A Virginia shopper has filed a lawsuit accusing Best Buy of quietly funneling customers’ personal purchase data to advertisers without the notice required under state law. The complaint targets Best Buy Ads, the retailer’s in-house advertising unit, which the company announced on January 4, 2022, with a promise to tap “deep customer insights” for brand partners. At the center of the legal theory is a decades-old Virginia statute that most consumers have never heard of, one that specifically bars merchants from selling information collected during in-store transactions unless they tell the buyer first.
How Best Buy Ads and Virginia’s Privacy Statute Collide
The legal friction starts with a straightforward rule. Virginia Code Section 59.1-442, housed within Chapter 35 of the state code and formally titled the Personal Information Privacy Act, prohibits merchants from selling to third parties any information gathered in connection with a sale, rental, or exchange of tangible personal property at the merchant’s place of business without first giving notice to the purchaser. The statute is narrow in scope but direct in its demand: tell the customer before you share their data, or do not share it at all.
Best Buy’s advertising arm, by contrast, was built to do the opposite at speed. When the company rolled out Best Buy Ads in early 2022, it described the unit in a Business Wire release as a way to connect brands with shoppers using “deep customer insights” drawn from the retailer’s vast transaction and browsing records. The service promised advertising placements on Best Buy’s own digital properties as well as external sites, meaning purchase data collected at checkout could flow outward to partners across the open web.
The lawsuit’s core theory is that this architecture created a structural conflict with Virginia’s pre-sale notice requirement. A customer who buys a laptop at a Best Buy store generates a transaction record. If that record is later matched to an advertiser segment and used to serve targeted ads through external platforms, the data has effectively been transferred to a third party. Under Section 59.1-442, that transfer is lawful only if the shopper received notice before or at the time of purchase. The complaint alleges no such notice was provided, either at the register or in any clearly presented in-store disclosures.
What the Statute Says and What Best Buy Promised Advertisers
The gap between the law’s text and the company’s marketing language is where the plaintiff’s argument gains traction. Virginia’s statute applies specifically to tangible personal property sold at a merchant’s place of business. Best Buy operates hundreds of brick-and-mortar stores, and its core business is selling physical electronics, appliances, and accessories. Every qualifying in-store transaction, the lawsuit contends, falls squarely within the statute’s reach, even if the data is later mixed with online browsing behavior.
Best Buy’s own announcement framed the advertising unit as a competitive advantage rooted in first-party shopper data. The company cast itself as a partner for brands seeking to reach “tech-savvy” consumers, highlighting its ability to build audience segments from purchase histories, loyalty program records, and digital interactions. But the Virginia law predates the retail media trend by years and was not written with ad-tech pipelines in mind. That mismatch is the crux of the dispute: a statute designed for a simpler era of customer data now confronting a system engineered to monetize purchase histories at scale.
The practical effect for shoppers, if the complaint is correct, is that a routine electronics purchase could feed a data pipeline they never agreed to join. A customer might see ads for accessories, warranties, or unrelated products on third-party sites, not realizing that the targeting was powered by an in-store transaction that state law treats as sensitive unless disclosed. The plaintiff argues that this invisible repurposing of checkout data is exactly what Section 59.1-442 was meant to prevent.
Enforcement, Remedies, and the Role of State Lawmakers
The lawsuit also raises questions about how aggressively Virginia’s privacy rules will be enforced in an era of data-driven retail. The Personal Information Privacy Act provides for civil penalties and allows affected individuals to seek relief when merchants ignore the notice requirement. If a court agrees that Best Buy’s advertising practices fall within the statute, other retailers operating similar media networks could face copycat suits from customers whose purchases were quietly transformed into ad-targeting fuel.
Any broader policy response would run through Richmond, where the Virginia General Assembly oversees updates to the state’s consumer protection framework. Lawmakers could clarify how legacy statutes like Section 59.1-442 interact with modern advertising models, tighten disclosure standards for in-store data sharing, or create new obligations tailored to retail media networks. For now, the Best Buy case tests how far existing law can stretch to cover practices that were barely imaginable when the statute was drafted.
Best Buy has not publicly detailed its legal position in response to the complaint, but the company is likely to argue that its use of customer data is consistent with its privacy policies and industry norms. The plaintiff, by contrast, is asking the court to focus not on norms but on the specific command of Virginia law: if merchants want to sell or transfer in-store transaction data to third parties, they must tell customers first. The outcome could determine whether a quiet line of code in a retailer’s ad stack is treated as a technicality-or as a violation of a long-standing promise embedded in state statute.
