The Consumer Data Protection Act (CDPA) just became law in Virginia -- even though it won't go into effect until 2023. CDPA has drawn a lot of rough comparisons among pundits between itself and the California Consumer Privacy Act (CCPA). The two are similar, but they're not the same.
The scope of the laws isn't the same. Both laws apply to most for-profit businesses as based, in some manner, on revenue and/or handling of their respective residents' data. Still, California probably reaches further than Virginia does here. The CCPA applies to any for-profit businesses that meet one of the following three requirements:
- Has over $25 million in statutorily adjusted gross annual revenues (regardless of revenue source); OR
- Gets at least 50% of its annual revenue from selling California consumers' personal data (regardless of revenue amount); OR
- Buys, sells, receives for commercial purposes, and/or shares for commercial purposes, "alone or in combination, the personal information of 50,000 or more [natural persons who are California residents], households, or devices" in a year.
In Virginia, the CDPA applies to two narrower categories of for-profit businesses:
- The business controls or processes the personal data of at least 25,000 Virginia consumers in a calendar year AND get more than 50% of its gross revenue from the sale of personal data; OR
- The business controls or processes at least 100,000 Virginia consumers' personal data in a calendar year (regardless of revenue).
California has a "right-to-repair" exemption for data-sharing built into CCPA. Virginia exempts in-state postsecondary schools (even for-profit ones) from CDPA's requirements. Both CCPA and CDPA have "publicly available information" exceptions, although CCPA strictly limits what qualifies as "publicly available information," while CDPA defines "publicly available information" extremely broadly. Both laws protect personal data, but exclude from their respective definitions thereof "publicly available information". If it's public, it's not personal.