Virginia bans sale of geolocation data
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Governor Abigail Spanberger signed S.B. 388 on April 13, 2026, amending the Virginia Consumer Data Protection Act (VCDPA) to prohibit the sale of geolocation data, with the ban taking effect July 1, 2026.
- The VCDPA defines "sale" narrowly as "the exchange of personal data for monetary consideration by the controller to a third party" — a definition narrower than other state comprehensive privacy laws.
- Maryland and Oregon previously banned geolocation data sales, but both states more broadly define "sale" to include exchanges for "monetary or other valuable consideration," not just money.
- California, Massachusetts, Vermont, and Washington State have all proposed similar geolocation data sale bans, placing Virginia in a growing wave of state-level restrictions.
- The legislative push follows enforcement scrutiny, including a California Attorney General investigation into the location data industry in March 2025 and a 2024 FTC settlement that barred a data broker from selling geolocation data.
Why it matters: Virginia's narrower "sale" definition — covering only monetary consideration — creates a potential workaround that data brokers could exploit by trading geolocation data for non-monetary value, a gap Maryland and Oregon's statutes explicitly close. Companies handling location data in Virginia now have until July 1, 2026 to restructure data-sharing arrangements before the ban takes effect.
