What are the penalties for violating Virginia's VCDPA?

Virginia's penalty number is the same as Texas's, and so is the shape of the process in front of it. What differs is one extra condition on the cure.

The number

Section 59.1-584(C): if a controller or processor continues to violate the chapter following the cure period, or breaches an express written statement provided to the Attorney General, the Attorney General may initiate an action in the name of the Commonwealth, seek an injunction to restrain any violations, and seek civil penalties of up to $7,500 for each violation.

As in Texas, the penalty does not attach to the original violation. It attaches to continuing after the cure window closes, or to breaking the promise you made to stop.

Civil penalties, expenses, and attorney fees collected are paid into the state treasury and credited to the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund.

The 30-day cure, and its second condition

Section 59.1-584(B) requires the Attorney General, before initiating any action, to provide 30 days' written notice identifying the specific provisions alleged to have been or being violated.

Then the part that decides outcomes: if within the 30-day period the controller or processor cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action shall be initiated.

Both steps are required. A business that fixes the problem quietly and says nothing has not satisfied 59.1-584(B), and the Attorney General may proceed.

The written statement is also a forward-looking commitment, not just a status report. It asserts that no further violations shall occur, and subsection (C) makes breaching it independently actionable. So the statement is worth drafting carefully rather than treating as a formality.

The cure period has not expired

Virginia's cure provision carries no sunset in the current text of the section.

That places Virginia with Texas rather than with California, whose CCPA cure period ended under the CPRA. For a business operating across all three, the practical consequence is that a first-time compliance failure in Virginia or Texas is usually recoverable, where in California it may not be.

One enforcer, and no private suits

Subsection (A) is a single sentence: the Attorney General shall have exclusive authority to enforce the provisions of the chapter.

Subsection (E) closes the other route: nothing in the chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of the chapter or under any other law.

Together those put Virginia in a very different risk category from Illinois BIPA, where the private right of action drives most litigation. The exposure here is a regulator that is required to warn you before it sues.

What it costs beyond the penalty

Section 59.1-584(D) allows the Attorney General to recover reasonable expenses incurred in investigating and preparing the case, including attorney fees, in any action initiated under the chapter.

And subsection (C) pairs penalties with injunctive relief. In practice the injunction is often the more disruptive outcome, because a required product or process change lands on a schedule you do not control.

Next step

Penalty exposure only matters once the law applies to you, and Virginia's thresholds are their own test. The free 2-minute Obligation Scan tells you which US state privacy laws reach your business and what each requires. See the Virginia VCDPA overview for applicability, Texas TDPSA fines and penalties for the closest parallel, and CCPA fines and penalties for the California contrast where the cure period has gone.