Virginia SB 338 Signed: Geolocation Data Sale Ban Takes Effect July 1, 2026

Virginia Enacts a Geolocation Data Sale Ban

Virginia Senate Bill 338 is now law. Governor Abigail Spanberger approved SB 338 on April 13, 2026 as Chapter 820, with an effective date of July 1, 2026. The act amends the Virginia Consumer Data Protection Act (VCDPA) to prohibit controllers from selling or offering to sell consumers' precise geolocation data.

That moves Virginia from a consent-based sensitive-data framework to a hard sale ban for precise location data — a category privacy advocates have called uniquely sensitive because it can reveal where people live, work, worship, seek medical care, and spend their time.

What SB 338 Does

The new law adds a straightforward prohibition to the existing VCDPA: controllers may not sell consumers' precise geolocation data. Precise geolocation is generally defined in the VCDPA as data that can identify a consumer's physical location within a radius of 1,750 feet (approximately one-third of a mile).

Key provisions include:

Prohibition on sale — controllers may not sell or offer for sale precise geolocation data concerning a consumer
July 1, 2026 effective date — businesses subject to the VCDPA should stop covered sale activity before Q3 begins
No private right of action — enforcement remains exclusively with the Virginia Attorney General, consistent with the VCDPA's existing framework
Original enforcement amendment removed — an earlier version of the bill would have modified VCDPA enforcement provisions, but this was stripped during the legislative process

Source check: Virginia legislative tracking lists SB 338 as approved by the Governor as Chapter 820 with a July 1, 2026 effective date, and the chapter text amends Code of Virginia § 59.1-578 to add the precise-geolocation sale prohibition (LegiScan bill status; Virginia LIS Chapter 820 text, date_retrieved: 2026-05-25).

Why Geolocation Data Is Getting Special Attention

Precise geolocation data has become a flashpoint in privacy regulation for several reasons. Location data collected from smartphones and apps can track individuals to specific locations — medical clinics, places of worship, political events, and private residences. Data brokers have been caught selling location data that was used to identify individuals visiting sensitive locations. Unlike browsing data, location data is difficult to anonymize because movement patterns are uniquely identifying.

These concerns have driven multiple states to restrict geolocation data beyond what their general privacy frameworks require.

How Virginia Compares to Other States

Virginia is not alone in targeting geolocation data. Several states have enacted or proposed similar restrictions.

Maryland (MODPA)

Maryland's Online Data Privacy Act, effective October 1, 2025, takes the most aggressive approach. It prohibits the sale of all sensitive data — not just geolocation — and applies data minimization requirements that limit collection of geolocation data to what is strictly necessary for the service being provided.

Oregon (OCPA Amendments)

Oregon amended its Consumer Privacy Act to restrict the sale of precise geolocation data within a 1,750-foot radius, effective July 1, 2025. The restriction applies specifically to data brokers and includes enhanced penalties for violations involving minors' data.

California (CCPA/CPRA)

California classifies precise geolocation as sensitive personal information. Consumers have the right to limit its use and disclosure, and businesses must obtain opt-in consent before processing it. However, California has not enacted an outright ban on its sale.

Connecticut (Public Act 26-64)

Connecticut enacted SB 4 as Public Act 26-64 in May 2026, adding a hard prohibition on selling consumers’ precise geolocation data to the existing CTDPA, alongside data broker registration and accessible deletion mechanism requirements. The geolocation-sale ban takes effect October 1, 2026.

What Businesses Should Do Now

If you are subject to the VCDPA and sell, license, broker, or otherwise monetize precise location data about Virginia consumers, treat July 1, 2026 as the implementation deadline. Here are practical steps to prepare:

Audit your geolocation data practices — identify everywhere your business collects, processes, or shares precise location data. This includes mobile apps, in-store analytics, advertising platforms, and third-party SDKs embedded in your products.
Review data sharing agreements — if you share geolocation data with third parties (including advertising partners, analytics providers, and data brokers), determine whether those transfers constitute a "sale" under applicable state definitions.
Block Virginia precise-location sales — configure adtech, data broker, enrichment, and analytics workflows so precise Virginia location data is not sold or offered for sale after July 1, 2026.
Implement geolocation-specific consent — treat precise geolocation as sensitive data everywhere, not just in states that require it. Consent may still be needed for collection or processing even where a separate sale ban applies.
Reduce geolocation precision where possible — if your business only needs approximate location (city or zip code), configure your systems to collect coarse location rather than precise GPS coordinates.
Update your privacy notice — clearly disclose your geolocation data practices, including what you collect, how you use it, and whether you sell or share it.

Use our privacy law calculator to check which state laws currently apply to your business, and review the state law comparison tool to understand how geolocation requirements differ across jurisdictions.

Timeline and Next Steps

SB 338 is no longer pending. The operational timeline is now fixed: signed April 13, 2026; effective July 1, 2026. Before that date, VCDPA-covered businesses should identify precise-location sale flows, turn off Virginia sale eligibility, update vendor instructions, and confirm the privacy notice no longer implies that sale of precise geolocation data remains available with consent.

Use the Geolocation Compliance Checker to inventory state-specific location-data obligations, and check our compliance deadlines tracker for the latest privacy compliance dates.

Published: March 28, 2026. Last verified: May 25, 2026.