Virginia has enacted the U.S.’s second comprehensive privacy law, creating consumer privacy rights and business obligations similar to those in the GDPR and CCPA, while adding a few new twists. The law, enacted March 2, 2021, will require companies, for the first time in the U.S., to obtain residents’ consent before collecting sensitive personal data. This article explains the elements of the law and its requirements, highlights ambiguities that companies will confront, and provides perspective on the law’s main impacts. See “Privacy Resolutions for 2021” (Jan. 20, 2021).