Virginia bans geolocation data sales under amended VCDPA
Original: Virginia bans sale of geolocation data
Why This Matters
State-level geolocation data restrictions are expanding rapidly, signaling a tightening U.S. privacy regulatory landscape for data brokers.
On April 13, 2026, Virginia Governor Abigail Spanberger signed S.B. 388 into law, amending the Virginia Consumer Data Protection Act to prohibit the sale of geolocation data. The ban takes effect July 1, 2026, joining Maryland and Oregon in restricting such data sales.
Virginia Governor Abigail Spanberger signed S.B. 388 on April 13, 2026, amending the Virginia Consumer Data Protection Act (VCDPA) to ban the sale of geolocation data, effective July 1, 2026. The VCDPA defines 'sale' narrowly as 'the exchange of personal data for monetary consideration by the controller to a third party,' a more limited definition than those used in Maryland and Oregon, which also cover exchanges for 'other valuable consideration.' Virginia joins a growing wave of states enacting similar protections, including proposed legislation in California, Massachusetts, Vermont, and Washington State. The legislative trend follows heightened regulatory scrutiny, including a California Attorney General investigation into the location data industry in March 2025 and a 2024 FTC settlement that banned a data broker from selling geolocation data.