Virginia expands privacy protections for reproductive and sexual health data

In 2024 and 2025, Virginia enacted new protections limiting how menstrual, reproductive, and sexual health data can be accessed or used. SB 16 (2024) bars law enforcement from obtaining menstrual health data through warrants or subpoenas, while SB 754 (2025) requires companies to get consent before collecting or sharing reproductive or sexual health information.

The provisions aim to safeguard Virginians — including people traveling from states with abortion bans — from digital surveillance that could expose their personal health decisions. As the laws roll out, state regulators, healthcare providers, and tech companies are still determining how to comply, raising questions about how these protections will function in practice.

Why it Matters

As abortion bans reshaped the South, digital data became an unexpected risk for patients. Search histories, cellphone location records, online pharmacy queries, and even entries in period-tracking apps have been used in past investigations in other states. For people seeking abortion care, particularly those traveling long distances, these data trails can carry legal consequences.

Virginia’s new laws represent an effort to draw a clear line: health decisions — including menstrual cycles, pregnancy status, and reproductive care — should not be accessible to police or sold to third parties. Through these efforts, Virginia has tried to close some of the gaps in HIPAA and state health records laws as they relate to app companies and data brokers.

Background

In 2024, Virginia lawmakers added language to the state’s criminal procedure code prohibiting courts from obtaining “menstrual health data,” including information stored in period-tracking apps or on personal devices. Supporters argued the measure was needed to prevent menstrual data from being used in abortion-related investigations as bans spread across other states.

In 2025, Virginia went further. Lawmakers passed SB 754, which amends the Virginia Consumer Protection Act (VCPA) to regulate “reproductive or sexual health information” collected in consumer transactions. The law broadly defines this information to include data about pregnancy, menstruation, sexual activity, reproductive health conditions, efforts to obtain care, location information that may indicate a visit to a clinic, and even data inferred from online behavior. Companies covered by the VCPA must get consent before obtaining, disclosing, selling, or disseminating this kind of information.

All of these efforts signal bipartisan recognition that reproductive data should remain private — even though broader reproductive rights remain politically contested.

Still, implementation challenges remain. Privacy experts note that companies vary in how they categorize or store reproductive health data, and that enforcement authority is spread across multiple agencies.

Resources

American Bar Association - New Reproductive and Sexual Health Privacy Law: Surprisingly Broad Applicability and Operationally Challenging
Associated Press - Gov. Youngkin signs a measure backed by abortion-rights groups but vetoes others
Orrick, Herrington & Sutcliffe LLP - Virginia Enacts Amendment to Protect Reproductive and Sexual Health Privacy