Va. Senator Expects Changes to Reproductive Health Data Privacy Law
Virginia’s reproductive health data privacy law could be amended next year in response to concerns from retailers, state Sen. Barbara Favola (D) said in an email to Privacy Daily Wednesday. “I expect to be making some changes to my data privacy law during the 2026 session.”
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Gov. Glenn Youngkin (R) unexpectedly signed the Democratic bill (SB-754) into law in March. It contains a private right of action and updates the Virginia Consumer Protection Act (VCPA) to prohibit obtaining, disclosing, selling or disseminating personally identifiable reproductive or sexual health information without a consumer’s consent.
Some raised compliance concerns with the Virginia law before it took effect July 1 (see 2504110039). By requiring opt-in consent and for other reasons, some observers say the Virginia bill goes further than Washington state’s My Health My Data Act.
“Retailers are seeking clarification on whether a purchase constitutes the collection of data under the intent of the bill,” Favola said in the email. She stressed that her “interest and the intent of the law is to protect personally identifiable data when an individual purchases reproductive or sexual health products AND to protect such data from being sold.”
The senator said she has met with “big box retailers” about the concerns but declined to specify which stores. “I expect conversations to continue.”
Troutman Pepper privacy attorneys warned about the law’s applicability in a July 10 blog post: “Given the broad definitions" in the Virginia law, it “likely regulates organizations that are not traditional health care companies, and goes beyond traditional health information.”
Retailers are among those that could be swept in, Troutman Pepper said in a June 25 blog post. “Data concerning purchases that enable a retailer to derive or extrapolate [reproductive and sexual health information] from non-health-related information (such as proxy, derivative, inferred, emergent, or algorithmic data) are within the scope of the Act.”