In March 2024, Virginia Governor Glenn Youngkin signed Senate Bill 754 (SB 754), introducing a new privacy regulation affecting a broad array of businesses beyond traditional healthcare sectors. The legislation amends the Virginia Consumer Protection Act to impose strict obligations on suppliers who obtain or share "reproductive or sexual health information" in connection with consumer transactions. The law is set to take effect from July 1, 2025, with enforcement mechanisms including state action and a private right of action.
SB 754's scope is notably broad, defining "reproductive or sexual health information" expansively. This encompasses data relating to an individual's past, present, or future reproductive or sexual health and includes specific categories such as efforts to obtain reproductive or sexual health services or supplies, reproductive health conditions (like pregnancy, menstruation, ovulation, and sexual activity status), related surgeries and procedures (including pregnancy termination), use or purchase of contraceptives and abortifacients, bodily functions and symptoms related to menstruation or pregnancy, and any derived or algorithmic data extrapolated from non-health information.
The legislation reaches beyond healthcare providers and medical products to cover commercial transaction data, such as the purchase of contraceptives, menstrual products, and over-the-counter pain relief medications. It also includes geolocation data that could indicate attempts to access reproductive health services, such as visiting reproductive health clinics or locations associated with these products, as well as browsing behaviour and marketing data. Employee-related data connected to wellness initiatives and fertility treatments may also fall under the law’s ambit.
Under SB 754, suppliers—defined broadly to include sellers, lessors, licensors, manufacturers, and distributors involved in consumer transactions primarily for personal, family, or household use—are required to obtain explicit opt-in consent before collecting, disclosing, selling, or disseminating personally identifiable reproductive or sexual health information. This requirement applies even when such data processing is necessary for delivering the requested product or service. The standard for consent mirrors that of the Virginia Consumer Data Protection Act (VCDPA) enacted in 2021, demanding a clear, affirmative, specific, informed, and unambiguous opt-in.
Notably, the legislation does not clarify what constitutes "personally identifiable" information, leaving companies without a definitive standard for de-identification to avoid compliance. Moreover, except for exemptions pertaining to data protected under HIPAA, the confidentiality rules under 42 CFR Part 2 for substance use disorders, and Virginia’s health records privacy law, SB 754 imposes obligations without entity-level or threshold exemptions. This means non-healthcare businesses and non-resident companies conducting consumer transactions in Virginia may fall within the new regulatory framework.
The law contemplates substantial enforcement provisions. Individuals who suffer losses due to violations can seek actual damages, with willful breaches subject to treble damages, alongside reasonable attorneys’ fees and court costs. The Virginia Attorney General’s Office is empowered to pursue injunctions and civil penalties against violators.
Meghan O’Connor of Quarles, writing in Corporate Compliance Insights, highlighted that the law "will require significant technical and operational compliance steps for companies doing business in Virginia," pointing out the challenges companies face in implementing the necessary opt-in consent processes across diverse types of transactions.
With just over a year until the law takes effect, businesses involved in retail, marketing, data analytics, and even employment-related wellness programs must urgently assess the impact of SB 754 to prepare for compliance by the July 2025 enforcement deadline.
Source: Noah Wire Services