Virginia Bans Geolocation Data Sales

Virginia Governor Abigail Spanberger signed Senate Bill 338 into law on April 13, 2026, amending the Virginia Consumer Data Protection Act to prohibit the sale of consumers' precise geolocation data.

The law takes effect on July 1, 2026.

The legislation bars the sale of geolocation data within a 1,750-foot radius, a buffer large enough to keep data brokers from pinpointing where consumers live, work, worship, shop and otherwise travel.

Virginia joins Maryland and Oregon as the only states that have banned the sale of consumers' precise geolocation data.

How Does Virginia's Ban Compare to Other States?

The bill received unanimous, bipartisan approval at every step of the legislative process.

The bill passed the state legislature unanimously on March 10, with bipartisan support that is increasingly rare in privacy legislation.

Unlike Virginia, Maryland and Oregon define "sale" in broader fashion to include disclosures of personal data in exchange for money or "other valuable consideration," whereas Virginia's definition of sale is limited to disclosures of personal data for "monetary consideration."

The VCDPA defines "sale" more narrowly than other state comprehensive privacy laws, as "the exchange of personal data for monetary consideration by the controller to a third party."

Senate Bill 338 replaces the VCDPA's prior consent-based treatment of precise geolocation data – which allowed data controllers to process that category of "sensitive data" with a consumer's informed consent – with a new ban on selling a consumer's precise geolocation data.

What Prompted the Location Privacy Push?

Data brokers selling precise geolocation information have been under scrutiny and several news outlets have published reports showing how the data has been used to track the location of national security officials and people visiting abortion clinics. In February 2024, Sen. Ron Wyden (D-OR), announced that his staff found evidence that an anti-abortion organization "targeted misinformation" to citizens who visited some 600 reproductive health clinics in 48 states by leveraging mobile phone location data.

EPIC noted that the harms of the overcollection and widespread sale of precise geolocation data have also come to the forefront recently amid reports that Immigration and Customs Enforcement (ICE) has purchased software that allows the agency to track millions of Americans via their cellphones. Bypassing Fourth Amendment protections, ICE has purchased access to a social media and phone surveillance product that allows the agency to monitor specific areas for mobile phones and track the movements of those devices (or their owners) over time.

In May 2024, the Federal Trade Commission reached a settlement with InMarket Media, which prohibited InMarket from selling or licensing sensitive location data, meaning data that can link an individual to a specific sensitive location, including sexual and reproductive health providers, religious organizations, labor union offices, locations predominantly providing services to LGBTQ+ individuals, locations predominantly providing services to specific racial or ethnic groups, and locations of public gatherings of individuals during political or social demonstrations, marches, and protests.

Which States Are Considering Similar Bans?

Several other states are debating enacting their own bans with legislation now pending in the California, Connecticut, Massachusetts and Vermont legislatures.

California, Connecticut, Maine, Massachusetts, Vermont, and Washington are all considering similar legislation during the 2026 legislative session.

In March 2025, California Attorney General Rob Bonta announced "an ongoing investigative sweep into the location data industry" and reminded consumers of their rights under the California Consumer Privacy Act to opt out of the sale or sharing of their personal information.

On May 27, 2026, Connecticut Governor Ned Lamont signed Senate Bill 4 into law, amending the Connecticut Data Privacy Act. The CTDPA Amendments create data broker registration and compliance requirements, ban the sale of geolocation data, and set limits on surveillance pricing and the processing of genetic data.

How Big Is the Data Broker Industry?

The global data broker market size was estimated at USD 277.97 billion in 2024 and is projected to reach USD 512.45 billion by 2033, growing at a CAGR of 7.3% from 2025 to 2033.

North America held a 41.2% revenue share of the global data broker market in 2024.

Location Data is the next fastest growing segment of the market due to the increasing need for real time attribution and place based behavioral insights. The improvements in device sensors and privacy responsible data collection has led to a much larger ability to use the information across all industries including Retail, Advertising, and Logistics, creating many new licensing channels and opportunities for integration, resulting in large market growth.

Location Data holds nearly 8% of the data broker market share because businesses increasingly utilize geospatial analytics and mobility insights for targeted advertising and operational planning. Data brokers collect information from mobile devices, GPS systems, and connected applications to analyze movement patterns and consumer behavior.

What Changed This Week

Virginia became the third state to ban the sale of precise geolocation data, following Maryland and Oregon. The law prohibits data controllers from selling location information within a 1,750-foot radius and takes effect July 1, 2026. Unlike Maryland and Oregon, Virginia's ban applies only to sales for monetary consideration, not exchanges for other valuable consideration. The legislation received unanimous bipartisan support and reflects growing momentum for location privacy protections at the state level.

What to Watch

For the estimated 8.7 million Virginians the law will protect starting July 1, data brokers will no longer be able to sell a record of every place they have been. Watch for implementation guidance from Virginia's Attorney General as the July 1 effective date approaches. Monitor legislative progress in California, Connecticut, Massachusetts, and Vermont, where similar bans are under consideration. Track Federal Trade Commission enforcement actions against data brokers, particularly following the agency's ongoing scrutiny of location data practices. Connecticut's new data broker law, which includes geolocation sale restrictions and takes effect in phases through 2028, will provide another model for state-level regulation.

Reporting based on coverage from The Record, Consumer Reports, Hunton Privacy Blog, Regulatory Oversight, Willkie Compliance Concourse, EPIC, Proskauer, Grand View Research, April-June 2026.