to the Virginia Attorney General, who can seek civil penalties of up to $7,500 per violation under § 59.1-584. That changes how you use the law — it is a compliance lever backed by a regulator, not a courtroom weapon — but it does not weaken the underlying right. Most brokers process valid requests because non-compliance invites the AG's attention.

If you are a Virginia resident, you hold a tool that residents of most states still lack. Using it is a practical, repeatable task, and the benefit reaches well beyond your inbox.

Your rights under the VCDPA

The VCDPA grants Virginia consumers a defined set of rights against controllers that process their personal data. For the purpose of stopping catalog mail, four of them matter most.

Right to access (confirm and know). You can ask a controller to confirm whether it is processing your personal data and to give you access to that data. For a data broker, this is how you learn whether your profile exists in their files at all — the necessary first step before deletion. Section 59.1-577 frames this as the right "to confirm whether or not a controller is processing the consumer's personal data and to access such personal data."

Right to delete. You can request that a controller delete personal data "provided by or obtained about" you. Note the breadth of that phrase: it covers not just data you handed over directly but data the broker acquired from other sources — public records, other brokers, purchase histories. For compiled marketing files, which are almost entirely "obtained about" you rather than provided by you, this is the operative right.

Right to opt out of sale, targeted advertising, and profiling. You can direct a controller to stop processing your personal data for (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling that produces legal or similarly significant effects. The "sale" opt-out is the one that bites data brokers hardest, because selling consumer records is the core of their business model. When you exercise it, the broker must stop transferring your data to third parties for monetary or other valuable consideration.

Right to correct. You can request correction of inaccurate personal data. This matters less for stopping mail than deletion does, but a correction can disrupt the matching logic brokers use to link records, which has a secondary suppression effect.

The law pairs these rights with a hard response deadline. Under § 59.1-577, a controller must respond to your request "without undue delay, but in all cases within 45 days of receipt." The controller may extend once by an additional 45 days when reasonably necessary, but it must notify you of the extension and the reason within the original window. Ninety days is the outer limit.

How to submit a VCDPA request to data brokers

Sending a VCDPA request is straightforward, but doing it precisely improves the odds the broker processes it on the first pass rather than bouncing it for more information.

  1. Identify the brokers to target. Start with the high-volume marketing-data brokers that supply catalog prospecting lists — Acxiom, Epsilon, Experian Marketing Services, LexisNexis, and the people-search aggregators such as Spokeo and Intelius. These are the firms whose records most directly feed catalog mailing lists.

  2. Find the broker's privacy portal. Nearly every covered controller publishes a privacy notice describing how to exercise your rights, plus a dedicated request channel. Look in the website footer, the privacy policy, or search the site for "Virginia privacy rights," "VCDPA request," or "Do Not Sell My Personal Information." Many brokers route all state-law requests through a single web form; others accept email to a designated privacy address.

  3. State your request clearly and assert your residency. Write plainly: "I am a Virginia resident exercising my rights under the Virginia Consumer Data Protection Act. I request access to and deletion of all personal data you hold about me, and I direct you to stop selling my personal data and to stop processing it for targeted advertising and profiling." Include your full name, current mailing address, and any prior addresses, since brokers match on address history.

  4. Complete identity verification. The VCDPA permits a controller to authenticate your request before acting, and most will ask you to confirm details they already hold or to respond to a verification email. Complete this promptly — the 45-day clock runs from receipt of a request the controller can reasonably verify, so an unverified request can stall.

  5. Use the appeal process if you are denied. The VCDPA requires controllers to establish an appeal process for refused requests, and to respond to an appeal within 60 days. If a broker declines your deletion, file the appeal in writing and keep the response. The appeal step is not optional for the controller — it is built into the statute.

  6. Escalate to the Attorney General. If a broker ignores your request, denies your appeal without a valid statutory basis, or goes silent past the deadlines, you can submit a complaint to the Virginia Attorney General's consumer protection office at oag.state.va.us. Because the AG holds exclusive enforcement authority, the complaint route is how non-compliant brokers face consequences.

Keep a log for every request: broker name, date submitted, confirmation number, verification status, and the 45-day deadline. That record is what makes an AG complaint actionable rather than anecdotal.

What to expect

Set realistic expectations and the process is far less frustrating. The 45-day window is a maximum, not a target — many brokers process requests in batches, so your profile may not vanish from a search result the moment you submit. Give the full cycle before following up, then escalate to the appeal if there is no response.

The most important thing to understand is the enforcement structure. The VCDPA does not give you a private right of action. Section 59.1-584 states plainly that nothing in the chapter "shall be construed as providing the basis for, or be subject to, a private right of action." Instead, the Attorney General has exclusive authority to enforce the law. Before suing, the AG must give a controller written notice and a 30-day period to cure the violation; if the controller fails to cure, the AG can seek an injunction and civil penalties of up to $7,500 per violation. In practice this means your leverage is the credible threat of regulatory exposure, not a personal lawsuit — which is exactly why documenting your request and the broker's non-response matters.

Expect re-addition over time. A VCDPA deletion removes your current profile; it does not permanently bar a broker from re-ingesting new data about you from public records, government filings, or future purchases. Treat opt-outs as maintenance, not a one-time fix. Re-submitting to the highest-volume brokers every 12 to 18 months is a reasonable cadence. Sending a combined deletion-and-opt-out-of-sale request, rather than deletion alone, covers both the existing record and the broker's future handling of any new record.

How this stops catalog mail

Catalog companies do not build their prospect lists from scratch. They rent and purchase compiled mailing lists from data brokers — Acxiom, Epsilon, Experian Marketing Services, and their peers — who segment consumers by purchase history, estimated income, household composition, and hundreds of other attributes. A retailer that wants "homeowners aged 45 to 65 who have bought apparel by mail in the past two years" buys that selection from a broker. Your address is in that pool because a broker put it there.

This is why a VCDPA request works upstream of the mailbox. When you submit a deletion and sale opt-out to Acxiom or Epsilon and they remove your record, you are no longer part of the inventory those brokers sell. The deletion does not stop a catalog company from mailing to everyone else on a list it already bought — but it removes you from being on the next list the broker sells, to any mailer, in any product category. That is the supply chain in plain terms: public record or purchase → broker ingests and enriches → broker licenses a list → list reaches a catalog company → catalog lands in your mailbox. Cutting the broker→list-broker→catalog chain at the broker node severs every downstream list product at once.

Opting out of an individual catalog treats the symptom; it stops one mailer until your address gets re-added the next time that mailer rents a fresh list. Deleting from the broker treats the cause. Each subsequent list the broker compiles excludes your record, which is why working through the major brokers systematically — using the statutory rights the VCDPA gives you — produces a durable reduction rather than a temporary one.

Keep reading

Posts in this series