On March 24, Virginia Governor Glenn Youngkin signed into law SB 754 (Act), which amends the Virginia Consumer Protection Act (VCPA) to prohibit entities from collecting, disclosing, selling, or disseminating reproductive or sexual health information without consent. The Act will take effect on July 1, 2025.
Applicability
The VCPA applies to all “suppliers,” defined as “any seller, lessor, licensor, or professional that advertises, solicits, or engages in consumer transactions, or a manufacturer, distributor, or licensor that advertises and sells, leases, or licenses goods or services to be resold, leased, or sublicensed by other persons in consumer transactions.” Unlike Virginia’s comprehensive privacy law, the Virginia Consumer Data Privacy Act (VCDPA), there is no revenue or data processing threshold for entities to be subject to the terms of the VCPA. This was likely a strategic move by Virginia legislatures to ensure a broader reach of protection for Virginia consumers.
Definition of Reproductive or Sexual Health Information
The Act makes it unlawful to obtain, disclose, sell, or disseminate personally identifiable “reproductive or sexual health information” without consent. “Reproductive or sexual health information” is defined broadly as any “information relating to the past, present, or future reproductive or sexual health of an individual,” and expressly includes surgeries and procedures (including termination of pregnancy); efforts to research or obtain relevant services or supplies; reproductive or sexual health conditions, diseases, or diagnoses; the use or purchase of contraceptives; and vital signs or symptoms related to menstruation or pregnancy; as well as any information in the foregoing categories that are derived or extrapolated from non-health-related information such as proxy, derivative, inferred, emergent, or algorithmic data. There are data-level exemptions, however, for personal health information (PHI) under HIPAA, health records for Title 32.1, or patient-identifying records for 42 U.S.C. § 290dd-2.
Consent Requirements
The Act incorporates the VCDPA’s definition of “consent,” which is defined as a “clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.”
Enforcement
Violations of the VCPA are enforceable by the Virginia Attorney General; the attorney for the Commonwealth of Virginia; or any attorney for a Virginia county, city, or town. Willful violations of the VCPA may result in penalties of up to $2,500 per violation. In addition to government enforcement, and unlike the VCDPA, the VCPA includes a private right of action. Any person who suffers loss because of a violation of the Act can seek legal recovery of the greater of actual damages or $500. If the violation is found to be willful, damages can be increased to the greater of three times actual damages or $1,000.
Our team will continue to monitor the implementation and enforcement of the Act. If you have any questions about the Act and how it could affect your business, please contact the authors. For a more in-depth overview of the VCDPA, please see our alert here.
