Virginia’s Location Data Ban Signals the End of Precise Geolocation Sales

The dominoes are falling fast. Virginia lawmakers unanimously passed SB 338 this week, prohibiting businesses from selling consumers’ precise geolocation data—defined as any location within a 1,750-foot radius. Virginia joins Oregon and Maryland in enacting outright bans on location data sales, and the momentum suggests this is just the beginning.

The question privacy professionals are now asking: How long before these prohibitions cover more than 50% of the U.S. population?

The Current State of Location Data Bans

States with Enacted Bans (2024-2026)

State	Law	Effective	Definition of “Precise”
Oregon	Oregon Consumer Privacy Act	2024	1,750 feet
Maryland	Maryland Online Data Privacy Act	March 2026	1,750 feet
Virginia	VCDPA Amendment (SB 338)	Pending signature	1,750 feet

These three states represent approximately 25 million people—about 7.5% of the U.S. population. But the pipeline of pending legislation suggests this number could grow dramatically.

States Actively Considering Location Data Bans (2026)

According to Consumer Reports, several states are expected to consider similar bans this year:

California — Building on CCPA/CPRA foundations
Massachusetts — Comprehensive privacy bill includes location provisions
Washington — My Health My Data Act expansion
Vermont — Data broker regulation updates
Maine — Comprehensive privacy legislation
New Mexico — New privacy framework in committee

A parallel regulatory approach requires explicit consumer consent before collecting or processing precise location data:

State	Consent Standard	Status
Colorado	Opt-in required	Active
Connecticut	Opt-in required	Active
Delaware	Opt-in required	Active
Kentucky	Opt-in required	Active
Minnesota	Opt-in required	Active
Montana	Opt-in required	Active
Nebraska	Opt-in required	Active
New Jersey	Opt-in required	Active
Tennessee	Opt-in required	Active
Texas	Opt-in required	Active

States considering opt-in standards: New York and Illinois.

The 50% Population Threshold: A Regulatory Tipping Point

Privacy attorney Alan Chapell posed the critical question on LinkedIn this week: “How long does the precise location space have before similar prohibitions cover more than 50% of the U.S. population?”

Let’s do the math:

Current bans (OR, MD, VA): ~25 million people (7.5%)

If California passes a ban: +39 million → 64 million (19%)

Add New York and Texas opt-in enforcement: +50 million → 114 million (34%)

Add remaining states with active bills (MA, WA, NJ, IL): +45 million → ~159 million

Result: Potentially 50% coverage by late 2027.

The California Privacy Protection Agency (CPPA) already lists approximately 40 companies in its data broker registry that process precise location data. These companies face an existential business model challenge.

What This Means for Compliance Teams

Immediate Actions Required

Audit your data flows — Identify any collection, processing, or sale of location data with precision greater than zip+4 (approximately 1,750 feet)
Review vendor contracts — Data broker relationships involving location data need immediate attention
Update consent mechanisms — Even in states without outright bans, opt-in consent is becoming the standard
Implement geographic restrictions — Consider treating location data bans as a national standard rather than managing state-by-state compliance

The Business Model Pivot

Companies in the precise location data space face three strategic options:

Pivot to aggregated data — Zip+4 or broader geographic segments don’t trigger most bans
Adopt analytics-only models — Processing location data for insights without “selling” may be permissible
Implement explicit consent workflows — If consumers genuinely opt in with clear disclosure, some uses remain viable

However, as Chapell noted: “Not ‘selling’ PLD may not address the supply problem for those that lack precise location data via O/O properties.” Companies without owned-and-operated data collection face the hardest path forward.

The Consumer Reports Model Bill

Consumer Reports released the State Location Privacy Act as model legislation for states considering action. Key provisions include:

Outright ban on selling precise geolocation data
Collection limits to what’s necessary for the requested service
Upfront notice requirements about location data practices
Private right of action for consumers—the strongest enforcement mechanism

The model bill has endorsements from EPIC, Consumer Federation of America, Privacy Rights Clearinghouse, Public Knowledge, CDT, and PIRG. This coalition support signals that privacy advocates are aligned on location data as a priority.

Virginia’s SB 338: What’s in the Bill

Virginia State Senator Russet Perry (D-Fauquier/Loudoun) introduced SB 338 to close what she described as “a major gap in privacy protections.” The bill amends the Virginia Consumer Data Protection Act (VCDPA) to:

Prohibit controllers from selling or offering to sell precise geolocation data
Maintain existing VCDPA enforcement mechanisms through the Attorney General
Align Virginia with the 1,750-foot standard used in Oregon and Maryland

The unanimous passage in Virginia’s House suggests bipartisan consensus on location privacy—a rare occurrence in today’s political environment.

Compliance Timeline and Recommendations

Q1-Q2 2026

Complete location data audits
Identify all third-party data broker relationships
Begin contract renegotiations with location data vendors

Q3-Q4 2026

Implement technical controls for geographic data precision
Deploy updated consent management platforms
Train teams on state-specific requirements

2027 and Beyond

Monitor pending legislation in California, New York, and Illinois
Prepare for potential 50%+ population coverage
Consider adopting strictest-state standards as baseline

The Bottom Line

The precise location data industry as we know it is facing a fundamental restructuring. Virginia’s unanimous vote—following Oregon and Maryland—establishes a clear legislative trend. Companies that built business models on buying and selling precise location data have a narrowing window to pivot.

For compliance professionals, the message is clear: Don’t wait for federal action. The states are moving fast, and the patchwork is becoming a quilt. Organizations that proactively adopt the strictest standards—treating precise location data as essentially non-saleable—will be best positioned as these regulations proliferate.

The 50% threshold isn’t a question of “if” but “when.” Smart money says 2027.

Have questions about location data compliance? Contact our compliance advisory team or explore our state privacy law tracker for the latest updates.