Beginner’s Guide to VCDPA Compliance in WordPress

As someone who’s managed WordPress sites for many years, learning yet another privacy law felt like a lot. But when I dug in, I realised it’s more straightforward than it looks.

Still, I’ve seen plenty of site owners make compliance harder than it needs to be—either by overcomplicating the process or missing simple steps.

That’s why I created this guide. I’ll walk you through the VCDPA’s core requirements step by step and share the tools I use to improve WordPress compliance without getting overwhelmed by legal jargon.

What is the Virginia Consumer Data Protection Act (VCDPA)?

The Virginia Consumer Data Protection Act (VCDPA) is a state privacy law that gives Virginia residents more control over their personal data. This includes information that can identify someone directly or indirectly, such as names, email addresses, IP addresses, or data collected through website forms or tracking tools.

Even if your business isn’t based in Virginia, the VCDPA might still apply to your WordPress site. What matters is whether you collect personal data from Virginia residents.

That said, the law doesn’t apply to every site. It mainly targets larger businesses and organisations.

Generally, you need to comply with the VCDPA if you:

• Control or process the personal data of 100,000 or more Virginia consumers in a calendar year, or
• Control or process the personal data of at least 25,000 Virginia consumers and get over 50% of your total revenue from selling personal data.

Keep in mind that the law also applies only to businesses or organisations operating for commercial purposes.

If your site fits one of those categories, then it’s essential to understand how the VCDPA works and what steps you need to take to stay compliant.

Why Should WordPress Users Care About VCDPA Compliance?

If your WordPress site falls under the VCDPA, then staying compliant helps you avoid potential penalties. The Virginia Attorney General enforces the VCDPA, and violations can lead to fines of up to $7,500 per incident.

Fortunately, you’ll usually receive a 30-day warning and a chance to fix the issue before any penalties are applied.

Consumers also can’t sue you directly under this law. Only the Attorney General can take action, which adds a layer of protection, but doesn’t mean you should ignore compliance.

More importantly, showing that you care about user privacy helps build trust with your audience.

When visitors know you’re being transparent and responsible with their data, they’re more likely to stick around, sign up for your email newsletter, or buy from your online store.

Simply put, staying compliant is t just a legal duty. It’s also key to building trust and achieving long-term success.

How VCDPA Affects Your WordPress Site

If your site is covered by the VCDPA, you must support several privacy rights for your visitors. That means making it easy for Virginia residents to control how you collect, use, and delete their personal data.

As a WordPress site owner, here are the main rights you need to understand and support:

• The Right to Know: Visitors can ask what personal data you’ve collected about them.
• The Right to Correction: They can ask you to correct any incorrect or outdated information.
• The Right to Opt-Out: Users can ask you not to sell or share their personal data with other companies.
• The Right to Data Portability: They can request a copy of their personal data in a format they can use elsewhere, like a ZIP file.
• The Right to Delete: Users can ask you to permanently delete the data you’ve collected about them.

Throughout this guide, I’ll show you how to support each right using WordPress tools and beginner-friendly strategies.

How to Improve Your VCDPA Compliance in WordPress

VCDPA compliance may sound technical. But at its core, it’s about being transparent with your visitors and giving them control over their personal data.

As a WordPress site owner, you can take practical steps to meet these requirements. These include limiting how much data you collect, creating clear policies, and making it easy for users to opt out or request changes.

In this article, I will walk you through each part of the process. You can follow them step-by-step or jump to the parts that apply to your site using the links below:

Perform a Data Audit

The first step to VCDPA compliance is understanding how your website collects and stores personal data. That means reviewing the tools, plugins, and services you use—and documenting the information they gather.

To start, I recommend listing every WordPress plugin on your site, along with any third-party tools that interact with user data. This could include analytics platforms, form builders, or SEO tools.

Once you have that list, check what kind of personal information each tool collects. For example, if you’ve added a quote request form, record whether it asks for names, company details, or job titles.

