Browse
Log in / Register
Share
May 9, 2026 — Virginia residents clicking into TribLIVE.com are now seeing a "Notice of Your Privacy Rights in Virginia," a direct result of the Virginia Consumer Data Protection Act (VCDPA). The notice disables features like videos and social embeds unless visitors agree to let the site use personal data for advertising; continuing without agreeing effectively opts them out of data sales. Here's what the law actually gives Virginians, how the notice works, and why enforcement changed in 2025.
Virginia was the second state, after California, to pass a comprehensive consumer privacy law. The VCDPA was signed in March 2021 and took effect on January 1, 2023. It applies to businesses that operate in Virginia or target Virginia consumers and either handle the personal data of at least 100,000 Virginians, or handle data on 25,000 or more Virginians while earning more than half of their revenue from selling personal data.
For a news publisher like TribLIVE — a Pittsburgh-region outlet with a meaningful Virginia readership — the law plainly applies. Covered companies must give consumers notice of their rights, honor those rights when requested, and avoid processing personal data for targeted advertising, sale, or profiling without a valid legal basis.
It's worth underlining that the VCDPA is not the GDPR. It doesn't require an all-purpose "I consent to cookies" pop-up before most processing. Adults can generally be processed until they say no. But the law does require controllers to offer at least two ways to opt out of targeted advertising and data sales — which is exactly why TribLIVE's notice is structured as an all-in-one gate.
The notice does three things at once.
First, it geo-detects your state. Because Virginia has its own privacy law, the site treats traffic from the commonwealth differently from visitors in states without one. Second, it disables the network-dependent parts of the page — video players, social media widgets — because those third-party systems may collect personal data before a Virginia visitor has made a choice. Third, it asks for a decision: proceed anyway, which the notice equates with opting out of personal-data sales, or click "agree" to unlock the full experience and allow data-driven advertising.
There's a subtle legal point layered under that prompt. Virginia law defines "sale of personal data" as "the exchange of personal data for monetary consideration." A free news site handing browsing signals to an ad network isn't always a "sale" in that narrow reading, since the data often moves without money passing the other way. But the VCDPA also gives Virginians a separate right to opt out of targeted advertising and profiling. Because the disabled features are precisely the mechanisms that would send data to third parties, choosing to proceed is, in practice, an opt-out of both sale and targeted advertising. The site covers a lot of legal ground with one simple button.
The notice also asks readers to bookmark the page so they can "manage your preferences any time in the future." That's not just a convenience line. The VCDPA requires controllers to honor withdrawal of consent and to process opt-out requests without unreasonable delay. If a preference center is broken or buried, a publisher's friendly notice can become an enforcement problem.
Under Va. Code § 59.1-571 et seq., Virginia consumers can:
Controllers must respond to requests within 45 days, with one possible 45-day extension. A consumer can't be forced to create an account to exercise these rights, and the law restricts controllers from conditioning a product on consent to processing that isn't reasonably necessary — meaning a site can't bury unrelated data-sharing in the fine print and call it a fair exchange.
One caveat: there is no private right of action under the VCDPA. Individual readers can't sue a publisher; enforcement belongs exclusively to the Virginia Attorney General. That differs from California, where consumers can bring limited claims, and it means every complaint relies on the AG's resources.
Two amendments reshaped the law in 2024, both effective October 1, 2024.
HB 23 broadened the definition of personal data to include identifiers that can identify a natural person, including pseudonymous data, and raised the age for heightened protection from under 13 to under 18. If a site knows — or should know — a visitor is under 18, it must get consent before processing that data. The same bill strengthened the ban on "dark patterns," the interface tricks designed to nudge users into choices they wouldn't deliberately make, such as pre-checked boxes or confusing double negatives.
SB 361, meanwhile, narrowed the small-business exemption. The existing carve-out protected companies processing data of 25,000 to 99,000 consumers as long as data sales accounted for under half their revenue. The amendment closed that loophole for businesses that knowingly sell personal data or process data for targeted advertising — the exact activities that most worry Virginia consumers.
The biggest change came last year. Under the original law, the Attorney General had to give violators a 30-day "cure" period — a grace window to fix problems before fines could apply. Effective July 1, 2025, SB 381 removed that cure period entirely.
Now the Attorney General can file suit as soon as a violation is discovered, and courts can impose civil penalties of up to $7,500 per violation plus injunctive relief. That changes the risk calculus for every covered business, including publishers. A vague privacy notice, a preference center that doesn't actually process opt-outs, or a failure to honor a recognized opt-out mechanism can now trigger an action with no warning shot.
Virginia wasn't the first jurisdiction to ditch the cure period — Connecticut's right to cure had already expired and Colorado's was sunsetting — but it's a significant one given how many other states copied Virginia's framework. So far, no headline VCDPA enforcement action has been launched against a major publisher; the AG's more visible cases have centered on other consumer-protection theories. Privacy attorneys who build consent-management tools for newsrooms expect test cases soon, likely around dark patterns and children's data.
If you hit TribLIVE's notice — or any similar gate on another site — you have real options:
There's an uncomfortable economic reality underneath all of this. Regional publishers lean heavily on programmatic advertising, and programmatic ads depend on data signals. Third-party video players and social embeds also exchange data as part of their basic operation. Virginia's law doesn't outlaw that model — it demands transparency and a working off-switch.
That model keeps spreading. More than a dozen states now have comprehensive privacy laws, most visibly shaped by Virginia's statute, with Maryland, Minnesota, and Rhode Island among the latest to join. Congress still hasn't passed a federal comprehensive privacy law — the American Privacy Rights Act stalled in 2024 — so states keep setting the pace.
For Virginians, the takeaway is straightforward: TribLIVE's notice isn't a warning that something shady is happening. It's the law functioning as designed, showing consumers a real, enforceable choice. Read it, pick the option that fits your comfort with advertising, and remember that you can change your mind later. That bookmark link is worth keeping.
