VA Amendment Requires Consent for Sexual Health Data

Want to receive these privacy recaps in your inbox each week? Subscribe here.

UNITED STATES

VA Amendment Requires Consent for Reproductive / Sexual Health Data

The Virginia Governor signed an amendment to the Virginia Consumer Protection Act making it unlawful, beginning July 1, 2025, to obtain, disclose, sell, or disseminate any personally identifiable reproductive or sexual health information in connection with a consumer transaction (including advertising) without the consent of the consumer.

“Reproductive or sexual health information” is broadly defined as “information relating to the past, present, or future reproductive or sexual health of an individual” and expressly includes (among other information) efforts to research or obtain reproductive or sexual health information services or supplies, location information that may indicate an attempt to acquire such services, reproductive or sexual health status, such as pregnancy, menstruation, or whether an individual is sexually active, use or purchase of contraceptives or birth control, and any of the foregoing that is inferred or obtained through algorithmic data. 

TAKEAWAY

This amendment is made to the Virginia Consumer Protection Act (VCPA), which is not a privacy law, rather than to the state’s existing comprehensive privacy law, the Virginia Consumer Data Protection Act (VCDPA). The significance of that distinction is that the VCPA contains a private right of action, and the VCDPA does not. This means that individual plaintiffs can sue companies for failing to obtain consent for the collection or dissemination of actual or inferred reproductive or sexual health information, but not for failing to obtain consent for any other type of sensitive information under the VCDPA. 

CPPA to Consider Removing “Behavioral Advertising” from ADMT Rules

The California Privacy Protection Agency released for discussion in its April 4 board meeting an updated draft of proposed regulations, as well as a slide deck outlining potential modifications to the proposed regulations for board discussion, including potential removal of “profiling a consumer for behavioral advertising” from the regulations entirely.

TAKEAWAY

If the CPPA decides not to remove “profiling a consumer for behavioral advertising” from the regulations, the activity would trigger requirements to conduct risk assessments, to provide a pre-use notice, and to extend opt out and access rights with respect to the activity.

This has resulted in significant criticism, largely due to the definition of “behavioral advertising”, which includes cross-context behavioral advertising (to which opt-out rights under the CCPA already apply) and also includes targeted advertising based on PI obtained from a consumer’s activity “within the business’s own distinctly-branded websites, applications or services” (i.e., a company’s use of its own first-party data to target advertising to its own consumers). This definition, if not removed, would therefore extend opt-out rights beyond “selling” and “sharing”  to internal, first-party behavioral advertising.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.