covers all “persons” that conduct business in Virginia or produce products or services that are targeted to Virginia residents and process personal data of 1) at least 100,000 Virginia residents or 2) derive over half of its gross revenue from the sale of personal data of at least 25,000 Virginia residents