A recent Virginia resident went to visit Walmart.com and saw the image below with the consent text notification below as it was perceived they were purchasing and browsing for sensitive items. We provide a breakdown for privacy professionals and CPG online stores who would like guidance for their business.
Virginia law requires your consent to collect or use information about your potential or actual purchase of reproductive or sexual health products or services. By viewing, searching for, or buying these products or services on our site, or using related features such as Baby Registry, you consent to our use of this information to complete your purchase, provide the requested feature, and for gerenaly analytics, operations, and fraud prevention. If you do not consent, please avoid viewin, searching for, using, or purchasing these products, services, or features.
Understanding Virginia SB754: Walmart’s Privacy Notice and the Rising Stakes in Reproductive Health Data Compliance
Virginia’s Senate Bill 754 (SB754) marks a major development in state-level data privacy protections specifically targeting the collection, use, and sharing of consumer data related to reproductive and sexual health products. As of this writing, companies that collect this sensitive data from Virginia residents must obtain explicit consent before processing it. This legal requirement has prompted major retailers like Walmart to adopt compliance strategies, including visible consent notices targeted at visitors from Virginia.
What SB754 Requires and Why Walmart.com Has This Notice
Virginia SB754, formally titled the Consumer Data Protection Act Amendments – Reproductive Health Data Protection, builds upon the Commonwealth’s earlier privacy laws. It recognizes data related to the “purchase, inquiry, or use of reproductive or sexual health services” as sensitive personal data and mandates affirmative consent prior to its collection or use. The bill:
- Applies to controllers (businesses) that conduct business in Virginia or target products to Virginia residents.
- Requires clear, affirmative, and freely given consent before processing this data.
- Enforces limitations on data use and sharing without consumer authorization.
- Grants consumers rights to access, delete, and opt out of the sale or processing of such data.
Walmart’s Compliance Strategy: Proactive Geo-Targeted Consent
Walmart’s approach demonstrates a proactive response to the law. When a Virginia-based visitor lands on Walmart.com and interacts with reproductive or sexual health-related content (such as a baby registry or contraceptive products), they are met with a notice that reads the full text we posted above starting with:
“Virginia law requires your consent to collect or use information about your potential or actual purchase of reproductive or sexual health products or services…”
This banner, by explicitly informing users and conditioning site interaction on consent, fulfills the notice and consent requirements under SB754. From a legal perspective, this reduces liability and affirms that any data collected is lawfully obtained under state privacy guidelines.
Why This Matters For Walmart and Other Online Stores in Virginia: Risk of Noncompliance
Had Walmart failed to display this notice, several legal and operational risks could have arisen and as we’ve shown there have been massive lawsuits for ECPA violations with Almeida Law leading the way with privacy and HIPAA related class action lawsuits:
- Violation of Virginia law: Collecting sensitive data without consent could lead to state attorney general enforcement actions or consumer complaints.
- Litigation Exposure: While SB754 does not explicitly grant a private right of action, consumer lawsuits could be brought under broader consumer protection statutes or future expansions of the law.
- Reputational Harm: Mishandling sensitive reproductive health data could trigger public backlash—particularly in a post-Dobbs legal environment where health data carries political, ethical, and legal weight.
- Cross-jurisdictional liability: In the future, similar laws may be enacted in other states, increasing the risk of multistate enforcement if patterns of noncompliance emerge.
Is This Notice Legally Necessary?
The short answer: Yes—for SB754 compliance and risk mitigation purposes.
While some might argue that a general privacy policy would suffice, SB754 is explicit in requiring affirmative and specific consent for reproductive health data. The targeted nature of the Walmart banner is an example of best-in-class geo-aware privacy compliance, and it anticipates potential class actions or regulatory scrutiny from over collection or improper use of sensitive information. If you tie this in with our adaptive privacy notice then you are showcasing some of the highest levels of privacy compliance.
Furthermore, the inclusion of analytics, fraud prevention, and operational uses in Walmart’s consent language reflects a thorough understanding of the law’s secondary-use limitations. These uses are only legally permissible with user consent.
Implications for Other Businesses
Walmart’s response sets a strong precedent. Other e-commerce platforms, healthcare providers, and even adtech companies should consider:
- Auditing data collection practices related to reproductive health products and services.
- Deploying geofencing and state-specific banners for jurisdictions like Virginia and Washington (which passed similar legislation with the My Health My Data Act).
- Updating consent management platforms to reflect new categories of sensitive data under evolving state laws.
- Reviewing analytics and tracking tools that might inadvertently collect sensitive behavioral or transactional data.
Privacy Law is Getting Personal & Captain Compliance Can Help
Virginia’s SB754 signals a broader shift in American data privacy law toward contextual sensitivity recognizing that not all data is created equal. Reproductive health, in particular, now falls under enhanced protections in light of broader political and legal developments. Walmart’s notice reflects how seriously large enterprises are taking this shift and underscores the high stakes of failing to do so.
