New Va. law protecting reproductive health data prompts Walmart’s online data collection pop-ups

Disclosure pop-ups about the “cookies,” or other aggregate bits of data websites collect and store aren’t an uncommon experience while shopping online. What’s less common: when a pop-up indicates that your potential purchase of condoms, birth control medication or menstrual hygiene products is being noted digitally, a message Virginians have started seeing when they shop virtually for such products. 

Since July 1, a new state law outlines that people’s personally identifiable reproductive or sexual health information cannot be obtained, disclosed, disseminated or sold without consumer consent. As new laws took effect in Virginia on July 1, Walmart has begun alerting customers about certain product or service searches and purchases.

“By viewing, searching for, or buying these products or services on our site, or using related features such as the Baby Registry, you consent to our use of this information to complete your purchase, provide the requested feature, and for general analytics, operations and fraud prevention,” a pop-up disclaimer now notifies people who visit Walmart’s website from within Virginia. 

If consumers don’t want their data connected to their sexual or reproductive health to be stored, the disclaimer suggests they “avoid viewing, searching for, using or purchasing these products, services, or features.”

But not all pop-ups are new or specifically focused on reproductive-related information. Other retailers like CVS have more broad disclaimers about data collection. Its site explains that information collected about consumer behaviors is used “to provide our products and services recommendations, understand how you engage with our site, and improve the services we offer you.”

It also warns that it may share data with “trusted third parties” that include marketing, analytics and research “partners.” 

This sort of data collection is a common practice in e-commerce and is a catalyst for targeted advertisements that people experience elsewhere on the internet, like their social media feeds or when using search engines. 

As the national reproductive health legal landscape shifts, including contraception and abortion access, some state and federal lawmakers have pressed for strengthened consumer protection laws surrounding reproductive health data. 

Virginia Senate Majority Leader Scott Surovell, D-Fairfax and Sen. Barbara Favola, D-Arlington, have introduced and supported legislation to shore up these protections.

Surovell said the U.S. Congress’ “My Body, My Data Act,” a measure to protect menstrual health data introduced by Democratic lawmakers, inspired him to bring a similar effort to Virginia.  

“I don’t think a lot of people realize the information that private industry buys and sells about them,” he said in a recent call. 

He then worried about how law enforcement and government officials could use consumer data in the private sector. 

“I was concerned that attorneys generals in some other states who want to be more aggressive about prosecuting women or other people for helping women cross state lines to obtain either contraception or abortion services might use information that the private sector has in order to reverse engineer women and other people to prosecute,” Surovell said. 

Surrovell and Favola also worked on bills to prevent menstrual data from being subject to search warrants, which Gov. Glenn Youngkin signed into law.  Last year, Youngkin was lambasted by many, including former President Joe Biden and talk show host Stephen Colbert, for opposing the same bill in a previous legislative session. 

“It should go without saying that when a woman has her period or visits a doctor, it is nobody’s business but her own,” Favola said earlier this year. 

As more pregnant people travel to get abortions outside states where the medical procedure is banned or restricted, some states — including Alabama and Texas — have threatened legal repercussions for people who leave the state for an abortion, and for those who aid them.  

This year Favola’s Senate Bill 754 passed the Democrat-controlled legislature and Youngkin signed it. The law protects reproductive health data, often collected in period tracking digital apps, and allows consumers to sue if their data is sold or released without their consent. 

Walmart’s interpretation of the law prompted the pop-up disclaimer, and other companies will find their own way to follow suit.

“The companies are trying to figure out how to implement the bill,” Favola said in a text message. 

Next, Favola wants to explore how to further refine the bill to ensure people’s identifiable information is protected. 

“I made it clear that the law is focused on individually-identifiable data — not aggregate data,” she explained. “I expect to make some revisions next session.” 

Further details will be discussed in a workgroup later this summer, she said. 

This article first appeared on Virginia Mercury and is republished here with permission. Virginia Mercury is part of States Newsroom, a network of news bureaus supported by grants and a coalition of donors as a 501c(3) public charity. Virginia Mercury maintains editorial independence.