Virginia's Reproductive Health Information Rule: SB 754 and Subdivision A 85 of the Consumer Protection Act

Where the Provision Sits in the Virginia Consumer Protection Act

The Virginia Consumer Protection Act is chapter 17 of title 59.1. Its core is section 59.1-200(A), a numbered list of "fraudulent acts or practices committed by a supplier in connection with a consumer transaction" that the section declares unlawful. The list runs from misrepresenting goods as those of another to dozens of practices the General Assembly has added over the years, including unlicensed mold remediation and food labels that do not meet FDA rules. Subdivision 85 of that list reads:

"Obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer. This subdivision shall not apply to nonpublic personal information subject to the provisions of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.)."

The provision came from SB 754 of the 2025 session, not from a 2024 bill. The Legislative Information System records show it was prefiled on December 5, 2024, passed the Senate 21 to 17 on January 24, 2025 and the House 52 to 43 on February 14, and was approved by the Governor on March 24, 2025 as chapter 591 of the 2025 Acts of Assembly, effective July 1, 2025. The enacted text added the practice as subdivision 83 or 84, depending on which of the two versions of section 59.1-200 then in force is read. Later enactments that added other subdivisions have since moved it to 85, which is where it appears in each of the section's four currently published versions, the last effective July 1, 2027.

Two definitions in section 59.1-198 decide who the subdivision binds and when. A "supplier" is a seller, lessor, licensor or professional that advertises, solicits or engages in consumer transactions, or a manufacturer, distributor or licensor that sells goods or services for resale in consumer transactions. A "consumer transaction" includes the advertisement, sale, lease, license or offering of goods or services "to be used primarily for personal, family, or household purposes." The subdivision therefore applies where a supplier's handling of the information occurs in connection with a transaction of that kind.

Reproductive or Sexual Health Information Defined

Chapter 591 added a definition of "reproductive or sexual health information" to section 59.1-198: "information relating to the past, present, or future reproductive or sexual health of an individual," including seven listed categories:

• Efforts to research or obtain reproductive or sexual health information services or supplies, "including location information that may indicate an attempt to acquire such services or supplies"
• Reproductive or sexual health conditions, status, diseases or diagnoses, including pregnancy, menstruation, ovulation, ability to conceive, whether an individual is sexually active, and whether an individual is engaging in unprotected sex
• Reproductive and sexual health-related surgeries and procedures, including termination of a pregnancy
• Use or purchase of contraceptives, birth control or other medication related to reproductive health, including abortifacients
• Bodily functions, vital signs, measurements or symptoms related to menstruation or pregnancy, including basal temperature, cramps, bodily discharge or hormone levels
• Information about diagnoses, diagnostic testing, treatment or medications, or the use of any product or service, relating to the five categories above
• Information in any of those categories "derived or extrapolated from non-health-related information such as proxy, derivative, inferred, emergent, or algorithmic data"

The first and last items carry the definition beyond medical records. Location data showing a visit to a clinic, and an inference about pregnancy drawn from purchase history, are each within the text by name. The definition ends with three exclusions: health information protected under HIPAA, "health records for the purposes of Title 32.1," and patient-identifying records for purposes of 42 U.S.C. § 290dd-2, the federal confidentiality provision for substance use disorder treatment records.

The Consent Requirement

Chapter 591 also added a definition of "consent" to section 59.1-198, by cross-reference: it "means the same as that term is defined in § 59.1-575," the definitions section of the Consumer Data Protection Act. Section 59.1-575 defines consent as "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer," which may include a written statement, including one made electronically, "or any other unambiguous affirmative action."

Three features of subdivision 85 shape how the consent rule operates. It covers four distinct acts, obtaining, disclosing, selling and disseminating, so collection without consent is within it as well as transfer. It reaches only information that is "personally identifiable," a term chapter 17 does not define. And the subdivision does not state when consent must be obtained or whether separate consent is needed for each act; the text requires only that the act not occur "without the consent of the consumer."

The Gramm-Leach-Bliley sentence is not in the enacted 2025 text. Chapter 591, as approved, ended the subdivision after the words "without the consent of the consumer." The exclusion for nonpublic personal information subject to the federal Gramm-Leach-Bliley Act appears in the section as currently codified, so it was added by a later amendment. The section's history note lists chapters from the 2026 session, and the specific chapter that added the sentence could not be identified from the sources retrieved for this article.

