Virginia bans monetary sales of geolocation data under privacy law, joining Maryland and Oregon as state scrutiny grows

Virginia Governor Abigail Spanberger signed S.B. 388, amending the Virginia Consumer Data Protection Act to ban the sale of geolocation data starting July 1, 2026. The law applies to exchanges of personal data for monetary consideration, a narrower definition than in Maryland and Oregon.

Virginia’s move shows state lawmakers are increasingly targeting location data markets even when broader federal privacy rules remain stalled. The narrower definition of sale may limit the ban’s reach, but growing legislation and enforcement pressure suggest data brokers and app ecosystems face rising compliance risk.