Virginia Banned the Sale of Your Location Data—Six More States Are Next

What Virginia Just Did

On April 15, 2026, Governor Abigail Spanberger signed Senate Bill 338 into law, amending the Virginia Consumer Data Protection Act to ban the sale of precise geolocation data. The law takes effect July 1, 2026.

The legislation bars the sale of geolocation data within a 1,750 foot radius, a buffer large enough to prevent data brokers from pinpointing where consumers live, work, worship, shop, and otherwise travel. The bill passed the state legislature unanimously on March 10, with bipartisan support that is increasingly rare in privacy legislation.

Virginia joins Oregon and Maryland as the third state to enact an outright ban on precise geolocation data sales. Maryland's law, which took effect on April 1, goes even further by limiting data collection broadly, restricting sensitive data sales, and imposing additional protections for minors.

Why Location Data Is Different

Location data is not just another data point. It is a proxy for everything. Your phone's location history reveals where you live, where you work, which doctor you visit, which house of worship you attend, whether you went to a protest, which bar you frequent, and who you spent the night with. It can be used to infer your religion, political affiliation, health conditions, and sexual orientation.

Data brokers have built a multibillion dollar industry on buying this data from app developers and selling it to advertisers, law enforcement agencies, and anyone willing to pay. The FTC has pursued enforcement actions against brokers like Kochava, which was caught tracking people to health clinics and churches and selling that information to third parties.

Government agencies have also exploited the data broker market. U.S. Customs and Border Protection was found tracking phones through advertising data without a warrant, and the FBI has admitted to purchasing Americans' location data directly from commercial sources.

The 1,750 Foot Buffer

The 1,750 foot radius is a carefully chosen threshold. It is large enough to prevent brokers from identifying specific buildings or addresses, but not so large that it renders all location data unusable for legitimate purposes like aggregate traffic analysis or urban planning.

In practical terms, 1,750 feet is about one third of a mile, or roughly five and a half American football fields. Within a dense urban area, that radius could encompass dozens of buildings, effectively anonymizing any individual location within the zone.

The restriction applies specifically to the sale of this data. Companies can still collect precise geolocation data with user consent for their own services, but they cannot sell that data to third parties at a precision that would identify specific locations.

A Shift From "Notice and Choice" to Outright Bans

For decades, the dominant framework in U.S. privacy law has been "notice and choice": companies disclose their data practices in a privacy policy, and consumers theoretically consent by continuing to use the service. In practice, nobody reads privacy policies, consent is meaningless when the alternative is not using the service, and companies bury the most invasive practices in legal jargon.

Virginia's law, along with Oregon's and Maryland's, represents a different approach entirely. Instead of asking consumers to navigate an impossible consent landscape, these laws simply prohibit the practice. You cannot sell precise geolocation data on residents, period. No opt out form to find, no cookie banner to navigate, no privacy settings to configure.

Matt Schwartz, policy analyst at Consumer Reports, called the protections "critical, especially at a time when the risk of stalking, individualized scams, and unwanted targeting has never been clearer."

Six More States Are Moving

Virginia's law is part of a growing wave. California, Connecticut, Maine, Massachusetts, Vermont, and Washington are all considering similar legislation during the 2026 legislative session. Hawaii has already enacted a ban on the sale of geolocation and browser data specifically to protect abortion access.

The momentum suggests that within two to three years, a significant portion of the U.S. population could live under geolocation data sale bans. For data brokers, the patchwork of state laws may eventually make the business model untenable, effectively creating a de facto national standard through state level action.

What You Can Do Now

While legislation catches up, you can take immediate steps to limit location data exposure:

• Audit app permissions. Review which apps have access to your location on iOS (Settings > Privacy > Location Services) and Android (Settings > Location > App permissions). Revoke access for any app that does not need it.
• Switch to "While Using" mode. For apps that do need location access, set permissions to "While Using the App" rather than "Always." This prevents background tracking.
• Disable advertising identifiers. On iOS, go to Settings > Privacy > Tracking and turn off "Allow Apps to Request to Track." On Android, go to Settings > Privacy > Ads and delete your advertising ID.
• Use a privacy focused browser. Browsers like Firefox and Brave block many of the scripts that collect location data from websites.
• Request data deletion. If you are in a state with a comprehensive privacy law, you can request that data brokers delete your information. California's Delete Act provides a single platform to do this for all registered brokers at once.

The Bottom Line

Virginia's geolocation data ban is a concrete step toward dismantling the infrastructure that allows data brokers to track where Americans go. The 1,750 foot buffer, the unanimous bipartisan support, and the growing number of states following suit all signal that the era of unrestricted location data sales is ending.

For the estimated 8.7 million Virginians the law will protect starting July 1, data brokers will no longer be able to sell a record of every place they have been. For everyone else, the question is when, not whether, their state will follow.