Virginia Code § 59.1-576 — Consumer data protection: coverage and government exemption

AI-use reference. Current. Applies to: Businesses targeting Virginia residents meeting statutory data/revenue thresholds Requirements or purpose: Coverage generally requires control or processing of at least 100,000 consumers’ personal data in a year, or at least 25,000 consumers plus over 50 percent of gross revenue from personal-data sales. Limits: § 59.1-576 exempts state/local governmental bodies, HIPAA entities/business associates, specified financial entities/data, nonprofits and higher education; numerous data exemptions also apply. Not a city-wide AI regulation; applicability to a private supplier depends on its activities and exemptions. Employment-context data and FERPA-regulated data are among express information exemptions.