Virginia Just Banned the Sale of Your Location Data

SB-338 makes Virginia the third state to outlaw selling your movements. Data brokers are running out of friendly territory.

State of Surveillance Editorial Team

Aerial view of a highway interchange at night with cars creating light trails
Photo via Unsplash

TL;DR: On April 13, 2026, Virginia Governor Abigail Spanberger signed SB-338 into law, banning the sale of precise geolocation data. Virginia is now the third state (after Oregon and Maryland) to block data brokers from selling your movements. The law takes effect July 1, 2026. It passed every legislative vote unanimously. Meanwhile, data brokers have been caught selling location data showing who visited abortion clinics, mosques, gun stores, and protests. The federal government still buys this data instead of getting a warrant. Virginia just said: not here.

What Virginia Actually Did

SB-338 amends the Virginia Consumer Data Protection Act (VCDPA) with a single, pointed addition: data controllers cannot sell or offer for sale "precise geolocation data" concerning a consumer [1].

The definition matters. "Precise geolocation data" under the VCDPA means any information derived from technology (GPS, cell towers, Wi-Fi triangulation) that pinpoints a person's location within a radius of 1,750 feet [2]. That's roughly a third of a mile. Tight enough to know which building you walked into. Which clinic. Which church. Which rally.

Senator Russet Perry (SD-31), the bill's sponsor, didn't mince words: "Virginians should not have their daily movements treated as a commodity, especially while federal law still allows this kind of data trafficking" [3].

Every committee, every floor vote, every legislative stage: the bill passed unanimously. Bipartisan support for privacy legislation is rare enough to notice.

The Industry This Law Targets

If you've never heard of the location data brokerage industry, that's by design. Companies you've never interacted with are buying and selling records of where your phone has been, often accurate within a few feet.

Here's how the pipeline works: apps on your phone collect GPS coordinates, often through software development kits (SDKs) buried in the code. Those coordinates get sold to data aggregators. The aggregators package them into products and sell them to anyone willing to pay. Government agencies. Advertisers. Stalkers. Anti-abortion groups.

The names behind this industry are worth knowing:

  • X-Mode Social (now Outlogic): Sold location data that could track visits to reproductive health clinics, places of worship, and domestic abuse shelters. The FTC banned the company from selling sensitive location data in January 2024, the first enforcement action of its kind [4].
  • SafeGraph: Classified "Planned Parenthood" as a trackable brand. Vice reported in May 2022 that you could buy location data on visits to more than 600 Planned Parenthood locations for just $160 [5]. SafeGraph only stopped selling the data after the story went viral.
  • Near Intelligence: Sold location data of abortion-seekers to The Veritas Society, a Wisconsin anti-abortion group, which used it for targeted ad campaigns against women visiting Planned Parenthood [6]. The company tracked 1.6 billion people across 44 countries before filing for bankruptcy. Its former executives are under criminal investigation.
  • Babel Street: Sold its "Locate X" tool to the IRS, CBP, and the Secret Service, letting federal agents track Americans without a warrant [7].
  • Venntel: Provided location data to ICE and CBP. The ACLU's FOIA lawsuits revealed that DHS agencies used commercial location data to bypass Fourth Amendment warrant requirements.

This isn't hypothetical harm. These companies built products that let anyone map who visits abortion clinics, mosques, gun shows, protests, and addiction treatment centers. Virginia just cut them off from 8.6 million residents.

Three States Down, Forty-Seven to Go

Virginia joins a small but growing club:

Oregon (HB 2008)

Effective January 1, 2026. Amended the Oregon Consumer Privacy Act to ban the sale of precise geolocation data within a 1,750-foot radius. Also added children's data protections. Oregon went first.

Maryland (MODPA)

The Maryland Online Data Privacy Act includes a ban on selling precise geolocation data. Maryland's law is part of a broader privacy framework that also covers health data and minors' information.

Virginia (SB-338)

Signed April 13, 2026. Effective July 1, 2026. The cleanest of the three: a direct, no-exceptions ban on selling precise geolocation data, bolted onto the existing VCDPA.

