First-order effects

• Companies operating in Virginia now face a January 2023 deadline to build consumer rights infrastructure — access, deletion, opt-outs — separate from what they already built for California, effectively doubling compliance work for multi-state operators.
• Online stores and other data-heavy businesses flagged in the earlier Wall Street Journal reporting get their first confirmation that state-level privacy law is arriving whether or not Congress acts.

Second-order effects

• Other statehouses take the two-state precedent as proof of concept: within three years Maryland passes paired bills restricting data collection and protecting minors' social media safety, and Washington goes further still with consumer health-data safeguards covering location records that could reveal clinic visits.
• A patchwork of state regimes shifts bargaining power toward compliance vendors and legal teams, while smaller retailers face proportionally higher costs than the large platforms that lobbied on these bills.

Third-order effects

• If the sequence holds — California, then Virginia, then Maryland and Washington — comprehensive data protection becomes de facto national policy written state by state, with each new law ratcheting scope from general consumer data toward sensitive categories like health and children's information, a trajectory visible by 2026 when Virginia itself layers social media limits for minors on top of its privacy baseline.