Virginia Period Tracker Privacy Laws (2026)

Virginia has strong reproductive privacy protections. But period tracker data still has gaps. Full 2026 legal breakdown.

Abortion is legal in Virginia without a gestational limit beyond viability. Period tracker data faces low subpoena risk, supported by the Virginia Consumer Data Protection Act.

This page is educational, not legal advice. Laws and enforcement practices can change. Verify current rules with official state sources or a qualified attorney before relying on this information.

Abortion Law Status in Virginia

Abortion is legal in Virginia without a gestational age limit beyond viability. Virginia law allows abortion prior to viability without restriction. Post-viability abortions are permitted when a physician determines they are necessary for the health or life of the mother. Virginia has become an important access state for patients from neighboring North Carolina, West Virginia, and Tennessee, where abortion is more restricted or banned.

Period Tracker Data Risk in Virginia

Period tracker data in Virginia faces low subpoena risk. Abortion is legal. State prosecutors are not pursuing reproductive health cases. The Virginia Consumer Data Protection Act (VCDPA) classifies health data as sensitive personal information. It gives consumers rights to access, correct, and delete their data. Period tracking apps serving Virginia users must comply with VCDPA requirements. Virginia's legal landscape provides meaningful protections compared to neighboring states with abortion restrictions.

Specific Reproductive Data Protections

Virginia has enacted two specific reproductive data privacy protections.

SB 754 (March 2025) amends the Virginia Consumer Protection Act to prohibit obtaining, disclosing, or selling reproductive or sexual health information without consent. It includes a private right of action ($500 to $1,000 per violation). SB 16 (July 2024) prohibits search warrants for menstrual data stored on apps or electronic devices. Virginia was among the first states to pass a law directly targeting menstrual data warrants.

Federal Protection Status

The HIPAA Reproductive Privacy Rule would have blocked disclosure of protected health information for investigating lawful reproductive healthcare. A federal court in Texas vacated it nationwide on June 18, 2025. HHS declined to appeal. Biden-era executive orders directing FTC and HHS action on reproductive data privacy were revoked on January 24, 2025. A ClearDATA/Harris Poll survey (May 2023, n=2,053) found 81% of Americans wrongly believe HIPAA covers health apps. It does not. Period tracker apps are not healthcare providers. They fall entirely outside HIPAA regardless of state. There is no federal floor for reproductive health data protection.

Key facts

State: Virginia
Abortion law: legal-access
Data protection: moderate
Subpoena risk: low

Virginia allows abortion access without a specific gestational week limit prior to viability.
The Virginia Consumer Data Protection Act (VCDPA) covers sensitive health data.
The VCDPA gives consumers rights to access and delete their data, including health data from period tracking apps.
Virginia borders North Carolina and West Virginia where abortion is more restricted or banned.
Period tracker companies serving Virginia users must comply with VCDPA requirements for sensitive data.

Definitions

Subpoena: A court order that can require a person or company to produce documents or data. Period tracker apps that store readable data on their servers can receive subpoenas. Local-first apps reduce what the company can produce.
Reproductive data: Health information related to menstrual cycles, pregnancy, fertility, and related symptoms. This data is not protected by HIPAA when held by period tracker apps, meaning standard federal health privacy law does not apply.
On-device storage: A privacy architecture where core cycle records stay local-first. Optional encrypted sync may send unreadable ciphertext. Because there is no readable central cycle database, company-directed requests should have less core cycle data to retrieve. Device access and operational records are separate risks.

Cited signals

$59.5M class action settlement against Flo for sharing user reproductive health data with Facebook and Google Reuters, September 25, 2025
Period tracker apps collect an average of 50+ data points per cycle including symptoms, mood, sexual activity, and medication use Norwegian Consumer Council, 2020

Relevant laws

Virginia Consumer Data Protection Act (VCDPA)

Comprehensive consumer data privacy law effective January 2023. Covers personal data including sensitive health information and grants consumers rights to access, delete, and opt out of data sales.

Read statute

Virginia Code § 18.2-71 et seq., Abortion Law

Virginia allows abortion without a gestational age limit prior to viability. Post-viability abortions require physician determination of necessity for health or life of the mother.

Quick answers to the obvious questions.

Does Virginia's Consumer Data Protection Act cover period tracker app data

Yes. The Virginia Consumer Data Protection Act classifies health data as sensitive personal information. Period tracker users in Virginia have rights to access, delete, and opt out of the processing of their cycle data under this law.

Can out-of-state prosecutors subpoena period tracker data from Virginia app companies

Potentially. Virginia does not have a dedicated shield law blocking out-of-state abortion-related subpoenas. Users whose period tracker syncs data to company servers may face requests from prosecutors in states with abortion bans, making on-device storage the safer option.

Questions people ask before they switch.

Is period tracker data safe in Virginia?

Virginia is a low-risk state for period tracker users. Abortion is legal, the VCDPA covers health data as sensitive personal information, and state prosecutors are not pursuing abortion-related cases.

What does the Virginia Consumer Data Protection Act do for period tracker users?

The VCDPA classifies health data as sensitive personal information. Virginia residents have the right to access their data, request deletion, and opt out of data processing and sales by period tracking apps.

Can other states access period tracker data from Virginia companies?

Virginia does not have a formal shield law as of 2026. But the VCDPA's strong data protections and Virginia's legal stance on abortion create a relatively protective environment.

Does federal law protect my period tracker data in Virginia?

No federal law protects period tracker data. Virginia fills much of this gap. The VCDPA covers health data as sensitive personal information. SB 16 (July 2024) prohibits search warrants for menstrual app data. SB 754 (March 2025) prohibits obtaining or selling reproductive health information without consent.