Virginia’s ban on the sale of geolocation data took effect on July 1, adding a specific location-privacy restriction to the Virginia Consumer Data Protection Act. Governor Abigail Spanberger signed Senate Bill 338 on April 13, and the measure applies to transactions covered by the state law’s definition of a sale.
That definition is narrower than the language used in several other state privacy statutes. Virginia defines a sale as a controller exchanging personal data with a third party for monetary consideration. The new prohibition therefore directly reaches cash transactions involving geolocation information. The supplied legal analysis does not say that every transfer, disclosure or use of location data is banned, and the statutory definition should not be expanded beyond its terms.
By comparison, Maryland and Oregon define a sale to include exchanges for monetary or other valuable consideration. Both states had already enacted prohibitions on selling geolocation data. Their broader wording may capture arrangements where data changes hands for benefits other than direct payment, while Virginia’s provision centers on monetary consideration.
The state joined a wider legislative trend. California, Massachusetts, Vermont and Washington had recently considered measures containing similar restrictions, according to the legal analysis. Proposed legislation is not the same as enacted law, but the activity indicates growing state attention to markets for precise information about where people travel, live and spend time.
Regulators had also focused on the data-broker industry before Virginia’s amendment. The California attorney general opened an investigation into the location-data sector in March 2025. In a separate federal action, the Federal Trade Commission reached a 2024 settlement that barred a data broker from selling geolocation information. These steps provide enforcement context, although they arise under different legal authorities and do not determine how Virginia courts or regulators will interpret Senate Bill 338.
Location data can reveal sensitive patterns even when a transaction does not include a name. Repeated points may expose visits to homes, workplaces, medical facilities, places of worship or political events. The new law addresses one part of that risk by removing a commercial sale pathway covered by the VCDPA. The supplied analysis does not detail exceptions, remedies or enforcement procedures, so organizations subject to the law would need to consult the statute and applicable guidance.
Virginia’s action is therefore both significant and bounded. It establishes a clear ban on monetary sales of geolocation data, effective statewide from July 1, while leaving the exact treatment of non-monetary exchanges dependent on the rest of the privacy act. The distinction makes statutory wording central to assessing compliance and comparing Virginia with other states.
