Virginia CDPA 59.1-578 A 5: Consent for sensitive data

Controllers may not process sensitive data (racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, data collected from a known child, and precise geolocation within 1,750 feet) without the consumer's consent, a clear affirmative, freely given, specific, informed and unambiguous act; for a known child, processing must follow COPPA.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Controller duties and transparency (59.1-578) – Virginia CDPA

59.1-578 A 1 Data minimisation
59.1-578 A 2 Purpose limitation
59.1-578 A 3 Reasonable data security
59.1-578 A 4 Non-discrimination
59.1-578 A 6 Ban on selling precise geolocation data
59.1-578 C Privacy notice
59.1-578 D Disclosure of sale and targeted advertising
59.1-578 E Secure means to submit requests

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Virginia CDPA controls