Updated 21 August 2026 — this article was rewritten with primary sources added and unsupported claims removed.
Virginia now bans selling your location data — but the ban is written in a way that leaves most of the location-data trade untouched. The gap is not an oversight buried in fine print; it sits in a single word in the statute, and it is the difference between a law that reshapes the data-broker market and one that reshapes almost nothing.
What SB 338 changed
On 13 April 2026, Governor Abigail Spanberger signed Senate Bill 338 into law as Chapter 820, effective 1 July 2026. The act amends Code of Virginia § 59.1-578, the controller-duties section; the definitions the ban turns on sit separately in § 59.1-575. The bill amends a single section of the Virginia Consumer Data Protection Act (VCDPA) to add one prohibition: a controller “shall not sell or offer for sale precise geolocation data concerning a consumer.” It passed both chambers unanimously.
Virginia did not write a standalone location-privacy statute. It bolted the new ban onto the VCDPA, which means every definition in the parent law now governs the geolocation rule too — including the two definitions that decide how much the ban actually does.
The first inherited definition is a strength. Under the Code of Virginia § 59.1-575, “precise geolocation data” means information that identifies a person’s location “within a radius of 1,750 feet.” That is roughly a third of a mile — tight enough to place someone at a specific clinic, house of worship, or address, which is exactly the granularity that makes location data sensitive. On what it covers, the law is well drawn.
One word narrows the whole ban: “monetary”
The problem is the second inherited definition. The VCDPA defines a sale as “the exchange of personal data for monetary consideration by the controller to a third party” (Code of Virginia § 59.1-575). Read that again: monetary consideration. Only transactions where a company receives actual money in exchange for location data count as a sale. If money never changes hands for that specific transfer, the VCDPA’s ban does not apply.
That narrow test is what privacy analysts flagged as one of the most consequential drafting choices in the bill: Virginia’s monetary-only standard is narrower than the standard the states that moved first adopted (National Law Review). The same analysis notes a second limit worth naming: the ban reaches only precise geolocation, so imprecise or aggregated location data falls outside it entirely — a second gap sitting alongside the monetary one. Consumer Reports, which backed the bill, still called the signing a “landmark” for location privacy (Consumer Reports) — both things are true at once, and the tension between them is the whole story.
The three states side by side
Virginia is the third state to ban selling precise location data, after Oregon and Maryland. What separates them is not whether they ban the sale — it is how each one defines the transaction, and that choice decides whether the non-cash data deals that dominate the market are covered.
| Virginia | Oregon | Maryland | |
|---|---|---|---|
| Law | VCDPA / SB 338 | HB 2008 | MODPA |
| Transaction standard | “monetary consideration” only | monetary or other valuable consideration | sale of sensitive data banned outright |
| Non-cash transfers covered? | No | Yes | Yes |
| Precise-location threshold | within 1,750 ft | within 1,750 ft | precise geolocation (sensitive data) |
| In effect | 1 Jul 2026 | 1 Jan 2026 | 1 Oct 2025 (enforced from 1 Apr 2026) |
Oregon’s HB 2008 bans exchanging location data for “monetary or other valuable consideration,” a phrase that deliberately catches barter and data-for-services deals. Maryland’s MODPA goes further still, prohibiting the sale of sensitive data — a category that expressly includes precise geolocation — outright, with no consent exception. In both states, a non-cash data deal is caught. In Virginia, the identical transfer is legal, because no money moved for the data itself.
The transfers that still move location data
Most location data does not change hands for cash. It moves through programmatic advertising pipelines, data co-ops, licensing deals, and reciprocal data-sharing arrangements where the compensation is ad inventory, audience reach, platform access, or more data — not an invoice. Under Virginia’s monetary-only standard, none of those are a sale, so none of them are banned.
The largest channel of all is programmatic advertising’s real-time bidding, where an app broadcasts a user’s location to dozens of potential ad buyers in the milliseconds before an ad loads. No one writes a cheque for that specific location broadcast; the app is paid for the ad that eventually serves. That is precisely the non-cash, value-for-data structure Virginia’s definition does not reach, and it is how a large share of precise location actually leaves your phone.
The practical route around the ban is therefore short. A broker that today sells a Virginian’s location feed for money can restructure the same transfer as a licensing agreement, an API access deal, or a data-for-data swap, receive non-cash value instead, and land outside the prohibition entirely. The commercial outcome is identical; the legal exposure disappears.
What recourse a Virginian actually has
Even for the cash sales the law does reach, the enforcement route is limited. The VCDPA is enforced exclusively by Virginia’s Attorney General; it grants consumers no private right of action, and it gives a business a 30-day window to cure a violation before an enforcement action can proceed (Code of Virginia, Chapter 53). A Virginian who believes their location data was sold cannot sue the seller directly — they can complain to the Attorney General, who decides whether to act. That structure means the ban’s real-world bite depends heavily on how actively one office chooses to pursue it.
The pattern is not confined to location data. The same structural gap — a category of intimate information that federal law leaves largely unregulated, filled unevenly by individual states — produced the fight over health data collected by wearables, which HIPAA does not reach, and the one over period-tracking apps after Dobbs. Geolocation is simply the category where a state legislature moved first.
Which states are next
The momentum is spreading: California, New York, and Massachusetts are weighing similar restrictions (National Law Review). But because there is no federal privacy law setting one definition of “sale,” each new state writes its own — and each definition it chooses becomes another line a national data broker can optimize around rather than a floor it must meet. Virginia’s ban is real for the cash sale of your location. For the machinery that actually moves it, the more useful question a Virginian can ask is not whether their location is for sale, but whether anyone is paying cash for it — because if they are not, this law has nothing to say.
