Virginia has banned the sale of geolocation data by amending the Virginia Consumer Data Protection Act, joining other states in similar legislative efforts amid increasing regulatory scrutiny on location data.
# Virginia Bans Sale of Geolocation Data
Source: [https://www.hunton.com/privacy-and-cybersecurity-law-blog/virginia-bans-sale-of-geolocation-data](https://www.hunton.com/privacy-and-cybersecurity-law-blog/virginia-bans-sale-of-geolocation-data)
On April 13, 2026, Virginia Governor Abigail Spanberger signed into law[S\.B\. 388](https://lis.virginia.gov/bill-details/20261/SB338/text/SB338), which amends the Virginia Consumer Data Protection Act \(“VCDPA”\) to prohibit the sale of geolocation data\. Notably, the VCDPA defines “sale” more narrowly than other state comprehensive privacy laws, as “the exchange of personal data for monetary consideration by the controller to a third party\.”
The ban on the sale of geolocation data goes into effect on July 1, 2026\.
Virginia follows[Maryland](https://www.hunton.com/privacy-and-cybersecurity-law-blog/maryland-legislature-passes-state-privacy-bill-with-robust-requirements-and-broad-threshold-for-application)and[Oregon](https://www.hunton.com/privacy-and-cybersecurity-law-blog/oregon-amends-consumer-privacy-act)in banning the sale of geolocation data\. Both Maryland and Oregon more broadly define “sale” to mean the exchange of personal data “for monetary*or other valuable consideration*\.” Virginia joins several other states that have recently proposed legislation with similar bans, including[California](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB322),[Massachusetts](https://malegislature.gov/Bills/194/S197),[Vermont](https://legislature.vermont.gov/bill/status/2026/S.71)and[Washington State](https://app.leg.wa.gov/billsummary?BillNumber=1671&Year=2025&Initiative=false)\. The legislative activity follows regulatory scrutiny on the sale of geolocation data, including the California Attorney General’s[investigation](https://www.hunton.com/privacy-and-cybersecurity-law-blog/california-ag-announces-new-ccpa-enforcement-sweep-targeting-location-data-industry)into the location data industry in March 2025, and a 2024[FTC settlement](https://www.hunton.com/privacy-and-cybersecurity-law-blog/ftc-bans-data-broker-from-selling-precise-consumer-location-data)banning a data broker from selling geolocation data\.
Massachusetts lawmakers passed the Consumer Data Privacy Act, banning the sale of precise location data and granting residents new rights over accessing and deleting their data.
Lawmakers have proposed a new version of the Health and Location Data Protection Act that would ban the sale of Americans' health and location data, including data shared with AI chatbots like ChatGPT and Claude, with stronger enforcement measures.
The Supreme Court ruled that police need a warrant to access cellphone location data, even for short periods, reaffirming a reasonable expectation of privacy in digital location records.
The US Supreme Court ruled 8-1 against AT&T and Verizon, upholding FCC fines totaling $104 million for selling users' real-time location data without consent, finding that the FCC's penalty process did not violate carriers' Seventh Amendment right to a jury trial.
The US Supreme Court ruled 6-3 that geofence warrants, which compel tech companies to hand over cell phone location data, require Fourth Amendment protections, affirming that individuals have a reasonable expectation of privacy in their location records even in public areas.