Virginia Enacts Amendment to Protect Reproductive and Sexual Health Privacy

Virginia recently enacted an amendment to its state Consumer Protection Act to regulate the processing of Virginia consumers’ reproductive and sexual health information. Specifically, SB 754 prohibits businesses from obtaining, disclosing, selling or disseminating personally identifiable reproductive or sexual health information of Virginia consumers without their consent.

SB 754 takes effect in July 2025, is broad in scope, and is enforceable through a private right of action. Accordingly, businesses should assess the law’s applicability and take necessary steps to mitigate risk.

Here are six key things you need to know about SB 754:

1. What is amended, and who is regulated?
   
   

   While SB 754 regulates the processing of health information, it does not amend the state’s comprehensive privacy law, the VCDPA. Instead, SB 754 amends Virginia’s Consumer Protection Act. This distinction is consequential, in part, because the Consumer Protection Act applies far more broadly and has a greater impact on smaller businesses, which the VCDPA’s relatively high thresholds for applicability often exclude.

   Specifically, the law applies to “suppliers”—sellers, lessors, licensors or professionals who advertise, solicit or engage in consumer transactions, and manufacturers, distributors or licensors who advertise and sell, lease or license goods or services to be resold, leased or sublicensed by other persons in consumer transactions.
   
   

2. What data is covered?
   
   

   SB 754 applies to “reproductive or sexual health information,” which is defined expansively as information relating to the past, present or future reproductive or sexual health of an individual. The definition encompasses the categories of data below, including data that is derived or extrapolated from non-health-related information, such as proxy, derivative, inferred, emergent or algorithmic data:

   • efforts to research or obtain reproductive or sexual health information services or supplies, including location information that may indicate an attempt to acquire such services or supplies;
   • reproductive or sexual health conditions, status, diseases or diagnoses, including pregnancy, menstruation, ovulation, ability to conceive a pregnancy, whether an individual is sexually active and whether an individual is engaging in unprotected sex;
   • reproductive and sexual health-related surgeries and procedures, including termination of a pregnancy;
   • use or purchase of contraceptives, birth control or other medication related to reproductive health, including abortifacients;
   • bodily functions, vital signs, measurements, or symptoms related to menstruation or pregnancy, including basal temperature, cramps, bodily discharge or hormone levels; and
   • any information about diagnoses or diagnostic testing, treatment, medications or the use of any product or service relating to the above information.

   Notably, the law does not apply to information protected under the Health Insurance Portability and Accountability Act (HIPAA), Virginia state health records privacy laws or substance use disorder patient records from federally assisted Part 2 programs. This exception, however, applies only at the data level—it does not exempt entities subject to HIPAA.
   
   

3. What are the obligations?
   
   

   The amendment prohibits suppliers from obtaining, disclosing, selling or disseminating any personally identifiable reproductive or sexual health information relating to a Virginia consumer in connection with a consumer transaction without the consumer’s consent. This requirement extends even where a consumer has requested a product or service from a supplier.

   Under SB 754, consent must be a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. This is the same standard set forth under Virginia’s comprehensive privacy law.
   
   

4. How is SB 754 enforced?
   
   

   Unlike Virginia’s comprehensive privacy law, the Virginia Consumer Protection Act has a private right of action. It allows any person who suffers loss because of a violation of the Act to initiate legal proceedings to recover the greater of actual damages or $500. Where the violation is found to be willful, damages may increase to the greater of three times actual damages or $1,000.

   In addition, the state attorney general—or the attorney for any Virginia county, city or town —may issue an order to investigate potential violations of the law. These regulators may seek civil penalties of up to $2,500 per violation. Subsequent violations may carry penalties of up to $5,000 per violation.
   
   

5. When does SB 754 come into effect?
   
   

   SB 754 will take effect on July 1, 2025.
   
   

6. What should companies do now?
   
   
   • Determine whether they are within the scope of the law. The scope of the Virginia Consumer Protection Act is broad. Therefore, companies should determine whether the Act applies to their data collection and processing activities.
   • Identify whether they collect any “reproductive or sexual health information.” Businesses should inventory the data they collect to determine whether any information from Virginia residents may fall under the broad definition of reproductive or sexual health information, particularly if it is derived from non‑health-related data.
   • Be ready to build or adjust compliance programs. Companies subject to the amended law should be prepared to implement or refine notice and consent mechanisms before processing any regulated information after the law takes effect.

We are committed to helping our clients determine their obligations, defend their practices, and update their compliance programs to address consumer health data laws. If you face an enforcement action or lawsuit under these laws—or if you would like advice on how to avoid them—please contact one of the authors (Thora Johnson, Alyssa Wolfington, Michaela Frai, Peter Graham) or another member of the Orrick team.