Virginia vs Colorado Privacy Law Comparison
Understanding the differences between Virginia's VCDPA and Colorado's CPA is essential for businesses operating across state lines. Virginia's law became effective January 1, 2023, while Colorado's law took effect July 1, 2023. Below is a detailed side-by-side comparison covering applicability thresholds, consumer rights, enforcement, and more.
Reviewed by PrivacyLawMap editorial team · Last verified: 2026-07-18
Start with the Virginia data privacy law guide and the Colorado data privacy law guide for the full state-specific thresholds, rights, source links, and checklist steps behind this comparison.
To weigh the real-world stakes behind these two laws, see documented VCDPA fines and privacy penalties from actual state enforcement actions in the penalties tracker.
VCDPA vs CPA: the key differences at a glance
The biggest difference between Virginia's VCDPA and Colorado's CPA (as of 2026) is that Colorado's CPA carries a higher maximum civil penalty ($20,000 vs $7,500 per violation under Virginia's VCDPA).
- Maximum civil penalty: VCDPA up to $7,500 per violation vs CPA up to $20,000 per violation.
- Right to cure: VCDPA has 30-day cure period vs CPA with no cure period.
- Private right of action: no under VCDPA vs no under CPA.
- Universal opt-out (GPC) signals: not mandated under VCDPA vs must be honored under CPA.
- Effective date: VCDPA since January 1, 2023 vs CPA since July 1, 2023.
Primary sources: VCDPA Full Text (Virginia Code Title 59.1, Chapter 53) · CPA Full Text (SB 21-190, Colorado Legislature) · Verified 2026-07-18.
Swipe the table sideways to see every state column.
| Category | Virginia VCDPA | Colorado CPA |
|---|---|---|
| Thresholds & Applicability | ||
Effective Date | Jan 1, 2023 | Jul 1, 2023 |
Revenue Threshold | None | None |
Consumer Count | 100,000 | 100,000 |
Data Sale % Threshold | 50% | 50% |
| Consumer Rights | ||
Right to Access | ||
Right to Deletion | ||
Right to Correction | ||
Opt-Out of Sale | ||
Opt-Out Targeted Ads | ||
Opt-Out Profiling | ||
Limit Sensitive Data | ||
Right to Appeal | ||
Private Right of Action | ||
| Enforcement & Compliance | ||
Universal Opt-Out Required | ||
Cure Period | 30 days | None |
Penalty / Violation | $7,500 | $20,000 |
Enforcement Body | Virginia Attorney General | Colorado Attorney General and District Attorneys |
Sensitive Data Consent | Opt-In | Opt-In |
Data Broker Provisions | The VCDPA does not include specific data broker registration requirements. Data brokers are subject to the same obligations as other controllers under the law. | The CPA does not include specific data broker registration requirements. However, data brokers that meet the applicability thresholds are subject to the same controller obligations under the law. |
Highlighted rows indicate differences between the two states
Virginia vs Colorado: Common Questions
Not sure if Virginia or Colorado privacy laws apply to you?
Our free calculator analyzes your business details and tells you exactly which state privacy laws you need to comply with.