Virginia Law Bans Sale of Geolocation Data

Virginia Enacts Sweeping Geolocation Data Ban

Virginia has passed a new law that significantly restricts the sale and transfer of geolocation data, marking a substantial shift in how personal location information can be handled within the state. The legislation, which takes effect January 1, 2025, targets the lucrative market of data brokers who aggregate and sell granular location information, often without explicit user consent for each transaction.

The new law, officially SB 1566 and HB 1632, creates a new definition for "geolocation data" and establishes strict limitations on its "sale." This prohibition applies to entities that collect, process, and sell this data. The intent is to provide consumers with greater control over their most sensitive personal information – their physical movements. This move aligns Virginia with a growing trend of states enacting robust privacy legislation, following in the footsteps of California, Utah, Connecticut, and others, though Virginia’s approach to geolocation data is notably direct.

Under the new statute, a "seller" of geolocation data is defined as a person that knowingly collects, processes, or sells geolocation data. The law explicitly prohibits such sellers from selling geolocation data. This broad definition encompasses many entities that have historically profited from the aggregation and distribution of location information, including app developers, data brokers, and advertising technology companies. The key here is the prohibition on the "sale" of this data, which is interpreted broadly to include sharing for monetary or other valuable consideration.

Defining Geolocation Data and Its Scope

The legislation defines "geolocation data" as any data that is used or intended to be used to identify the approximate or exact physical location of a consumer or device. This includes data derived from GPS, Wi-Fi triangulation, cell tower locations, IP addresses, and any other technological means. The crucial aspect is that this data must be capable of identifying a specific individual or their device.

The law does not create a private right of action, meaning individuals cannot directly sue businesses for violations. Instead, enforcement will be handled by the Virginia Attorney General. This mirrors the enforcement mechanisms in many other state privacy laws, placing the burden of compliance and prosecution on the state's chief legal officer.

However, the law carves out certain exceptions. For instance, it does not apply to data used for purposes such as:

• Detecting or addressing service errors or security incidents.
• Protecting against malicious, fraudulent, or illegal activity.
• Complying with legal obligations.
• Facilitating internal uses that are reasonably aligned with the consumer's expectations or are based on their relationship with the business.
• Processing transactions for goods or services requested by the consumer.

These exceptions are common in privacy legislation and aim to ensure that essential business operations and security measures are not unduly hindered. The critical distinction lies in whether the data transfer is considered a "sale" for commercial gain, rather than a necessary component of service delivery or security.

Implications for Data Brokers and App Developers

The implications for the data brokerage industry are profound. Companies that have built their business models around collecting, processing, and selling detailed location histories will need to significantly alter their operations in Virginia. The ban on "sale" means that simply sharing data with a third party in exchange for compensation, whether monetary or through data reciprocity, is now prohibited. This could force a reassessment of data-sharing agreements and revenue streams.

App developers who collect location data, even if anonymized or aggregated, will need to scrutinize how they monetize this information. If an app shares location data with third parties for advertising, analytics, or other commercial purposes in Virginia, it may fall under the definition of a "seller" and thus be in violation of the law. This necessitates a careful review of SDKs, third-party integrations, and data-sharing policies.

The law also raises questions about the definition of "sale" in the context of the broader digital advertising ecosystem. Many platforms operate on complex data-sharing arrangements that blur the lines between a direct sale and other forms of valuable consideration. Virginia's law appears to cast a wide net, potentially disrupting established advertising technology workflows that rely on granular location signals.

For consumers, the law offers a significant enhancement to their privacy rights concerning a particularly sensitive data category. While many privacy laws focus on consent for data collection and use, Virginia's direct ban on the sale of geolocation data provides a more definitive restriction on the commercialization of this information. This could lead to a reduction in the availability of hyper-targeted advertising based on precise location, and potentially impact the business models of location-based services that rely on data monetization.

The legislative intent is clear: to put a hard stop to the widespread commercial exploitation of Virginians' physical movements. As this law takes effect, businesses operating in or serving Virginia residents must ensure their data handling practices are compliant, paying close attention to the definitions of "seller" and "sale" as interpreted by the Attorney General's office.