Virginia bans sale of precise geolocation data
Scope of the Virginia Law
- Bans sale of “precise geolocation data,” defined as location info accurate within 1,750 feet.
- Excludes utility smart meter data and content of communications.
- Went into effect July 1 and follows similar moves in Maryland and Oregon; several other states are considering related laws.
- Some note enforcement is limited to the state Attorney General; individuals cannot sue directly.
Sale vs Sharing and Likely Workarounds
- Many point out the law targets “sale,” not all “sharing,” leaving room for:
- “Free data with paid hardware/service” models.
- Cross-contracting where data is “shared” but costs are hidden in other agreements.
- “Anonymized” or “fuzzy” geolocation that still allows re-identification.
- Commenters expect companies to redefine relationships (e.g., “partners,” “services”) to avoid triggering the definition of “sale.”
Effectiveness of the 1,750 ft Threshold
- Critics argue coarse data is still highly identifying when combined over time (home, work, routines).
- Discussion references k-anonymity and the ease of de-anonymizing movement patterns.
- Some call the law a political gesture that doesn’t truly stop tracking-based harms.
Jurisdiction and Interstate Questions
- Unclear how Virginia will handle out-of-state companies (e.g., Delaware-incorporated data brokers) selling data collected from Virginia residents.
- Speculation that cross-state enforcement would rely on courts, presence in the state, or infrastructure located in Virginia (e.g., data centers).
Privacy, Consent, and Coercion
- Strong theme that geolocation data is highly sensitive and prior unfettered sale was “wild.”
- Debate over whether data should be considered “owned” by collectors or individuals.
- Concerns about:
- Use in insurance pricing, lending, healthcare, and potential redlining.
- “Coercive” consent where access to products/services is tied to surrendering data.
- Some want broader bans on personal data sale nationwide and meaningful criminal liability for abusive practices.
Broader Context and Reactions
- Many see this as a positive, overdue step and hope it “spreads like wildfire.”
- Others think it’s too weak, given extensive existing surveillance (carriers, ALPRs, data brokers) and the law’s loopholes and limited enforcement.