To guide your audit, ask yourself:

• What personal data do I collect? This includes names, email addresses, IP addresses, payment details, and any other data submitted through forms or comments.
• Where is this data stored? Is it saved on your own server or sent to an outside service?
• Why am I collecting this information? The VCDPA says data must be “adequate, relevant, and reasonably necessary” for your stated purpose.
• How long do I keep it? You should only store personal data as long as it’s needed for its original purpose.
• Do I share this data with anyone? This includes service providers, third-party tools, or advertising networks. Be sure to check whether any of this data is used for targeted ads.

Once you’ve completed your audit, you’ll have a clear picture of what data you collect, where you store it, and what you need to adjust to meet VCDPA requirements.

Create a Data Compliance Record

After completing your data audit, the next step is to keep a written record of your findings. This document should explain the actions you’ve already taken to follow the VCDPA, along with any updates or fixes you made during your audit.

This record provides clear proof that you take privacy seriously. This can help if you’re ever audited or if someone asks about your compliance practices.

As you’ll see throughout this guide, it’s tough to follow the VCDPA behind the scenes. You also need to show you’re doing things the right way.

Every business website is different, but I recommend running a new data audit and updating your records at least once per year.

You should also update your records any time you change how your site collects or uses personal data. For example, after installing a new plugin that collects user info, or when the law itself changes, it’s a good time to revisit your audit and test.

Keeping this record up to date doesn’t take much time, and it’ll make compliance much easier in the long run.

Collect Less Data

The VCDPA says you should only collect personal data that’s “adequate, relevant, and reasonably necessary” to meet a specific goal.

In other words: don’t collect anything you don’t truly need.

This idea is known as data minimisation. It means reviewing what you currently collect and looking for ways to reduce it. If a piece of information isn’t essential for your site to function—or for the task at hand—it’s better to leave it out.

After completing your data audit, carefully review all the information you collect. Ask yourself: “Do I truly need every single piece of information I’m asking for?”

If something isn’t necessary, remove it. The less data you collect, the easier it is to stay compliant, and the less you’ll have to manage when users make requests.

This approach also builds trust. By avoiding unnecessary questions, you show that you respect your visitors’ privacy and value their time.

Create a Privacy Policy

A privacy policy is a page on your website that clearly explains what personal data you collect, how you use it, and who you share it with.

Having a clear, up-to-date privacy policy is essential for VCDPA compliance. It helps visitors understand how you handle their information and directly supports the VCDPA’s Right to Know requirement.

To make things easier, WordPress includes a built-in tool for creating a privacy policy. You can find it by going to Settings » Privacy in your WordPress dashboard.

Alternatively, you can use our own WPBeginner privacy policy page as a starting point.

Just remember to change all mentions of ‘WPBeginner’ to your specific business or website name.

Want more detailed instructions? We also have a complete, step-by-step guide to adding a privacy policy in WordPress.

If your site already has a privacy policy, that’s great, but you’ll still need to review and update it to reflect the VCDPA.

In particular, make sure it covers the key rights your visitors have:

• Right to Know
• Right to Delete
• Right to Correction
• Right to Opt Out

You’ll also need to explain how users can act on those rights. For example, you might link to a contact form where visitors can request access to their data, or provide steps for updating their profile information.

Finally, keep your privacy policy up to date. This ensures it always reflects your current data practices and any changes to the VCDPA.

Many websites use cookies to track user behaviour, display ads, or measure analytics. If your site does this, the VCDPA expects you to inform users and give them a way to opt out.

Unlike the GDPR, which requires visitors to actively agree before you collect data, the VCDPA follows an opt-out model. That means you can often collect data by default, as long as users know what’s being collected and can opt out.

One of the simplest ways to meet this requirement is by adding a cookie popup. A good popup should explain what types of cookies your site uses, what data it collects, and how it uses that information. It should also give users a clear way to opt out.

I recommend using WPConsent for this. It’s the same plugin we use on WPBeginner to manage cookie banners and user consent.

It works well for WordPress beginners and is actively updated to follow privacy laws like the VCDPA, GDPR, and CCPA.

You can also find a free version of WPConsent in the WordPress plugin directory.

To get started, simply install and activate the plugin.

