Law / United States / 
Virginia
SB 754 (2025), reproductive or sexual health information as a prohibited practice under the Consumer Protection Act
Va. Code Ann. 59.1-200(A)(85) (2025 Va. Acts ch. 591)
In force since .
A sensitive categories rule binding private bodies.
As of .
What it requires
- If you are a supplier dealing with Virginia consumers, do not obtain, disclose, sell, or disseminate a consumer's personally identifiable reproductive or sexual health information without the consumer's consent, including location information that may indicate an attempt to obtain reproductive or sexual health services or supplies.
- Obtain the consumer's consent before obtaining, disclosing, selling, or disseminating reproductive or sexual health information that you derive or extrapolate from non-health data by proxy, inference, or algorithm.
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What this law does
The Virginia Consumer Protection Act declares unlawful the listed fraudulent acts or practices committed by a supplier in connection with a consumer transaction. One listed practice is obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.
Reproductive or sexual health information includes efforts to research or obtain related services or supplies, including location information that may indicate an attempt to acquire them. It also includes information derived or extrapolated from non-health data by proxy, inference, or algorithm. The prohibition does not apply to nonpublic personal information subject to the Gramm-Leach-Bliley Act. The definition leaves out health information protected by Health Insurance Portability and Accountability Act (HIPAA). SB 754 was approved , as Chapter 591 of the 2025 Acts of Assembly, effective .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or tracks devices.