The Virginia Consumer Data Protection Act, which is scheduled to go into effect in 2023, states that a consumer has the right to “opt out of the processing of the personal data for purposes of [] targeted advertising . . . .”1 Unlike other state statutes, such as the CPRA, the Virginia Consumer Data Protection Act does not contain an exemption for situations in which a consumer has opted into the sharing of personal information in the first instance. As a result, even if a business has obtained the opt-in consent of a Virginia consumer (e.g., through an opt-in cookie banner), the business is still required to permit the consumer to select, at any time, to opt out to the further sharing of their personal information for the purposes of targeted advertising.

1 Va. Code §59.1-573(A)(5) (2021).