After you activate it, WPConsent will automatically scan your site for active cookies. It will then record all the cookies it finds.

Next, WPConsent’s setup wizard will help you customise your cookie popup. You can adjust the layout, the text size, button styles, colours, and even add your own custom logo.

As you make changes, WPConsent will show a live preview. This lets you see exactly how the banner will look on your WordPress website.

When you’re happy with how everything looks, save your changes. The cookie banner will then appear on your WordPress website, helping you comply with the VCDPA.

For more detailed instructions, see our full guide on how to add a cookie popup in WordPress.

Write a Separate Cookie Policy 

A cookie popup is a good starting point, but it’s also smart to create a dedicated cookie policy.

This separate page gives visitors more detail about how your site uses cookies. That way, they can better understand what personal information you collect and how you use it.

In your cookie policy, you should list all the different types of cookies you use on your site. For example, you might use essential cookies (required for your site to work), analytics cookies (to measure website traffic), or marketing cookies (for advertising).

You should also explain what each type of cookie does. For example, some cookies might track user behaviour or deliver targeted ads.

It’s also helpful to describe what personal data each cookie collects. This might include a visitor’s IP address, device type, or browsing activity.

To build trust, keep your cookie policy easy to understand. Avoid technical terms or legal jargon that’s hard to follow. Instead, use clear, direct language anyone can understand.

Once your cookie policy is written, make sure it’s easy to find. I recommend linking to it in your footer, your cookie popup, and your main privacy policy.

Luckily, a tool like WPConsent can do much of this for you.

As you saw earlier, when you first install WPConsent, it automatically scans your site and identifies any active cookies.

To do this, go to WPConsent » Settings.

In the plugin’s settings, choose the page where you want to display the cookie policy.

WPConsent will then add this policy to your chosen page. It’s that simple.

If you’re using WPConsent to display a cookie popup, then visitors can w access this policy directly from the popup itself.

They just need to select the ‘Preferences’ button.

From there, they can click the ‘Cookie Policy’ link.

WPConsent will then take them straight to the correct page.

Block Third-Party Scripts

One of the biggest challenges of VCDPA compliance is that it also covers external tracking tools. These include popular services like Google Analytics and Facebook Pixel.

The reason for this is simple: these tracking tools often collect visitor data. Under the VCDPA, you’re responsible for managing how these third-party tools collect, store, and use that personal information.

You also need to give visitors a way to stop these tools from tracking them if they choose.

So, how do you control tracking scripts from other companies? The answer is simple: automatic script blocking.

The VCDPA generally allows tracking tools unless a visitor opts out, especially for targeted advertising. But a best practice for building user trust is to block tracking scripts until visitors opt in.

This approach goes beyond VCDPA requirements and also helps you comply with stricter laws like GDPR. With this feature, scripts won’t load until the visitor explicitly agrees.

It also provides visitors with the information they need to understand what they’re agreeing to before you collect any data. This helps you meet the VCDPA’s Right to Know rule.

Plus, you get a head start on complying with other privacy laws like Europe’s GDPR, which requires opt-in consent. It’s a great way to strengthen your website’s privacy practices overall.

Fortunately, WPConsent includes an automatic script-blocking feature that works out of the box.

Simply activate the plugin, and it will automatically find and block common tracking scripts. This includes tools like Google Analytics, Google Ads, and Facebook Pixel. Even better, WPConsent does this without breaking your site.

As soon as a visitor gives consent, WPConsent runs the blocked script. This provides a smooth user experience because the page doesn’t need to reload.

Track and Log Visitor Consent

Even if you follow all the VCDPA rules, regulators might still question how you handle data or even audit your site.

If this happens, you’ll need to prove that you’re respecting your audience’s choices. That’s why it’s important to keep a detailed record of user consent.

WPConsent makes this easy by automatically logging each user’s consent. It saves key details, including the user’s IP address, consent choices, and the exact date and time they made them.

You can see this information at any time by going to WPConsent » Consent Logs in your WordPress dashboard.

Need to share this information with an auditor or team member? You can export it from your WordPress dashboard in just a few clicks.