The Private Right of Action

Placing the rule in section 59.1-200 attaches the Consumer Protection Act's remedies to it. Under section 59.1-204(A), "[a]ny person who suffers loss as the result of a violation of this chapter" may recover actual damages or $500, whichever is greater. If the trier of fact finds the violation willful, it may increase damages to three times actual damages or $1,000, whichever is greater. Subsection (B) allows an award of reasonable attorneys' fees and court costs in addition to damages.

The section also contains a cure-offer mechanism. A supplier may deliver a written cure offer before filing its initial responsive pleading; if it does, the offer is admissible at trial, and the supplier is not liable for fees and costs incurred after delivery unless the damages awarded exceed the offer's value. Section 59.1-198 defines a cure offer as including a minimum additional amount of 10 percent of the offer or $500, whichever is greater, capped at $4,000. A person who accepts a cure offer may not bring another action substantially based on the same facts under any other statute or common law theory.

Public enforcement runs alongside. Section 59.1-203 authorizes the Attorney General, any attorney for the Commonwealth, and the attorney for any city, county or town to seek an injunction, without proof of damages, generally after written notice and an opportunity to show no violation occurred or to execute an assurance of voluntary compliance. Under section 59.1-206, a court finding a willful violation of section 59.1-200 may impose a civil penalty of up to $2,500 per violation, rising to $5,000 per violation for willfully breaching an assurance or injunction, plus investigative expenses of up to $1,000 per violation and attorney's fees.

How It Relates to the VCDPA's Sensitive Data Rules

The Consumer Data Protection Act already restricts some of the same information. Its definition of sensitive data in section 59.1-575 includes personal data revealing a "mental or physical health diagnosis" or "sexual orientation," and section 59.1-578(A)(5) bars processing sensitive data without the consumer's consent. The two statutes differ in scope and enforcement:

• Applicability: the VCDPA applies only to persons that control or process data of at least 100,000 Virginia consumers, or 25,000 with more than half of gross revenue from selling personal data, under § 59.1-576(A); subdivision 85 has no numerical threshold
• Entity exemptions: § 59.1-576(B) excludes nonprofit organizations, institutions of higher education, HIPAA covered entities and business associates, and financial institutions subject to Gramm-Leach-Bliley; the VCPA's own exclusions in § 59.1-199 are different and are described below
• Subject matter: the VCDPA category is a health "diagnosis"; the VCPA definition adds research efforts, location, purchases of contraceptives, bodily measurements and inferences
• Enforcement: § 59.1-584 gives the Attorney General exclusive VCDPA enforcement with a 30-day cure and states the chapter provides no basis for a private right of action; § 59.1-204 gives a damages action to any person who suffers loss from a VCPA violation

The link between the two is the borrowed definition of consent. Subdivision 85 uses the VCDPA's standard for what counts as consent while leaving the VCDPA's thresholds, exemptions and enforcement scheme behind.

What It Does Not Reach

The limits come from four places in the text. The definition itself excludes HIPAA-protected health information, health records for purposes of Title 32.1 and federally protected substance use disorder treatment records. The current text of subdivision 85 excludes nonpublic personal information subject to the Gramm-Leach-Bliley Act. The requirement of a supplier acting in connection with a consumer transaction confines the subdivision to transactions for goods or services used primarily for personal, family or household purposes. And the words "personally identifiable" leave out information that does not meet that description.

The Act's general exclusions in section 59.1-199 also apply. Among them, the chapter does not apply to any aspect of a consumer transaction authorized under the laws or regulations of the Commonwealth or the United States, or to "[b]anks, savings institutions, credit unions, small loan companies, public service corporations, mortgage lenders as defined in § 6.2-1600, broker-dealers as defined in § 13.1-501, gas suppliers as defined in subsection E of § 56-235.8, and insurance companies regulated and supervised by the State Corporation Commission or a comparable federal regulating body." Those entity exclusions apply to subdivision 85 in the same way they apply to every other practice listed in section 59.1-200.

Frequently Asked Questions