Reproductive Health Data Privacy Act (SB 1082)

• Requires businesses providing reproductive health services ("regulated entities") to obtain explicit individual consent before collecting, processing, or selling reproductive health data, with exceptions for HIPAA-protected health information.

• Limits use of reproductive health data to specific purposes including providing requested services, completing transactions, legal compliance, public safety, and fraud prevention; prohibits collecting more data than necessary or retaining data longer than needed.

• Establishes strict requirements for selling reproductive health data beginning June 30, 2027, including written consent with specific disclosures, one-year expiration dates, and ability to revoke consent at any time.

• Prohibits use of geofences (technology establishing virtual boundaries within 1,850 feet of reproductive health facilities) to identify, track, or collect data from individuals seeking reproductive health services.

• Allows the Attorney General and individuals to bring civil actions for violations with damages of $100-$750 per incident or actual damages, whichever is greater, plus injunctive relief and attorney fees.