Video Surveillance Laws in Virginia

A single Virginia camera deployment can touch four separate bodies of law: a criminal privacy statute, a wiretap law, a consumer data act, and a sector-specific regulation. None of them speak to each other, and none of them forgive a security team that gets the overlap wrong. The throughline is narrow but unforgiving: almost every question turns on whether the person on camera had a reasonable expectation of privacy, and whether the system captured audio along with video.

For a PSOC operator running cameras across Virginia sites, the practical task is to map each camera, each location, and each recording mode to the specific statute that controls it, then build the compliance step into standard operating procedure before footage is ever pulled.

Core Legal Principles and Primary Statutes

Virginia's framework rests on the reasonable expectation of privacy doctrine and a cluster of Title 18.2 criminal statutes prohibiting secret visual monitoring in private contexts. These statutes focus on whether a person is recorded in a protected location or under circumstances that would violate that person's reasonable expectation of privacy.

Section 18.2-130 criminalizes peeping or spying into a dwelling, and separately bars viewing a nonconsenting person who is nude or in a state of undress in enclosures such as restrooms, locker rooms, and bedrooms; the offense is a Class 1 misdemeanor that exempts lawful criminal investigations and correctional security surveillance.

Section 18.2-130.1 extends the peeping prohibition to electronic devices and drones and makes it a Class 1 misdemeanor to knowingly and intentionally use a drone to secretly or furtively peep or spy into or through a window, door, or other aperture of a dwelling. Section 18.2-121.3 makes it a Class 4 felony to cause a drone to enter the property of a contracted defense facility and obtain or attempt to obtain certain imagery.

Section 18.2-386.1 is the principal nonconsensual imaging statute and makes it unlawful to knowingly create any image of a nonconsenting person who is nude or in a state of undress in a protected location where that person would have a reasonable expectation of privacy; a companion provision, § 18.2-386.2, criminalizes the malicious dissemination or sale of such imagery.

Audio Versus Video Recording

The single most important operational distinction in Virginia surveillance law is whether a system captures audio. Silent video and audio recording sit under different statutes with sharply different penalties.

Virginia is a one-party consent state for audio. § 19.2-62 prohibits intentional interception of wire, electronic, or oral communications but exempts interception where one party has given prior consent. The consent requirement applies only where the speaker has a reasonable expectation of privacy. Recording a conversation in a public space where no such expectation exists requires no consent. A private conversation, including one held in a public place, requires the consent of at least one party.

Where Surveillance Is Allowed and Where It Is Prohibited

Virginia statutes name protected private spaces explicitly, and surveillance targeting those spaces is criminal regardless of technology. Each surveillance environment maps to a specific compliance posture under the controlling statutes.

Lower-risk environments for video-only monitoring. Public streets, parking lots, and building exteriors are generally lower risk for video-only monitoring where no reasonable expectation of privacy is implicated, though any audio capture remains subject to the consent requirements of § 19.2-62 alongside § 18.2-386.1.

The same posture applies to retail floors, lobbies, and common corridors, where silent video is lower risk under § 18.2-386.1 so long as no nudity, undress, or reasonable expectation of privacy is implicated. Private offices fall into a more context-specific category under § 18.2-386.1: video-only monitoring may be acceptable, but operators should avoid audio without consent and should not target nudity, undress, or otherwise private contexts.

Categorically prohibited environments. Surveillance of restrooms, locker rooms, and changing areas is criminal under §§ 18.2-130 and 18.2-386.1, and the same prohibition reaches hotel rooms, tanning booths, and bedrooms. Hidden audio capture without consent is a felony under § 19.2-62. These categories are not subject to a balancing test; they are off limits regardless of the technology used or the operator's intent.

Workplace Surveillance and Employee Privacy

For workplace video surveillance, Virginia compliance derives from the general criminal privacy statutes and the wiretap law. Employee monitoring must be checked against those sources and the context of the recording. Within those bounds, bathrooms and locker rooms are off limits. Open work areas such as desks, break rooms, and hallways fall outside the private spaces enumerated in the statutes. Silent video in common work areas is lower risk; combining video with audio triggers the § 19.2-62 one-party consent requirement.

The Virginia Consumer Data Protection Act, effective January 1, 2023, contains a broad exemption for employee data. Its definition of consumer excludes a natural person acting in a commercial or employment context, so routine workplace footage of employees in their employment capacity does not trigger VCDPA consumer rights obligations. The criminal prohibitions and the wiretap law still apply regardless of employment context.

Two further constraints apply. § 18.2-60.5 makes it unlawful to install a location tracking device to track a person without consent, and the statute reaches employees and visitors alike. For union-represented workforces, the National Labor Relations Act adds a separate layer: employer monitoring that tends to interfere with Section 7 protected activity can constitute an unfair labor practice, so labor counsel should review monitoring changes at covered facilities.

Notice and Consent Requirements

The Virginia surveillance statutes discussed here define criminal conduct and do not themselves create a general signage rule for most commercial settings.

The one context where an electronic monitoring notice is explicitly required by statute is nursing facilities. Administrative code 12VAC5-371-191 requires written consent from roommates before visual recording in shared resident rooms, and § 32.1-138.5:1 permits residents or their legal representatives to condition consent to monitoring devices in their rooms. These provisions reach licensed nursing facilities only.

For audio-capturing systems, notice can help manage risk. The one-party consent rule still controls audio capture, and signage is not a universal substitute for consent. Posted notice may help document how an operator communicates monitoring practices in common areas, but the statutes discussed here do not create a general signage mandate.

