Does a Shopify store handle a Virginia or Colorado deletion request like California's?

Do the Virginia and Colorado laws apply to your store?

Both statutes test you before they bind you, and neither test is California's. Each state pairs a volume limb — how many of that state's consumers had personal data you controlled or processed in a calendar year — with a lower limb that turns on revenue from selling personal data, or, in Colorado, a discount taken instead.

Either limb on its own is enough. The count is per state, not your order count: distinct Virginia consumers, then distinct Colorado consumers. The second limb differs by state. Colorado adds a route the counts do not describe: any amount of biometric identifiers or biometric data you control or process puts you inside the act, and your duties then run only to that biometric data. A store that clears neither limb — and, for Colorado, holds no biometric data at all — is outside the deletion rules that follow: the deadlines below are not yet yours, and your admin's erasure button still answers the customer.

Code of Virginia § 59.1-576; C.R.S. § 6-1-1304 in the version effective October 1, 2025; California Attorney General, CCPA. Read September 6, 2026.

California adds a trigger the columns above cannot hold — gross annual revenue, with no consumer count in it at all — so size alone can bring a store inside the California law: which businesses California's law covers.

How long do you have to answer, and can you extend it?

The clock carries over; what has to happen inside it does not. Both states give a controller 45 days from receipt of the request, and both allow one further 45 days where the complexity and number of the requests make it reasonably necessary — the same 45 plus 45 California runs.

Neither state gives you the extra days silently: Virginia allows them only if you inform the consumer of the extension within the initial 45-day response period, together with the reason for it; Colorado requires the same notice inside the same 45 days.

A refusal sits inside the same window: decline to act, and both statutes still require you to give the reasons and the appeal instructions within those 45 days.

What happens if you refuse a Virginia or Colorado request?

The first fork is whether you can tell who is asking. Both statutes let a controller decline to act on a request it cannot authenticate using commercially reasonable efforts, and let it ask instead for the additional information reasonably necessary to authenticate the request.

That appeal is a second process on its own clock — Virginia gives you 60 days from receipt of the appeal and no extension, Colorado 45 days extendable by 60 more where reasonably necessary. Both states want that answer in writing.

What has to follow the appeal decision differs by state. Colorado requires you to tell the consumer they can contact the attorney general if they have concerns about the result, whatever that result is; Virginia ties the duty to a denial, and spells out the form it takes:

No California page we read — the Attorney General's CCPA page and the privacy agency's FAQ, read on September 6, 2026 — describes an internal appeal a consumer files with the business; the remedy both name is a complaint to the regulator.

What changes in your Shopify admin?

The button does not change; the ledger beside it does. Shopify states the duty without naming a state — you are "responsible for complying with the privacy and data protection laws and regulations that apply to your business" — and its erasure route removes personal data such as a customer's name and address, while what was sold and the date of the sale stay visible. What that button actually removes is set out next door.

What the admin does not do is count. Virginia gives each consumer two free responses a year, then allows a reasonable fee for requests that are manifestly unfounded, excessive or repetitive; Colorado makes the first free and lets you charge for a second or subsequent request within twelve months, at an amount calculated the way § 24-72-205(5)(a) specifies. That tally is your record to keep.

The right itself is drawn differently, which changes what you search rather than what you press: Virginia's covers personal data provided by or obtained about the consumer, Colorado's personal data concerning the consumer.