The Act applies to persons that do business in Virginia or target products or services at Virginia residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving more than half of gross revenue from selling personal data. Consumers are Virginia residents acting in an individual or household context; employees and business contacts acting in a commercial or employment context are outside it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.