The Virginia privacy law going into effect January 2023 received some minor tweaks this month. In particular, provisions around deletion requests. As originally enacted, the Virginia law mirrored similar provisions in California and Europe, giving individuals the ability to ask for their information to be deleted. As amended, if information that the individual asks to be deleted was obtained “from a source other than the consumer” then the business can treat that deletion request as a request to opt out of targeted advertising, sale, and profiling. The business can also delete the information.

Putting it Into Practice: This amendment is a reminder for companies that the California and European concept of “rights requests” will soon be extended to individuals in Virginia, Utah and Colorado. While the processes are similar, there are nuances that are worth examining prior to the 2023 implementation dates.