Virginia bans the sale of precise geolocation data

Virginia has become the third US state to prohibit the sale of geolocation data. According to a post on Hunton’s Privacy & Cybersecurity Law Blog, Governor Abigail Spanberger signed S.B. 338 on April 13, 2026, amending the Virginia Consumer Data Protection Act (VCDPA) to ban the sale of geolocation data. The prohibition takes effect on July 1, 2026.

A narrower definition of “sale”

The VCDPA defines “sale” more narrowly than other state comprehensive privacy laws, as “the exchange of personal data for monetary consideration by the controller to a third party.” Maryland and Oregon, the two states that preceded Virginia in banning the sale of geolocation data, use broader wording — the exchange of personal data “for monetary or other valuable consideration.” The difference decides which data-sharing arrangements fall inside the prohibition.

Virginia follows Maryland and Oregon

Virginia joins several other states that have recently proposed legislation with similar bans, including California, Massachusetts, Vermont and Washington State. The legislative activity follows a period of regulatory scrutiny on the sale of geolocation data.

Regulators moved first

The California Attorney General opened an investigation into the location data industry in March 2025, and a 2024 settlement with the Federal Trade Commission banned a data broker from selling geolocation data. The Virginia law arrives in the middle of that push rather than ahead of it.

For companies that handle location data, the practical effect is a compliance deadline. Any sale of geolocation data as the VCDPA defines it has to stop in Virginia by July 1, 2026, and because the definition turns on monetary consideration between a controller and a third party, businesses need to map which of their data-sharing arrangements are sales under that wording rather than under the broader standards used elsewhere.