To do this, just click the ‘Export’ tab. Then, enter the ‘From Date’ and ‘To Date’ for the export. This creates a CSV file you can share with auditors, customers, and anyone else who needs access.

Provide an Easy Opt-Out for Data Sales

Under the VCDPA, if your site sells or shares personal data, then you must give visitors a way to opt out.

The easiest way to do this in WordPress is with WPConsent’s Do Not Track add-on. Despite its name, it gives you exactly what you need to meet the VCDPA’s opt-out-of-sale requirement.

To get started, go to WPConsent » Do Not Track » Configuration inside your WordPress dashboard.

WPConsent will then guide you through installing this add-on and creating a ‘Do Not Track’ form.

Once it’s active, visitors can fill out a simple form to opt out of the sale or sharing of their data.

Even better, WPConsent stores all opt-out requests directly on your website in a secure table. That way, you keep full control over sensitive data instead of depending on external services.

It also logs each request automatically, giving you built-in proof of compliance in case of an audit.

Support the ‘Right to Delete’

As I mentioned earlier, the VCDPA gives users the right to ask you to delete their personal data.

There are different ways to handle these requests, but the easiest is to add a ‘data erasure’ form to your site.

This is where WPForms can help. It’s a user-friendly form builder that lets you create all kinds of forms using a drag-and-drop editor.

For the VCDPA’s ‘Right to Delete’, WPForms includes a ready-made Right to Erasure Request Form template.

This provides a strong starting point, so you can add this important form to your site quickly and easily.

After installing WPForms, you can customise the Right to Erasure Request Form template in a user-friendly editor. This makes it easy to add, remove, and change the default fields.

Once you’re happy with the setup, you can add it to your site using a shortcode or the WPForms block.

Finally, make sure visitors can find this form easily. I recommend linking to it from your privacy policy, or embedding the form directly on that page.

WPForms also includes an entry management system that lets you filter form submissions and act on new deletion requests right away.

To review your entries, go to WPForms » Entries in the WordPress dashboard.

You’ll w see all the different forms you’ve created. Find the data erasure form and click it.

WPForms will w display all your ‘delete data’ requests.

To process these requests, use WordPress’s built-in ‘Erase Personal Data’ tool to delete user information in just a few clicks.

To begin, go to Tools » Erase Personal Data.

In the ‘Username or email address’ field, type in the user’s name or email.

This tool also has a ‘Send personal data erasure confirmation email’ setting. Use it to let the user know you’ve deleted their data.

For full VCDPA compliance, you’ll also need to delete this data from any other tools or services where it’s stored.

By creating this clear process, you make it easy for users to exercise their ‘Right to Delete,’ a core part of VCDPA compliance.

Handle Data Access Requests Efficiently

Under the VCDPA, visitors have two related rights: the right to access their data and the Right to Data Portability. This means they can request a copy of their personal data in an easy-to-use format.

The good news is you can handle these requests the same way you manage data deletion.

To start, add a data access form to your site with WPForms. It includes a ready-made Data Request template that collects all the information needed to identify the user in your records.

After adding this form to your site, WPForms will automatically record and show all access requests directly in your WordPress dashboard.

That way, you can view and respond to new requests as they arrive.

To review these requests, just go to WPForms » Entries.

Here, select your data request form. WPForms will then show all the entries for this form.

WordPress also includes a built-in Export Personal Data tool. You can use this to get all known data for any user, conveniently packaged as a .zip file.

To create this file, go to Tools » Export Personal Data in your WordPress dashboard.

Then enter the person’s username or email address to find the correct record.

Then, simply share the .zip file with the person who made the request.

Support the ‘Right to Correction’

Under the VCDPA, people can ask you to correct or update their personal data if it’s wrong or incomplete.

This might happen after a user requests and reviews a copy of their personal data. Or, some visitors may contact you directly if their information changes.

For example, they might move to a new address, get a new phone number, or want to update other details they previously shared with you.

As with other user rights, the easiest way to comply with the VCDPA is to add a form to your site. Once again, WPForms has a ready-made template for this exact task.

