Bill: https://lis.virginia.gov/bill-details/20261/SB338/text/SB338

> Virginia follows Maryland and Oregon in banning the sale of geolocation data. Both Maryland and Oregon more broadly define “sale” to mean the exchange of personal data “for monetary or other valuable consideration.” Virginia joins several other states that have recently proposed legislation with similar bans, including California, Massachusetts, Vermont and Washington State. The legislative activity follows regulatory scrutiny on the sale of geolocation data, including the California Attorney General’s investigation into the location data industry in March 2025, and a 2024 FTC settlement banning a data broker from selling geolocation data.

(i could not find a state legislation tracker regarding this type of legislation, please feel free to drop it in a reply if you find one!)

Note that this article is from April and the ban went into effect July 1.

So, instead you buy a "custom computer", and the data is completely free!

Its like how FLOCK gets around pesky data laws. The devices coat a lot, but the software dashboard access is "Completely free*"

NYTimes article a few years ago on how car insurance companies were using such data. Tracking sudden stoos, driving at night, driving faster than 80 mph, etc.

So let's say a Delaware incorporated company sells location data that happens to be collected in Virginia, but its sold from the corporation with no operations in Virginia. What happens? On the other hand us-east-1 is in Virginia with who knows how many payment processing servers running.

Honestly, it’s wild that selling people’s precise location data was ever treated like a normal business model.

We already know massive data harvesting has happened. Laws like this are just the bare minimum for catching up.

Would be nice if they could bring in laws that would punish these companies out of existence, but I doubt it.

A good start. From 2024: "A company allegedly tracked people’s visits to nearly 600 Planned Parenthood locations across 48 states and provided that data for one of the largest anti-abortion ad campaigns in the nation, according to an investigation" - https://www.politico.com/news/2024/02/13/planned-parenthood-...

I was intrigued, because even a broad location given for an IP address is "geolocation data", but the law says "precise geolocation data" which limits it to device-reported data, I assume.

This is going to spread like wildfire. ("We can do that?")

Great, now you have to ban sharing of it, or banning sale is worthless.

Or rather, only worthwhile as a straw-man you can point to and say "Look, we stopped it!" when you know that's false.

*except sale to the government?

Given the actual informed and uncoerced choice, people say no to this kind of collection and especially its sale or use for any purpose other than the explicit service they thought they were allowing it for (navigation, setting the time, etc etc). This is true for basically all information collected. I'm glad to see there is some minor protection language being included but it needs to have real teeth and get to the point. If you collect data from me under false pretenses or using coercive methods (you can't use the thing you just paid a lot of money for if you say no) you will not only be fined but criminally prosecuted.