A proposed class action lawsuit accuses Best Buy of quietly funneling customers’ personal purchase data to advertisers through its in-house media unit, Best Buy Ads, without providing the disclosures required under Virginia law. The complaint, filed under the state’s Personal Information Privacy Act, targets the retailer’s decision to monetize transaction records collected from shoppers who had no meaningful notice that their data was being sold. Virginia consumers who made purchases after the advertising unit went live in January 2022 are named as the proposed class.
How Best Buy Ads turned shopper data into ad inventory
Best Buy formally announced the creation of its new advertising arm in January 2022, describing it as an in-house advertising and media business designed to connect brands with the retailer’s customer base. The unit promised advertisers access to purchase behavior and browsing signals drawn from one of the country’s largest electronics retailers. That pitch, according to the complaint, depended on transferring identifiable customer information to third-party advertisers for consideration, a transaction that Virginia’s privacy statute explicitly regulates.
The lawsuit centers on whether Best Buy provided the advance notice that Chapter 35 of the Code of Virginia requires before a retailer sells purchaser information. The Personal Information Privacy Act, commonly known as VPIPA, sets out specific disclosure obligations that apply when a business transfers personal data tied to consumer purchases. Plaintiffs allege Best Buy bypassed those obligations entirely, treating customer records as a ready-made advertising asset without updating its privacy practices to match.
The gap between the public launch of the advertising unit and any corresponding privacy-notice update is the core factual dispute. If Best Buy began packaging and licensing transaction-level data to advertisers immediately after the January 2022 launch, and if its privacy disclosures did not reflect that new data flow at the same time, the company would have been operating outside the statute’s requirements from the start. The hypothesis that data-licensing revenue began accruing before privacy notices were revised cannot be tested with public filings alone, because Best Buy does not break out Best Buy Ads revenue as a separate line item in its SEC disclosures. That missing granularity is itself part of the problem the plaintiffs describe: the data sales were invisible to the people whose information was being sold.
What VPIPA requires and what the complaint says Best Buy skipped
Virginia’s Personal Information Privacy Act is not a new law. It has been part of the Code of Virginia for years and specifically governs the sale of purchaser information by retailers. The statute requires businesses to notify consumers before selling their personal data and to provide a mechanism for opting out. Unlike broader state privacy frameworks that focus on digital tracking, VPIPA targets the commercial transfer of records generated by actual purchases, including names, addresses, and transaction details. General information about how Virginia structures and publishes its statutes is available through the legislature’s own legal information portal, which includes references to consumer privacy provisions.
The complaint alleges that Best Buy treated the launch of its advertising business as a marketing event rather than a compliance trigger. When the company told brands it could deliver “rich shopper data,” according to its own promotional materials, it was describing the very category of information VPIPA was written to protect. Plaintiffs argue that no updated disclosure accompanied the new data flows, leaving Virginia shoppers unaware that their purchase histories were being repackaged and sold. They further contend that Best Buy failed to provide a clear, up-front opt-out mechanism tied to the sale of transaction data, instead burying any references to data-sharing practices in generic privacy language that did not reflect the scope of the new ad offering.
In the complaint’s telling, the absence of specific, timely notice is not a minor technical issue but a fundamental violation of the statute’s purpose. VPIPA is designed to ensure that consumers know when their purchase records are being monetized and have a realistic opportunity to say no. The plaintiffs say that by the time an average shopper might have discovered that Best Buy Ads existed, their data had already been fed into audience segments and targeting models offered to brands eager to reach electronics buyers.
Potential impact beyond Best Buy
Although the lawsuit focuses on a single retailer, it lands at a moment when many large chains are building so-called retail media networks that turn shopping data into ad inventory. If a court agrees that Virginia’s purchaser-information statute applies squarely to these programs, other companies could face similar claims unless they have already aligned their disclosures with the law. The case also highlights the growing importance of state-level privacy rules, which can sit alongside broader frameworks and create overlapping obligations for businesses handling consumer data.
For Virginia residents, the litigation may serve as a practical reminder to review how retailers describe their use of personal information. The state maintains a dedicated page explaining its approach to data protection and how individuals can learn more about applicable laws through the legislature’s privacy resources. Whether or not the Best Buy suit succeeds, it underscores that the line between routine marketing and regulated data sales is narrowing-and that retailers who cross it without clear notice may find themselves defending their practices in court.