The Personal Information Form Template comes with a built-in ‘Update Existing Record’ checkbox. Users can check this box to show they’re sending information to update a profile you already have for them.

This means you’ll immediately know why the user submitted this form.

This template includes many essential fields, such as legal name, preferred nickname, email address, home phone, and cell phone.

However, every website stores different kinds of information, so you may need to customise the form to collect additional details.

In that case, open the template in the WPForms editor. From there, you can add more fields using simple drag-and-drop.

Then fine-tune these fields using the left-hand panel. Just repeat these steps until the form collects all the information your users might want to edit.

With that done, you can publish the form on your site as normal.

Don’t forget to make your correction form easy to find. I recommend adding a link in important places, such as your website’s footer or privacy policy.

Remember that WPForms shows all form entries directly in your WordPress dashboard. This makes it easy to spot data correction requests as they come in.

How you update a user’s information will depend on the tools and software your site uses. For example, you might need to update a record inside your customer relationship management (CRM) app or email management software.

If the data is stored directly in WordPress, go to Users » All Users in your dashboard.

Here, find the user profile you need to update and click its ‘Edit’ link.

You will w see all the essential information WordPress has stored for that user.

From here, you can make any necessary changes and then save the user’s updated profile.

FAQs About VCDPA Compliance in WordPress

VCDPA compliance can seem overwhelming at first, but it doesn’t have to be.

To help, here are some of the most common VCDPA questions we hear at WPBeginner.

These answers cover the key parts of VCDPA compliance, clear up common concerns, and show you how to stay on the right side of the law.

What Is VCDPA and How Does It Affect My WordPress Site?

The VCDPA is a privacy law that gives Virginia residents more control over their personal data.

If your WordPress site handles personal data of Virginia residents and meets certain thresholds (such as processing the data of 100,000 or more consumers), then you must follow the VCDPA in order to avoid penalties.

How Does VCDPA Differ From GDPR?

Both the VCDPA and GDPR focus on protecting personal data. However, the VCDPA applies specifically to Virginia residents.

It also has some unique rules not found in GDPR. For example, VCDPA generally uses an ‘opt-out’ approach for most data collection. This means you can collect data unless a user specifically tells you t to.

Meanwhile, GDPR typically requires an opt-in, meaning you need the user’s clear consent before collecting their data.

That’s why it’s important to understand which privacy laws apply to your site.

What Should I Do If I Receive a Data Request (Like a Right to Delete Request)?

If you get a request from a Virginia resident to access, delete, or correct their personal data, you must respond as soon as possible, but in all cases within 45 days.

You may extend this period once by another 45 days when reasonably necessary, as long as you inform the consumer within the first 45-day window.

This means confirming the request, providing the requested data, and taking the correct action, such as deleting the data.

Since you’re on a deadline, you need a clear process for handling these requests.

How Do Small Websites Handle VCDPA Compliance?

Smaller websites may need to comply if they meet the VCDPA thresholds for processing Virginia consumer data. This means they:

• Process the personal data of 100,000 or more Virginia consumers in a year, OR
• Process data of at least 25,000 consumers and get over 50% of their total income from selling that data.

If your site qualifies, here’s how you can start working toward compliance:

• Set up privacy management plugins, such as cookie consent tools and form plugins for collecting data requests.
• Avoid collecting unnecessary data, and stick to data minimisation.
• Ensure all data collection methods follow the VCDPA rules.
• Keep your privacy and cookie policies up to date so they reflect your current practices.

Even if you’re running a smaller site, the right tools and processes can make VCDPA compliance easier and help you build trust with your audience.

Additional Resources for Privacy Compliance

Complying with privacy laws isn’t a one-time task. You’ll need to keep learning and updating your site to stay in line with the law.

With that said, here are some resources to help you on that journey:

I hope this beginner’s guide to VCDPA compliance for WordPress websites has helped you understand this important privacy law. Next, you may want to see our expert picks for the best GDPR plugins to improve compliance, or our guide on keeping personally identifiable info out of Google Analytics.