Virginia Governor Abigail Spanberger signed S.B. 338 into law on April 13, 2026, and starting July 1, 2026, businesses can no longer sell Virginians' precise geolocation data at all. The bill amends the Virginia Consumer Data Protection Act (VCDPA) to flatly prohibit the sale of this category of data rather than folding it into the state's existing opt-out consent framework, and according to the Electronic Privacy Information Center (EPIC), that makes Virginia the third state, after Maryland and Oregon, to ban the practice outright.
That distinction, ban versus opt-out, is the whole story here. Most state privacy laws, including Virginia's own VCDPA before this amendment, let a business sell precise geolocation data as long as it honors a consumer's opt-out request. S.B. 338 removes that option for this specific data category. There is no opt-out to configure, because there is no lawful sale to opt out of.
Source: EPIC (Electronic Privacy Information Center), Virginia Governor Signs Bill Banning Sale of Precise Location Data, captured August 2026.
What counts as precise geolocation data under S.B. 338
The bill does not ban selling any location data. It targets a specific, narrower category: precise geolocation data, defined under the VCDPA framework as information that reveals a consumer's location within a 1,750-foot radius. Coarse location data, the kind derived from a billing zip code or an IP-based city lookup, sits outside that definition and is not affected by this particular ban.
Figure: The radius threshold that separates "precise geolocation data," now unsellable in Virginia, from coarser location data the ban does not reach.
That 1,750-foot line matters for any business whose product touches GPS coordinates, cell-tower triangulation, Wi-Fi positioning, or Bluetooth beacon data, categories precise enough to place a person's real-time location down to a specific building or block. A weather app, a fitness tracker, a rideshare service, a retail app pinging a shopper's in-store position, all of these routinely collect data that falls inside the 1,750-foot definition, whether or not the app markets itself as a "location" product.
Virginia joins Maryland and Oregon in an outright ban
EPIC's announcement states plainly that Virginia "joins Maryland and Oregon" in banning the sale of precise geolocation data outright, and that the bill passed both chambers of the Virginia Legislature unanimously before reaching the governor's desk. EPIC had testified in support of S.B. 338 while it moved through the Legislature and sent Spanberger a letter urging her to sign it.
| State | Mechanism for precise geolocation sale |
|---|---|
| Virginia (S.B. 338, 2026) | Outright ban, no opt-out available |
| Maryland (MODPA amendments) | Outright ban, no opt-out available |
| Oregon | Outright ban, no opt-out available |
| Most other VCDPA-style states | Sale allowed if the consumer can opt out |
Maryland took a related but separate step earlier this year with a law barring the sale of personal data to government units tied to civil immigration enforcement; see our coverage of Maryland's data sale restrictions for that mechanism. Virginia's ban is not tied to a specific buyer type. It applies to any sale of precise geolocation data, regardless of who the buyer is.
Why EPIC pushed this as more than a privacy technicality
EPIC's letter to the governor framed the bill in blunt terms, telling Spanberger that "by banning the sale of precise geolocation data, S.B. 338 would put a stop to some of the most harmful abuses of our personal data happening today." The organization pointed to reporting that Immigration and Customs Enforcement (ICE) has purchased commercial software allowing the agency to track millions of Americans through their cellphones, monitoring specific areas for mobile devices and following the movements of those devices, and by extension their owners, over time, without a warrant.
That context helps explain why a data category most privacy laws treat as just another opt-out item got carved out for a flat ban in Virginia. A location data broker selling to a government surveillance buyer is legal in most states as long as consumers technically had a chance to opt out somewhere in a settings menu few of them ever find. S.B. 338 does not leave that gap open for precise location data specifically.
Virginia's move follows a broader pattern of 2026 state amendments tightening specific gaps in existing privacy statutes rather than passing entirely new laws; see our coverage of the Vermont, Louisiana, and other July 2026 amendment wave for how several other states used the same July 1 effective date to close different gaps. The location-data question itself is also a live compliance issue well beyond Virginia: our research on how many apps collect location data puts the practice at well over a third of mobile apps, which is a large surface area for a single state's ban to touch.
What this means for your privacy policy
A privacy policy that describes location data sharing with a single generic line, something like "we may share location data with our partners," does not tell a Virginia resident whether that sharing crosses into a sale, and it does not reflect that selling precise geolocation data is now flatly illegal in Virginia regardless of consent language elsewhere in the policy. If your business collects GPS, Wi-Fi, Bluetooth, or cell-tower location data from users and monetizes any part of that data through a third party, your disclosures need to distinguish between coarse and precise location data and state plainly that a sale of the precise category to Virginia residents is not something your business can lawfully do, not something a consumer needs to opt out of.
This is a narrower compliance gap than New Jersey's delayed data broker registry fees, covered in our piece on New Jersey's data broker enforcement timeline, but it is a live one starting July 1, with no phase-in period. Our Privacy Policy Generator keeps state-specific data-sale disclosures current as bans like Virginia's take effect, so your policy states what is and is not lawful rather than defaulting to a one-size-fits-all sharing clause.
Bottom Line
Virginia's S.B. 338 took effect July 1, 2026, banning the sale of precise geolocation data outright rather than requiring an opt-out, and making the state the third, after Maryland and Oregon, to draw that line. The ban applies specifically to data revealing a location within 1,750 feet, leaving coarser location data untouched, but for any business that sells precise location data at all, there is no consent workaround left in Virginia. A privacy policy that still treats all location sharing as one opt-out category has not caught up with what the law now actually requires.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
