On April 13, 2026, Governor Abigail Spanberger signed SB 338 into law, joining Oregon and Maryland in banning the sale of precise geolocation data. 

In recent years, location data has become one of the more politically salient data types due to its propensity to cause tangible harm when processed or disclosed for certain purposes. It can serve as proxy for more sensitive information (e.g., visits to abortion clinics or places of worship) and has been used extensively in recent federal immigration deportation efforts. In turn, states have sought to restrict the precise geolocation data flows through targeted prohibitions.  

Virginia achieves this by amending the Virginia Consumer Data Protection Act, which for some organizations may provide refuge and permit continued third-party disclosures. For example:

• The VCDPA defines sale as the exchange of personal data for monetary consideration only, and does not include the broader “or other valuable consideration” construction seen in other states.  A data sharing arrangement in which an app developer receives free SDK access or analytics services in return for providing precise location data to a broker would not constitute a 'sale' under the VCDPA.
• Certain entities may still be free to lawfully collect, process, and sell precise geolocation data if necessary "to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity."
• While there is legitimate debate about whether precise geolocation data can truly be considered “de-identified,” if a business takes reasonable measures to reduce traceability to individuals and complies with the VCDPA's remaining obligations (e.g., publicly commit to not re-identifying, contractually obligate recipients not to re-identify), it may pull the data out of the statute's scope and permit continued sales. Of course, this is a high bar in practice and carries real risk if de-identification does not hold up. 

SB 338 is one law in a growing consensus that precise geolocation data is too sensitive to be bought and sold. As more states move to adopt similar (and potentially broader) bans, organizations that depend on precise geolocation data should be pressure-testing the legality of their practices, or adjusting their business models accordingly.