Virginia Enacts New Broad Consent Requirement for Collection of Reproductive and Sexual Health Information

On March 24, 2025, Virginia Gov. Glenn Youngkin signed into law SB 754, amending the state’s Consumer Protection Act to prohibit businesses from “[o]btaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.” The amendment, which takes effect on July 1, 2025, could have significant implications for companies that do business in Virginia due to its broad scope and definitions, affirmative consent requirement, and the fact that it is subject to a private right of action.

Broad scope and definitions

The amendment defines “reproductive or sexual health information” very broadly, encompassing any “information relating to the past, present, or future reproductive or sexual health of an individual.” This definition expressly includes, but is not limited to, information relating to the following, among other listed examples:

• “Efforts to research or obtain reproductive or sexual health information services or supplies, including location information that may indicate an attempt to acquire such services or supplies”
• “Reproductive or sexual health conditions, status, diseases, or diagnoses, including pregnancy, menstruation, ovulation, ability to conceive a pregnancy, whether an individual is sexually active, and whether an individual is engaging in unprotected sex”
• “Use or purchase of contraceptives, birth control, or other medication related to reproductive health, including abortifacients”

The breadth of “reproductive or sexual health information” means that it could encompass activities of many businesses that may not think of themselves as collecting such information. For example, it could include retailers’ collection of transaction records for consumers’ purchase of products, such as condoms or tampons. Similarly, the collection of precise geolocation by mobile applications (even ones whose purpose is unrelated to health) could fall under the definition if such location data “may indicate an attempt to acquire [reproductive or sexual health] services or supplies,” for instance by visiting a clinic or pharmacy.

Further expanding its potential scope, the amendment applies to any entity that is subject to the Virginia Consumer Protection Act. As a result, businesses may be subject to this new requirement even if they do not meet the (relatively high) data processing volume thresholds for applicability of Virginia’s general consumer privacy law, the Virginia Consumer Data Protection Act (VCDPA).

Affirmative consent

The amendment’s consent requirement utilizes the definition of “consent” from the VCDPA, meaning “a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.” This consent requirement means that businesses collecting these categories of data will likely have to implement new, appropriately designed consent flows, rather than relying on implied consent or disclosures buried in a privacy policy or terms of service. However, unlike other consumer health data privacy laws, such as those of Washington state and Nevada, the new Virginia requirement does not expressly mandate that businesses provide a dedicated health data privacy notice that is separate from the business’s regular privacy policy.

Private right of action

In addition to enforcement by the Virginia attorney general, the new requirement is subject to a private right of action. It remains to be seen how attractive the new requirement will be as a basis for demand letters and lawsuits by plaintiffs’ firms. However, the existence of a private right of action undoubtedly increases businesses’ potential risks. This, together with the short timeline until the new requirement comes into force on July 1, 2025, makes it especially important for businesses to start assessing their potential exposure and compliance strategy.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.