VCDPA and browser fingerprinting

What VCDPA says about fingerprinting

The Virginia Consumer Data Protection Act was the second comprehensive US state privacy law to take effect, after California's CCPA/CPRA, and the template most other state laws have copied since. It went live on 1 January 2023 and is codified at Va. Code §59.1-575 through §59.1-585.

The statute does not mention 'fingerprinting', 'device identifier', or 'browser fingerprint' anywhere in its text. It does not need to: §59.1-575 defines 'personal data' as 'any information that is linked or reasonably linkable to an identified or identifiable natural person'. A fingerprint hash, composed of canvas output, font enumeration, GPU strings, audio context, time zone, and similar device characteristics, qualifies the moment the controller uses it to recognise a returning Virginia consumer. The hash does not need to be tied to a name, an email, or a payment card; the linkability test is satisfied by the fact that the same hash maps back to the same browser session across visits.

Where VCDPA diverges from CCPA is in the practical consequences of that classification. CCPA layers a sweeping opt-out right over the same data, including a 'sale or share' regime that captures most cross-context advertising. VCDPA narrows the most important opt-out hooks substantially. Understanding what counts as 'sale', 'targeted advertising', and 'profiling' under Virginia's definitions is more determinative than the personal-data classification itself.

When VCDPA applies to you

Section 59.1-576 sets a two-leg applicability threshold. A controller falls inside VCDPA if it conducts business in Virginia or produces products or services targeted to Virginia residents, AND it either (a) controls or processes the personal data of at least 100,000 Virginia consumers in a calendar year, or (b) controls or processes the personal data of at least 25,000 Virginia consumers AND derives over 50% of its gross revenue from the sale of personal data.

The second leg matters most for data brokers, ad-tech vendors, and anyone monetising fingerprint hashes downstream. A mid-size SaaS that touches 30,000 Virginia signups but earns nothing from selling that data is outside VCDPA's scope. A 25,000-consumer ad network that earns 80% of its revenue selling enriched audiences is inside.

'Consumer' is defined narrowly. It means a natural person who is a Virginia resident acting in an individual or household context. Employees, contractors, sole proprietors acting in a commercial capacity, and B2B contacts are explicitly excluded by §59.1-575. A fingerprint captured on an internal admin tool used solely by employees, or on a B2B SaaS product where every visitor is acting on behalf of a business customer, does not trigger VCDPA obligations.

The three opt-out rights that actually touch fingerprinting

Section 59.1-577 gives Virginia consumers five rights: access, correction, deletion, portability, and opt-out. The opt-out right is the one that matters for fingerprinting, and it splits into three independent categories of processing.

Targeted advertising under §59.1-575 means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer's activities across non-affiliated websites or online applications. Using a fingerprint to identify a returning visitor and serve them ads selected based on what they did on other sites is squarely inside this definition. First-party retargeting on your own site, frequency capping, and contextual advertising are explicitly carved out.

Sale of personal data under VCDPA is the narrowest definition of 'sale' in any US state law. It means the exchange of personal data for monetary consideration by the controller to a third party. Sharing fingerprint hashes with an ad-tech partner for non-monetary 'mutual value', the CCPA-style 'sale or share' situation, is NOT a sale under VCDPA. Selling a packaged audience-segment file that includes fingerprint-derived identifiers to a data broker for a dollar amount IS.

Profiling means any form of automated processing performed on personal data to evaluate, analyse, or predict personal aspects related to an identified or identifiable natural person. The opt-out right applies only when profiling produces 'legal or similarly significant effects' on the consumer, credit decisions, employment, insurance pricing, housing, healthcare access, education enrolment. Profiling a fingerprint to refine a marketing-segmentation dashboard does not trigger the opt-out; profiling a fingerprint as one input to a 'creditworthiness' score does.

Data Protection Assessments: the under-implemented obligation

Section 59.1-580 requires a controller to conduct and document a Data Protection Assessment (DPA, confusingly, the same acronym as 'data protection agreement') before engaging in four categories of processing: targeted advertising, sale of personal data, processing of sensitive data, and profiling that presents a 'reasonably foreseeable risk' of unfair or deceptive treatment, financial injury, physical injury, intrusion upon solitude or seclusion, or other substantial injury. The assessment must weigh the benefits of the processing against the risks to the consumer.

