Virginia bans sale of geolocation data, effective July 2

As of July 2, 2026, Virginia has enacted a law that bans the sale of geolocation data [Hunton Law Blog]. The statute applies to any entity that collects, stores, or processes location information tied to Virginia residents and requires that such data be used only for purposes that do not involve resale. Violations expose companies to civil penalties and potential injunctive relief.

── What the law does ──

Virginia’s measure is one of the first U.S. statutes to target geolocation data sales directly [Hunton Law Blog]. It codifies the requirement that location data be treated as personally identifiable information, mandating explicit user consent for any secondary use. The law also obliges firms to maintain auditable records of data handling practices and to destroy or anonymize geolocation data that is no longer needed for the original service.

── Why it matters ──

The ban forces location‑service providers to redesign data pipelines, adding consent management and audit trails that were previously optional. It also signals a shift toward state‑level privacy regimes that treat location data with the same rigor as health or financial information. Companies operating across multiple jurisdictions now face a fragmented compliance landscape, where differing state rules may require separate technical and legal responses.

Companies that ignore the new requirement risk enforcement actions that could disrupt service delivery and damage brand reputation. Early adopters that embed consent and data‑minimization controls stand to gain a competitive edge as privacy expectations tighten nationwide.