Camera-related state law

The governing audio statute is Va. Code 19.2-62, which makes interception of wire, oral, or electronic communications a Class 6 felony unless an exception applies. The most-used commercial exception is one-party consent: a participant in the conversation can record without notifying the other party. Virginia is therefore a one-party consent state for audio.

Video-only surveillance of common areas with posted notice is generally lawful. Hidden cameras in places where privacy is reasonably expected (restrooms, locker rooms, dressing rooms, hotel guest rooms) trigger separate criminal exposure under Va. Code 18.2-386.1 (unlawful filming) and related invasion-of-privacy provisions. Posted notice at the entrance is the industry standard for any commercial property.

Practical translation. Commercial VA camera installs default to video-only on the cameras and route audio capture through a separate documented intercom or call-recording workflow. Federal facilities and government contractors in the DC metro and Hampton Roads inherit additional NDAA Section 889 and contracting-officer expectations on top of state law.

Security business licensing (DCJS)

Virginia is one of the more heavily-regulated states for security businesses. The Virginia Department of Criminal Justice Services regulates private security services under Va. Code 9.1-138 et seq. and 6 VAC 20-171. Categories include alarm respondent, electronic security technician, electronic security sales representative, central station dispatcher, private investigator, armed and unarmed security officer, and others.

For commercial buyers, the practical takeaway is that any company installing alarm or electronic security equipment in Virginia for compensation must hold a DCJS license and individual employees performing covered functions must be registered. The DCJS publishes the active license roster and current registration rules at dcjs.virginia.gov. Buyers verifying a vendor before signing should pull the DCJS license number and the registrations of the technicians who will be on site.

Biometric data and the VCDPA

The Virginia Consumer Data Protection Act, Va. Code 59.1-575 et seq., took effect January 1, 2023. The VCDPA defines biometric data as sensitive personal data and requires controllers to obtain consent before processing it. The statute applies to controllers conducting business in Virginia or producing products targeted to Virginia residents who meet defined thresholds (controlling personal data of at least 100,000 consumers, or 25,000 consumers and deriving over 50 percent of gross revenue from sale of personal data).

For commercial security buyers, the practical reach is fingerprint and facial-recognition access control and any AI camera that builds a faceprint template for identification. VCDPA compliance requires consent, privacy notice, consumer-rights handling, and a data protection assessment for high-risk processing. Enforcement is by the Virginia Attorney General; there is no private right of action.

Privacy in the workplace

Virginia does not have a single workplace electronic-monitoring statute. Pure video surveillance of common work areas with posted notice is the routine pattern. Cameras in employee-only spaces with a reasonable expectation of privacy (restrooms, locker rooms, lactation rooms) are off-limits.

Most VA employers issue a single workplace surveillance notice in the employee handbook that covers cameras, badge access, computer monitoring, and call recording together. Audio capture is regulated by Va. Code 19.2-62 (one-party consent). VCDPA reaches employee biometric data only at covered controllers, but most fingerprint timeclock and facial-access deployments document consent regardless of threshold.

Video retention requirements

Virginia has no single statewide video retention statute. Retention is set by the regime that governs the industry.

  • Cannabis (medical). The Virginia Cannabis Control Authority publishes camera and retention rules for pharmaceutical processors and dispensing facilities. Pull the current CCA rules before designing the install.
  • Healthcare. HIPAA Security Rule (45 CFR Part 164) governs PHI-touching footage. Retention is typically 30 to 90 days at the facility.
  • Retail and hospitality with card data. PCI-DSS Requirement 9 specifies camera coverage of the cardholder data environment with 90-day retention.
  • Federal contractors. Virginia hosts the Pentagon, Quantico, NSA, and a dense federal contractor base. NDAA Section 889 controls vendor selection. CMMC, CUI handling, and SCIF expectations layer on for cleared facilities.
  • Schools. FERPA reach for K-12 districts and higher education. Virginia DOE guidance applies.

Default retention for VA commercial systems with no specific industry rule is 30 days. Federal-touching customers in Northern Virginia routinely set longer retention with explicit written retention policies in the SSP.

What Tec-Tel does to comply with Virginia regulations

Tec-Tel installs across Virginia for retail, manufacturing, healthcare, multi-tenant residential, financial, federal contractor, and licensed medical cannabis customers. The default install pattern for a VA commercial site:

  • Video-only on cameras unless audio is documented with one-party consent under Va. Code 19.2-62.
  • Posted surveillance notice at every public entrance.
  • No cameras in restrooms, locker rooms, dressing rooms, hotel guest rooms, or any space where privacy is reasonably expected.
  • VCDPA consent and notice language coordinated with the customer's privacy team for any biometric capture.
  • Retention configured to the regime that governs the industry (HIPAA, PCI, CCA, NDAA), with the facility's written retention policy attached.
  • NDAA Section 889-compliant vendor selection on any federal-touching install. No Hikvision, Dahua, Hytera, Huawei, ZTE, or covered OEM relabels.
  • Multi-vendor architecture so the customer is not locked into one camera or VMS line as state and federal rules evolve.

This is a buyer-facing reference, not legal advice. For a specific Virginia regulatory question, work with your privacy counsel.

Security service in Virginia

Tec-Tel deploys AI-era security across Virginia with one accountable project manager owning design, install, and service to one standard. The cities below have local service detail, deal sizing, and a free consultation. Don't see yours? We cover the whole state.

Or browse the full city directory and nationwide coverage map.