Virginia Governor Abigail Spanberger signed S.B. 388 into law, amending the Consumer Data Protection Act to prohibit the sale of geolocation data. This ban, effective July 1, 2026, follows similar legislation in Maryland and Oregon. The VCDPA defines “sale” narrowly as an exchange of personal data for monetary consideration by a controller to a third party, distinguishing it from broader definitions used elsewhere.

The legislative move reflects growing regulatory scrutiny on the handling of sensitive location information. California’s Attorney General investigated the location data industry in March 2025, and the FTC settled with a data broker in 2024 over similar practices. This wave of state-level action signals a significant shift in how consumer location data can be monetized by businesses.

Virginia’s definition of “sale” is more restrictive than Maryland or Oregon’s, which include “other valuable consideration.” This distinction may impact how data brokers and app developers interpret and comply with the new law. Other states like California and Massachusetts are also considering similar bans, indicating a broader trend toward restricting the opaque sale of user location data.