Most US fingerprinting deployments do not document one. The Virginia Attorney General can require production of the assessment in an enforcement context, and the absence of a documented assessment is itself a violation, separate from any underlying processing failure. The assessment is not made public; it is an internal record. For a fingerprinting deployment used to power targeted advertising, an adequate assessment names the signal categories collected, the purpose, the retention window, the disclosure recipients, the de-identification claim (if any), and the consumer-facing transparency mechanism.

What valid opt-out looks like under VCDPA

Section 59.1-578 requires the controller to provide a 'clear and conspicuous' mechanism to opt out of targeted advertising, sale, or profiling. The mechanism must be effective at the point the consumer makes the request, and the controller must comply within 45 days (extendable once by another 45 days for complex cases).

As of 1 January 2025, Virginia recognises Universal Opt-Out Mechanisms, most prominently the Global Privacy Control (GPC) browser signal. A fingerprinting deployment that ignores a GPC signal from a Virginia browser is in violation of §59.1-578, even if the consumer never manually clicked an opt-out link on the site.

Practically, this means the fingerprint script needs an upstream gate that checks for the GPC header and a consumer-facing opt-out preference before activating fingerprinting collectors for targeted-advertising or sale purposes. The fraud-prevention and analytics paths do not require this gate, because they are not targeted-advertising or sale-purpose processing, but the controller must keep those data flows architecturally separated to defend the distinction.

The cure-period question

VCDPA originally gave controllers a 30-day right to cure after receiving notice of a violation from the Virginia Attorney General. The legislature has revisited this provision twice. The current statutory text retains a notice-and-cure mechanism, but the AG's office has publicly signalled that it will treat the cure window narrowly and that repeat or wilful conduct disqualifies the controller from relying on it.

The practical reading: do not rely on the cure period to fix obvious deployment errors after the fact. The AG's published 'right-to-cure' guidance is the authoritative source on the current scope, and the 2024 SB 1023 amendment cycle is the milestone to check first when re-verifying the rule.

Territorial reach: do we have to care if we're outside Virginia?

Yes, in two situations. §59.1-576 applies VCDPA to any controller that produces products or services 'targeted to' Virginia residents, there is no physical-presence requirement. A New York or Bangalore SaaS that ships marketing pages, signup flows, or paid product to Virginia consumers and crosses the 100,000-consumer threshold falls inside the law.

VCDPA's reach does not extend to non-Virginia consumers. A controller that meets the threshold for Virginia consumers but not the equivalent threshold in (say) Colorado or Connecticut does not owe Virginia obligations to non-Virginia consumers, and vice versa. In practice, most multi-state controllers apply a 'highest common denominator' policy and treat every US consumer the same, but the legal obligations are state-by-state.

How Benny the Doorman fits into a VCDPA-aware deployment

Benny is a fingerprinting SDK and a hosted API, not a consent management or universal-opt-out platform. That separation is deliberate: the controller's CMP or preference centre owns the opt-out gating, and the fingerprint should only be requested once the gating signal indicates the consumer has not opted out of the purpose category that needs it.

Three integration steps for a VCDPA-aware deployment. First, defer the call to Benny's fingerprint API behind a Universal Opt-Out Mechanism check (the GPC header) and your own preference-centre flag when the purpose is targeted advertising or sale. Second, complete and store a Data Protection Assessment for each purpose listed in §59.1-580 before going live, Benny's documentation lists the per-signal categories, retention defaults, and architectural details that populate the technical sections of the assessment. Third, when the same Benny deployment supports both an exempt purpose (anti-fraud) and a regulated purpose (targeted advertising), architect those as separate data flows with separate retention windows and access scopes, the §59.1-578 opt-out has to be honoured on the regulated flow without breaking the exempt one.

Benny's processing is performed in-region on infrastructure in Chennai, India. US controllers transferring fingerprint hashes to that infrastructure should treat it as third-country processing under their own service-provider obligations; the standard DPA is available on request. VCDPA itself does not impose a US-only data-residency requirement on fingerprint hashes.