Ratings / Privacy Law
Critical Rating 1 / 5 · Critical — Active surveillance / serious risk.
Passed as one of the earliest state-level frameworks, the VCDPA is rated RED by privacy advocates because it was heavily influenced by industry lobbyists and serves as the template for weak state-level legislation. The law lacks a private right of action, giving sole enforcement
Passed as one of the earliest state-level frameworks, the VCDPA is rated RED by privacy advocates because it was heavily influenced by industry lobbyists and serves as the template for weak state-level legislation. The law lacks a private right of action, giving sole enforcement power to the state Attorney General, and includes broad exemptions for financial institutions and insurance companies. This creates a regulatory environment where corporate compliance is easily navigated without substantial changes to tracking behaviors.
The full methodological and legal context for this rating. This card is what we point to when asked to substantiate the claim.