State Privacy Law Updates: The Virginia Consumer Data Protection Act and the Colorado Privacy Act

State Privacy Law Updates: The Virginia Consumer Data Protection Act and the Colorado Privacy Act

On March 2, 2021, Virginia passed its own version of a broad, consumer-facing privacy law dubbed the Virginia Consumer Data Protection Act (“VCDPA”). The VCDPA applies to entities that conduct business in Virginia or produce products or services that are targeted to Virginia residents and, during a calendar year, either (i) control or process personal data of at least 100,000 Virginia residents, or (ii) derive over 50% of gross revenue from the sale of personal data and control or process personal data of at least 25,000 Virginia residents. Notably, the VCDPA excludes from the definition of “Personal Data” employment data, pseudonymous data and de-identified or publicly available information. As a result, processing of personal data in the employment context is not within the scope of the law. The VCDPA goes into effect on January 1, 2023.

Earlier this month, Colorado enacted the Colorado Privacy Act (“CPA”), making it now the third state to enact comprehensive privacy legislation behind California and Virginia. The CPA applies to entities that conduct business in Colorado or produce or deliver commercial products or services that are intentionally targeted to residents of Colorado and, during a calendar year, either (i) control or process personal data of at least 100,000 Colorado residents, or (ii) derive revenue or receive a discount on the price of goods or services from the sale of personal data and processes or control the personal data of 25,000 or more Colorado residents. Unlike the VCDPA or the California Consumer Protection Act, the CPA applies even if the business derives less than 50% of its gross annual revenue from sale of personal data. Mirroring the VCDPA, the law explicitly carves out employment data from the law’s scope.