What is cross-context behavioral advertising under the CPRA?

Virginia’s Consumer Data Protection Act (VCDPA) and California’s CCPA are both state privacy laws, but they have different scopes and requirements.

Both laws give consumers rights over their personal data, including access, deletion, correction, and certain opt-out rights. However, they differ in areas such as business thresholds, targeted advertising, data sales, sensitive data, and B2B or employment-related information.

One key difference is how they define a sale. Under the VCDPA, a sale generally means exchanging personal data for monetary consideration. The CCPA uses a broader definition that can also cover transfers made for other valuable consideration. Virginia also excludes individuals acting in a commercial or employment context from its definition of a consumer.

Businesses operating in both states should evaluate the requirements of each law separately rather than treating VCDPA compliance as equivalent to CCPA compliance.