On April 13, 2026, Virginia Governor Abigail Spanberger signed the bipartisan bill SB338, amending the Virginia Consumer Data Protection Act (VCDPA) by prohibiting data controllers from selling or offering for sale a consumer’s precise geolocation data. SB 338 replaces the VCDPA’s prior consent-based treatment of precise geolocation data – which allowed data controllers to process that category of “sensitive data” with a consumer’s informed consent – with a new ban on selling a consumer’s precise geolocation data. Effective July 1, 2026, the amendment adds a new restriction to the VCDPA and creates an immediate compliance issue for companies that collect, use, or monetize location information as well as for downstream acquirers of precise location datasets. As such, downstream recipients should revisit their diligence processes, including source-of-data review and contractual representations with vendors, to confirm compliance with this new law. Note, however, that the new Virginia prohibition is limited on its face to precise location data (i.e., defined under the VCDPA as data that directly identifies a natural person’s specific location within a 1,750-foot radius) and does not extend to imprecise or aggregated location information. The text of the VCDPA itself may also limit the scope of SB338 as the definition of “sale of personal data” under the statute is defined as “the exchange of personal data for monetary consideration by the controller to a third party” and includes several limited exceptions clarifying this definition.
This new restriction continues a trend in state privacy enactments concerning location data, with Oregon amending its own privacy law in 2025 to ban the “sale” of an individual’s precise location data and Maryland enacting the Maryland Online Data Privacy Act in 2024, which contains a provision that bans the sale of “sensitive data,” including precise location data (and which became effective in October 2025). Other states like California (AB 322), New York (S3044) and Massachusetts (S.2608) are considering similar prohibitions. Meanwhile, the FTC has in recent years maintained an enforcement focus on the sharing of location data without informed consumer consent.
