Virginia · VCDPAWordPress hosting with VCDPA plugin built into the platform.
Opt-out signals for sale and targeted advertising, opt-in for sensitive data, a 45-day response workflow, and an appeal channel — handled by Yovale's compliance MU-plugin. You don't install it. You don't update it. You don't pay for it. It's how every Yovale site ships, on every plan. The same platform also handles CCPA, CO CPA, CT DPA, and UT UCPA — one stack, every US state privacy law.
Under the VCDPA, you can opt out of the sale of personal data, targeted advertising, and profiling. You can also access, correct, delete, or export the data we hold about you.
Six obligations you have to meet.
The Virginia Consumer Data Protection Act took effect on January 1, 2023, making Virginia the second US state after California with a comprehensive consumer privacy law. It applies to controllers that process the personal data of 100,000+ Virginia consumers, or 25,000+ when 50% or more of revenue comes from selling personal data. Enforcement sits with the Virginia Attorney General, with civil penalties of up to $7,500 per violation.
- 01
Opt-out for sale, targeted ads, profiling
Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects. The mechanism has to be clear, conspicuous, and free of dark patterns.
- 02
Opt-IN for sensitive data
You cannot process sensitive data without explicit consent. Sensitive data covers race, religion, mental or physical health diagnosis, sexual orientation, citizenship and immigration status, genetic or biometric data, precise geolocation, and data from a known child.
- 03
Consumer rights: access, correct, delete, port
Virginia consumers can request access to the personal data you hold, correct inaccuracies, delete it, and obtain a portable copy in a readily usable format. You respond within 45 days, extendable once by 45 days when reasonably necessary.
- 04
Appeal process
When you deny a consumer request, you must give the consumer a clear way to appeal the decision and respond to the appeal within 60 days. If the appeal is denied, you provide an explanation and a link to file a complaint with the Virginia Attorney General.
- 05
Controller and processor duties
Contracts between controllers and processors must spell out processing instructions, confidentiality, deletion or return of data at end of service, and assistance with consumer requests. Yovale acts as your processor under a written contract.
- 06
Data protection assessments
Conduct and document a data protection assessment for any processing that presents a heightened risk of harm — targeted advertising, sale of personal data, profiling with significant effects, and any processing of sensitive data.
Built into the platform. Not a plugin you install.
Yovale ships VCDPA compliance as a signed must-use plugin — part of the hosting itself, not something you install from the WordPress repository. It's version-pinned, fetched from R2 with SHA-256 verification, and dropped into a per-site bind-mounted mu-plugins directory at provision time. Updates ship through the same channel your hosting updates do.
Geo-aware consent and opt-out
Virginia visitors see VCDPA opt-out controls for sale, targeted advertising, and profiling, plus opt-in prompts before any sensitive data category is processed. EU visitors see GDPR opt-in. California visitors see CCPA. One platform, every regulation.
Privacy portal
/.well-known/privacy on every Yovale site. Virginia consumers can submit access, correction, deletion, and portability requests without filing a support ticket. Every request shows up in your Compliance dashboard tab with a 45-day SLA timer.
Appeal workflow
When a request is denied, the consumer gets a one-click appeal link. The appeal opens a separate 60-day SLA case in your dashboard, with the original decision attached. If you deny the appeal, the platform attaches the Virginia AG complaint link automatically.
Signed processor contract
Pre-signed controller-processor contract that meets VCDPA § 59.1-579 requirements. Lists every sub-processor (Cloudflare, Anexia, R2), purpose limits, confidentiality, deletion at end of service, and assistance with consumer requests. PDF download from the dashboard.
Why infrastructure beats a plugin.
Typical WordPress VCDPA plugin
- Adds 200-500ms to every page load (banner JS, geo lookup, DB writes)
- Stores opt-out signals in wp_options — slow, untyped, breaks with object caching
- Updates through wp-admin — you maintain it, you break it, you debug conflicts
- Costs $49-149/year per site and rarely covers the appeal workflow
- Breaks when you migrate hosts; opt-out history and appeal records lost
Yovale's built-in approach
- 0ms latency — opt-out state computed at the edge worker, cached in the CDN
- Audit log in a dedicated database, queryable, never blocks page render
- Updates ship through the platform — you don't see them, you don't break them
- Included on every plan ($149 / $249 / $499 per year), no per-site compliance fees
- Travels with your site forever — opt-out and appeal history is yours to export
14 regulations. One toggle each. All automatic.
- Opt-out for sale, targeted ads, profiling
- Opt-in for sensitive data
- 45-day consumer request response
- Appeal process within 60 days
- Data protection assessments
VCDPA + Yovale, answered.
Does the VCDPA apply to my site?
It applies if you control personal data of 100,000 or more Virginia consumers in a calendar year, or 25,000 or more when 50% or more of your gross revenue comes from selling personal data. Government bodies, certain non-profits, HIPAA-covered entities, and FERPA-covered education data are out of scope. If you're below the thresholds you're not directly covered, but Yovale runs the same protections by default so your site is ready when you cross them.
How is the VCDPA different from the CCPA?
Both give consumers opt-out for sale and targeted advertising, plus rights to access, delete, and port their data. The VCDPA goes further on sensitive data — it requires opt-IN consent, while California uses an opt-out signal. The VCDPA also mandates a formal appeal process for denied requests and is enforced by the Virginia Attorney General, with no private right of action. Yovale handles both regimes from one platform.
How does the opt-out actually work?
Virginia visitors see a clear opt-out control in the consent banner and in the privacy portal at /.well-known/privacy. Clicking it stops sale, targeted advertising, and profiling immediately at the Cloudflare edge worker — before analytics, ad pixels, or third-party tags fire. The opt-out is logged in the audit trail with timestamp and IP-derived region.
What counts as sensitive data and how is the opt-in handled?
Sensitive data under the VCDPA covers race or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify a person, precise geolocation, and personal data from a known child. Yovale's MU-plugin blocks any plugin or script that touches a sensitive category until the consumer has actively opted in through the consent UI.
What happens when I deny a consumer request?
The platform sends the consumer a denial notice with a one-click appeal link. The appeal opens a separate case in your Compliance dashboard with its own 60-day SLA. If you deny the appeal too, Yovale automatically attaches a link for the consumer to file a complaint with the Virginia Attorney General, as required by VCDPA § 59.1-577(C).
Do you provide a processor contract?
Yes. A pre-signed controller-processor contract that meets VCDPA § 59.1-579 is available as a PDF in your dashboard. We're listed as your processor, you're the controller. It lists every sub-processor (Cloudflare, Anexia, R2), purpose limits, confidentiality terms, return or deletion of data at end of service, and our duty to assist with consumer requests and data protection assessments.
Ship a VCDPA-compliant WordPress site in 60 seconds.
Every Yovale site is VCDPA-ready from the moment you deploy. No plugin to install. No processor contract to chase. No appeal workflow to build. Start the free Growth trial and see your first compliance dashboard.