On March 24, 2025, the governor of Virginia signed into law Senate Bill 754, which amends the Virginia Consumer Protection Act (VCPA) to restrict the collection, use, sale, or sharing of personally identifiable reproductive or sexual health information.
The law has a broad definition of “reproductive or sexual health information” and will impact many companies operating in health- or wellness-related industries. Violations of the law will be enforceable under the VCPA’s private right of action, in addition to being enforceable by the state’s attorney general, so companies should act quickly to ensure compliance before the law becomes effective on July 1, 2025.
In Depth
Data in Scope
As amended, the VCPA now prohibits “obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.” “Reproductive or sexual health information” is defined as information relating to the past, present, or future reproductive or sexual health of an individual, and includes:
- Reproductive or sexual health conditions or status (including pregnancy, menstruation, and whether an individual is sexually active) and symptoms relating to such conditions or status
- Efforts to obtain reproductive or sexual health information services, including location information that may indicate such efforts
- Information about treatment or medication relating to reproductive or sexual health conditions, including contraceptives and birth control
- Information that is derived or extrapolated from non-health-related information, which mirrors consumer health privacy laws such as the Washington My Health My Data Act and brings in scope information that might not commonly be considered health information
The definition excludes data subject to the federal Health Insurance Portability and Accountability Act, health records under Virginia Code Title 32.1, and records related to substance use disorders that are protected under 42 U.S.C. § 290dd-2.
Consent Standard
The law borrows the definition of “consent” from the Virginia Consumer Data Protection Act, meaning that consent must be specific, informed, and affirmative (i.e., opt in). Pre-checked boxes, implied consent, browsewrap agreements, and bundled consent will not be sufficient.
Enforcement
Violations of the VCPA are enforceable by Virginia’s attorney general and through a private right of action. The private right of action is available to individuals who suffer loss as a result of a violation and carries statutory damages of $500 for general violations and $1,000 for willful violations.
Impact
Based on the broad definition of “reproductive or sexual health information,” the law may impact a wide range of companies that provide health and wellness products. For example, information regarding sexual health and menstruation could include diagnoses and treatments for polycystic ovarian syndrome or a patient’s over-the-counter purchase of pain relief for menstrual cramps. Certain gender-affirming care procedures also inarguably have at least a temporary effect on a patient’s fertility and, therefore, pertain to that patient’s reproductive health. Healthcare companies and providers may wish to revise their patient consent forms for any disclosures related directly or indirectly to reproductive or sexual health information – at least until clarifying regulatory or subregulatory guidance is issued. However, that same consent may be impracticable for application developers and wellness products.
Companies will need to pay particular attention to their use of online tracking technologies, such as cookies, pixels, and software development kits. These technologies may collect information subject to the law, such as website history data for patients seeking OB/GYN or abortion provider services. With the plaintiff’s bar already trained on tracking technologies, this law will likely generate even more cookie-related litigation.
WHAT COMES NEXT?
Companies operating in Virginia should assess their data practices and consent management procedures to ensure compliance and avoid the risk of private litigation or regulatory enforcement.
[View source.]
