Virginia's CDPA: the AI Profiling Opt-Out and What It Does Not Reach

Virginia’s Consumer Data Protection Act has been in force since 1 January 2023, and it contains one of the earliest state-law rights in the United States that reaches an automated decision directly rather than through a discrimination theory. It is also considerably narrower than most summaries of it suggest, and the narrowness is entirely in the definitions.

The right, in the statute’s own terms

The opt-out lives in Va. Code § 59.1-577(A)(5), which gives a consumer the right to opt out of the processing of personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Those three purposes sit in one subsection, but they behave differently: the first two describe what you do with the data, and the third describes what the output is used for. A model can process a great deal of personal data without triggering the third limb at all, if nothing downstream of it makes one of the enumerated decisions.

Mechanically, the right is a forward-looking stop rather than an unwind. A consumer who opts out is telling the controller not to do this in future; the statute does not require you to reverse a decision already taken, retrain a model, or delete an inference already drawn. Under § 59.1-577(B) the controller has 45 days to respond, once extendable by a further 45 days where reasonably necessary, and responses must be free of charge for the first two requests in any twelve-month period.

What counts as profiling

§ 59.1-575 defines profiling as any form of automated processing performed on personal data to evaluate, analyse or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Three things follow from that wording and each of them catches people out.

• There is no sophistication threshold. A scorecard, a regression, a rules engine and a large language model are all “automated processing”. Nothing in the definition requires machine learning, and a compliance position built on “we do not use AI” is not a position under this statute.
• It is about the person, not the population. The processing must evaluate aspects related to an identified or identifiable person. Aggregate analytics that never resolve to an individual sit outside; a per-applicant score does not.
• The enumerated aspects are broad and overlapping. “Reliability” and “behaviour” between them cover most of what a screening, scoring or fraud model produces, so arguing that an output is not about economic situation or health rarely gets you out of the definition.

The closed list of significant effects

This is where the scope is actually decided. § 59.1-575 defines a decision that produces legal or similarly significant effects as one that results in the provision or denial of financial and lending services, housing, insurance, education enrolment, criminal justice, employment opportunities, health care services, or access to basic necessities such as food and water. Unlike the open-textured phrasing of Article 22 of the GDPR, this reads as an enumeration, and a decision that is not on the list is not obviously caught however consequential it feels.

Two consequences are worth stating flatly. First, a large amount of consumer-facing personalisation — ranking, recommendation, pricing outside insurance and lending, content moderation — is not on the list. Second, the phrase is “provision or denial”, so a model that narrows a shortlist without itself provisioning or denying sits in genuinely contested territory. It is not settled whether an automated pre-screen that removes a candidate before any human sees the application “results in” the denial of an employment opportunity; the text says “in furtherance of” in the opt-out limb, which pulls towards yes, and the Attorney General has not published a resolution of it. Nobody should be told this is decided.

The assessment duty that runs alongside it

The opt-out is a consumer right. § 59.1-580 imposes a separate controller duty that catches a wider set of systems: a data protection assessment is required for processing personal data for targeted advertising, for the sale of personal data, for the processing of sensitive data, for any processing that presents a heightened risk of harm to consumers, and for profiling where that profiling presents a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact, financial, physical or reputational injury, intrusion upon solitude or seclusion where that intrusion would be offensive to a reasonable person, or other substantial injury.

Note the asymmetry. The assessment trigger for profiling is a risk test, not the enumerated-decisions test, so a model can require an assessment while producing no opt-out right at all. The assessments are confidential and exempt from public disclosure, but § 59.1-580 requires a controller to make them available to the Attorney General on request pursuant to a civil investigative demand — which is the practical reason to write them as though they will be read by a regulator, because that is the only circumstance in which they will be. The same structure appears in Delaware’s statute and in Oregon’s, with different trigger lists.

What the CDPA does not give a consumer

The omissions are as load-bearing as the right, and they are what distinguishes Virginia from the European model that the vocabulary is borrowed from.

• No right to an explanation. Nothing in the CDPA requires a controller to describe the logic of a model, its inputs, or the reason for a particular outcome. Compare Colorado’s notice provisions, which do require a statement of the principal reasons.
• No right to human review. There is no analogue of GDPR Article 22(3). A consumer may stop the profiling prospectively; they cannot demand a person redo the decision.
• No universal opt-out signal duty. Virginia does not require controllers to honour a browser or device preference signal. Colorado, Connecticut, California, Delaware, Oregon, Montana and Texas do, in various forms. If your opt-out implementation is a signal handler, Virginia is the state where it is not sufficient on its own.
• No private right of action. § 59.1-584 gives exclusive enforcement to the Attorney General, with a 30-day cure period that — unlike Connecticut’s and Colorado’s — was not written to sunset, and civil penalties of up to $7,500 per violation plus reasonable expenses.

There is one procedural right that is easy to miss and that does apply to an automated refusal: under § 59.1-578(C) a controller must establish a process for a consumer to appeal a refusal to act on a request, respond within 60 days with a written explanation of the reasons, and tell the consumer how to submit a complaint to the Attorney General. If you automate the intake of rights requests, you have automated a decision that carries its own appeal duty.

Finally, on what Virginia is not: the Commonwealth came close to having a general high-risk AI statute in 2025. House Bill 2094, the High-Risk Artificial Intelligence Developer and Deployer Act, passed both chambers and was vetoed by the Governor on 24 March 2025. It is not law, and nothing in it binds anyone. Anything you read describing Virginia as having a Colorado-style AI act is describing a vetoed bill; the enacted-versus-pending snapshot keeps that distinction explicit.