Virginia Enacts Amendments to Consumer Protection Act

Virginia recently amended its Consumer Protection Act (the Act) to provide enhanced protection for reproductive and sexual health information. These protections take effect on July 1, 2025.

The amendment prohibits a business from “[o]btaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.” The definitions in this amendment are broad and the impact could be substantial, as the Act allows for a private right of action. Any business that collects or uses reproductive or sexual health information and/or information that can be derived from that information should carefully review the requirements of this amendment and work quickly to implement them.

Below we outline several notable amendments and features of the Act.  

• Broad Definition: The amended law defines “reproductive or sexual health information” broadly as “information relating to the past, present, or future reproductive or sexual health of an individual.” This definition includes:
  • Location information that may indicate an attempt to research or obtain reproductive or sexual health information services or supplies;
  • Information on sexual health status or conditions, related surgeries, or procedures including the termination of a pregnancy;
  • Purchase or use of contraceptives, birth control, or other medication related to menstruation or pregnancy; and
  • Information on bodily functions, vital signs, symptoms, and hormone levels.

Notably, the information categorized as “reproductive or sexual health information” in the Act includes information that can be derived from or is extrapolated from non-health related algorithmic data, such as purchase history.

• Consent: The amended law incorporates the same definition of consent as the Virginia Consumer Data Protection Act (VCDPA) which requires “a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. Consent may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.”
• Enforcement: In addition to enforcement by the Attorney General, the Act permits a private right of action.

***

Wiley’s Privacy, Cyber & Data Governance team assists a broad range of clients in building compliance plans for the growing number of comprehensive and data-specific state privacy laws. Please contact us if we can assist your business in assessing applicability or building out a compliance plan.