Data Privacy, Retention, and Biometric Identification

The VCDPA applies to entities that control or process personal data of at least 100,000 Virginia consumers in a year, or at least 25,000 consumers where more than half of gross revenue comes from selling personal data. State government, nonprofits, higher education institutions, GLBA-covered financial institutions, and HIPAA-covered entities are exempt under VCDPA.

A critical exclusion shapes how the act treats footage. Biometric data under § 59.1-575 excludes a physical or digital photograph, a video or audio recording, or data generated from them in the circumstances covered by the statute, so raw surveillance footage, standing alone, is generally not biometric data under the VCDPA. If biometric identification technology is applied to that footage to generate a faceprint, whether the derived faceprint constitutes biometric data is legally unsettled. Separately, the OAG summary treats biometric data processed to uniquely identify an individual as sensitive data requiring opt-in consumer consent, so private operators should treat such output as potentially sensitive.

On the public side, § 15.2-1723.2 and parallel campus police rules bar local law enforcement and campus police from real-time biometric tracking absent statutory authorization. Those provisions apply to public-sector actors. Private operators using biometric identification to uniquely identify consumers should separately evaluate VCDPA sensitive-data obligations.

For private-sector footage, the Virginia statutes discussed above do not set a universal retention period, so retention should be handled through policy unless a sector-specific or contractual rule applies. Where the VCDPA applies, personal data must be protected by reasonable security measures, and controller-processor contracts must address deletion or return of data and the duration of processing.

Penalties and Legal Risk

Virginia's surveillance offenses span misdemeanor to felony, and the classification turns on the statute violated and the identity of the victim.

Unlawful filming of an adult victim under § 18.2-386.1(C) is a Class 1 misdemeanor, but the same conduct directed at a victim under 18 escalates to a Class 6 felony under § 18.2-386.1(D). Peeping or spying into a private space under § 18.2-130 is a Class 1 misdemeanor. On the drone side, under § 18.2-121.3(D), knowingly, intentionally, and without authorization causing a drone to enter the property of a contracted defense facility and obtaining or attempting to obtain images revealing controlled technical information is a Class 4 felony. Illegal interception of communications under § 19.2-62 is a Class 6 felony, reflecting Virginia's particularly strict treatment of unauthorized audio capture.

A third conviction under § 18.2-386.1 within ten years is a Class 6 felony, and on the audio side illegally intercepted communications are inadmissible in proceedings while the devices used are subject to forfeiture. Civil exposure can also follow, since aggrieved parties may pursue remedies under both state and federal wiretap frameworks where unauthorized audio capture occurs.

Federal Overlays

The federal Wiretap Act under ECPA Title I mirrors Virginia's structure and permits interception where one party consents. The Virginia framework adopts the same structure. A HIPAA-covered entity may not give media or third parties access to PHI captured on video without a valid HIPAA authorization.

Practical Compliance Guidance for Security Teams

Use these compliance steps to align camera operations with Virginia statutes and authoritative sources.

• Disable audio where oral communications may carry a reasonable expectation of privacy unless a party consents, consistent with § 19.2-62.
• Audit camera placement exclusion zones so no camera targets a restroom, locker room, changing area, hotel room, or bedroom.
• Document a written placement and justification policy for each camera.
• Set retention schedules and disposal procedures. For private-sector footage, define deletion timelines by policy unless a sector-specific or contractual rule applies; where the VCDPA applies, define deletion timelines in controller-processor contracts.
• Restrict biometric identification and treat its output as potentially sensitive when it is used to uniquely identify consumers. Evaluate opt-in consent before biometric identification.

Sector-specific overlays add requirements. Healthcare operators must not share PHI-containing footage without HIPAA authorization. Nursing facilities need resident and roommate consent before room monitoring under § 32.1-138.5:1 and 12VAC5-371-191. Children's residential facilities require written, Office of Human Rights-approved policies before recording under 12VAC35-46-510.

Building a Defensible Surveillance Posture in Virginia

Compliance in Virginia comes down to disciplined placement and a clear line on audio. Keep cameras out of enumerated private spaces, run video-only in common areas, and confirm consent before any audio capture. Treat biometric identification output as sensitive data, and layer in HIPAA, nursing facility, and children's residential requirements where they apply. A documented placement policy, a defined retention schedule, and periodic angle audits turn a patchwork of statutes into an operating standard a security team can defend.

Frequently Asked Questions

Is Virginia a one-party or two-party consent state for audio recording, and how does that affect security camera systems that capture sound?

Virginia is a one-party consent state, meaning one participant must consent to audio capture. This matters primarily in spaces with reasonable privacy expectations, not public areas where such expectations don't exist.

Does the Virginia Consumer Data Protection Act (VCDPA) classify surveillance camera footage as biometric data, and what happens when facial recognition is applied to that footage?

Raw footage is excluded from biometric data definitions. When facial recognition generates a faceprint for identification, its treatment may depend on whether it qualifies as biometric data; under the VCDPA, biometric data is sensitive data, and processing sensitive data requires consumer consent.

What are the penalties for unauthorized surveillance in Virginia, and how do they differ between video-only recording and audio capture?

Penalties escalate based on victim age and recording type. Unauthorized audio interception carries steeper penalties as a Class 6 felony, while most video-only violations are Class 1 misdemeanors unless targeting minors, which elevates charges to felony level regardless of medium.