No
Yes – private plaintiffs can seek the greater of actual damages or $500 for violations under the VCDPA, and for willful actions, treble damages or $1,000, whichever is greater.
Yes (limited) – private plaintiffs can seek damages of not less than $100 and not more than $750, whichever is greater, if their non-encrypted personal information or email address (together with information that would allow account access) is subject to unauthorized access due to a business’ failure to implement reasonable security measures.
Consent
Generally not required except for the processing of sensitive data.
Required where a consumer has restricted processing or a risk assessment indicates the risks of processing outweigh the benefits to the consumer.