Virginia Bans Sale of Precise Geolocation Data Under VCDPA
Virginia Governor Abigail Spanberger signed a law banning the sale of precise consumer geolocation data.
Why it matters: The new law intensifies compliance requirements for businesses that handle personal data in Virginia, making it critical for privacy officers and legal counsel to reassess data practices. As more states adopt targeted restrictions, companies face a patchwork of evolving privacy obligations.
- SB338, signed April 13, 2026, prohibits selling or offering for sale a consumer’s precise geolocation data in Virginia.
- 'Precise geolocation data' means identifying a person's location within a 1,750-foot radius.
- The law received unanimous Senate support and bipartisan sponsorship.
- Virginia aligns with Maryland and Oregon, both of which have enacted similar geolocation data sale bans.
Virginia has expanded its Consumer Data Protection Act (VCDPA) with a strict prohibition on selling or offering for sale consumers’ precise geolocation data. Governor Abigail Spanberger signed Senate Bill 338 (SB338) on April 13, 2026, marking a significant tightening of privacy expectations for organizations operating in the state.
- The bipartisan measure, sponsored by Senators Russet Perry and David Suetterlein, was passed unanimously in the Senate and cleared the House of Delegates with amendments.
- SB338 defines ‘precise geolocation data’ as information that identifies a natural person’s location within a 1,750-foot radius, derived from technologies like GPS, Wi-Fi, or cell towers.
- Virginia now joins Maryland and Oregon in banning geolocation sales, following a growing state-level trend toward stricter data protections.
Supporters point to risks the new law addresses. Senator Russet Perry described SB338 as “timely and necessary legislation that closes a dangerous gap by banning the sale of precise geolocation data—information that consumers never intended to be sold and that bad actors can use to harm everyday people.” Matt Schwartz of Consumer Reports emphasized protections against harms like stalking, targeted scams, and identity theft.
The legislative move comes amid concerns that consent-based rules failed to adequately protect sensitive location data. Businesses must now review their data handling practices and contracts to ensure compliance, as Virginia’s model may prompt further changes nationally.
By the numbers:
- April 13, 2026 — Date when Virginia's SB338 was signed into law.
- 1,750 feet — The radius threshold for 'precise geolocation data' under the law.
- 3 — States (Virginia, Maryland, Oregon) now banning sale of this type of data.
Yes, but: Key enforcement details and the law's exact effective date have not been specified.