States considering similar bans include California, Connecticut, Massachusetts, and Vermont [1]. The pattern is clear: states are filling a gap that Congress refuses to close.

Why States Are Acting: The Federal Government Won't

There is no federal law banning the sale of location data. None. The Fourth Amendment requires the government to get a warrant to track your phone: the Supreme Court said so in Carpenter v. United States (2018). But that ruling only applies to the government directly compelling phone companies to hand over data.

The workaround is stupidly simple: the government buys the data from brokers instead. No warrant needed. No court oversight. No notification to the person being tracked.

ICE does this. CBP does this. The IRS did this. The Secret Service did this. The Defense Intelligence Agency did this. They all purchased commercial location data to track Americans' movements without a warrant [7].

Senator Perry named this gap directly: Virginia won't wait for federal action to safeguard residents' privacy [3]. EPIC, the Electronic Privacy Information Center, backed her up, calling SB-338 legislation that "would put a stop to some of the most harmful abuses of our personal data happening today" [1].

Consumer Reports called it "landmark," adding that the law "should serve as an impetus for more states to do the same, because ultimately, all consumers deserve these protections" [8].

The Dobbs Effect

None of this legislation happened in a vacuum. The Supreme Court's 2022 Dobbs decision (which overturned Roe v. Wade) turned location data from a privacy concern into a safety threat overnight.

After Dobbs, location data that shows someone visiting a reproductive health clinic in a state where abortion is illegal could be used as evidence in a criminal case. Or it could be bought by anti-abortion groups to identify and target patients. Both scenarios moved from theoretical to real.

Vice's 2022 investigation showed SafeGraph was already selling this data before Dobbs [5]. Near Intelligence was already selling it to anti-abortion groups [6]. The legal landscape just made the stakes higher.

That's the context for every state geolocation ban: these laws aren't abstract. They exist because companies were caught selling data that tracks people to clinics, churches, and shelters, and because the people using that data weren't always advertisers.

What This Means for You

If you're in Virginia:

  • Starting July 1, 2026, data brokers cannot sell your precise location data. Period.
  • The law covers any company that controls data about Virginia consumers, not just companies based in Virginia.
  • The VCDPA already lets you opt out of data sales, request deletion, and access your data. SB-338 removes the need to opt out for location data specifically: the sale is banned outright.
  • Violations are enforced by the Virginia Attorney General, who can seek injunctions and civil penalties up to $7,500 per violation [2].

If you're not in Virginia, your location data is still being sold. The apps on your phone are still collecting it. The brokers are still packaging it. Your movements are still a product.

Three states have said no. Your state probably hasn't.

What You Can Do Right Now

Regardless of where you live:

  • Audit app permissions. Go to Settings → Privacy → Location Services (iOS) or Settings → Location (Android). Revoke location access for any app that doesn't need it. Most don't.
  • Set location to "While Using." For apps that legitimately need location (maps, ride-sharing), set access to "While Using the App" instead of "Always."
  • Delete weather and flashlight apps. Free utility apps are notorious for bundling location-harvesting SDKs. Use your phone's built-in weather and flashlight instead.
  • Opt out of data broker collections. Submit deletion requests to known brokers. The data broker explainer on our site walks through the process.
  • Check haveibeenpwned.com. If your email appears in a breach tied to a location data company, your movements may already be in circulation.

References

  1. EPIC - Virginia Governor Signs Bill Banning Sale of Precise Location Data (April 2026)
  2. National Law Review - Virginia Expands VCDPA with Ban on Sale of Precise Consumer Geolocation Data (April 2026)
  3. Consumer Reports - Virginia Location Privacy Legislation
  4. FTC - Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data (January 2024)
  5. Vice - Data Broker Is Selling Location Data of People Who Visit Abortion Clinics (May 2022)
  6. EPIC - Data Broker Helped Anti-Abortion Group Target Planned Parenthood Visitors, Wyden Letter Reveals
  7. EFF - Location Tracking Tools Endanger Abortion Access. Lawmakers Must Act Now. (December 2024)
  8. Consumer Reports - Virginia Governor Signs Landmark Location Privacy Bill Into Law (April 2026)