Virginia bans selling location data — but its narrow 'sale' definition leaves a gap

Virginia has become the third state to prohibit selling consumers’ geolocation data. Governor Abigail Spanberger signed S.B. 388 on April 13, 2026, amending the Virginia Consumer Data Protection Act, with the ban taking effect July 1, 2026. It follows Maryland and Oregon in targeting the location-data trade, and lands amid proposed bills in California, Massachusetts, Vermont, and Washington.

The catch is how Virginia defines a ‘sale.’ The VCDPA counts only exchanges of personal data for monetary consideration, a narrower standard than Maryland’s and Oregon’s, which also capture data traded for ‘other valuable consideration.’ That distinction matters: barter-style arrangements — swapping location data for services, analytics, or other non-cash value — could fall outside Virginia’s prohibition, leaving a workable path for brokers.

The legislation reflects mounting pressure on the location-data industry, including the California Attorney General’s March 2025 investigation and a 2024 FTC settlement that barred a data broker from selling geolocation data outright. With location data central to tracking individuals near sensitive sites such as clinics and places of worship, expect more states to follow — and scrutiny of whether narrow ‘sale’ definitions actually close the market.