Virginia bans sale of precise geolocation data
Virginia has enacted a law banning the sale of “precise geolocation data,” joining Maryland and Oregon and inspiring interest in similar measures elsewhere. Commenters explore how the law defines “precise” (within 1,750 feet), what counts as a “sale,” and how companies might evade it through data sharing, fuzzy location data, or complex contractual arrangements. Many see the move as an overdue but limited step toward addressing pervasive, largely opaque location tracking used for advertising, insurance, political targeting, and potential abuses around healthcare and surveillance.
Scope of the Virginia Law
- Bans sale of “precise geolocation data,” defined as location info accurate within 1,750 feet.
- Excludes utility smart meter data and content of communications.
- Went into effect July 1 and follows similar moves in Maryland and Oregon; several other states are considering related laws.
- Some note enforcement is limited to the state Attorney General; individuals cannot sue directly.
Sale vs Sharing and Likely Workarounds
- Many point out the law targets “sale,” not all “sharing,” leaving room for:
- “Free data with paid hardware/service” models.
- Cross-contracting where data is “shared” but costs are hidden in other agreements.
- “Anonymized” or “fuzzy” geolocation that still allows re-identification.
- Commenters expect companies to redefine relationships (e.g., “partners,” “services”) to avoid triggering the definition of “sale.”
Effectiveness of the 1,750 ft Threshold
- Critics argue coarse data is still highly identifying when combined over time (home, work, routines).
- Discussion references k-anonymity and the ease of de-anonymizing movement patterns.
- Some call the law a political gesture that doesn’t truly stop tracking-based harms.
Jurisdiction and Interstate Questions
- Unclear how Virginia will handle out-of-state companies (e.g., Delaware-incorporated data brokers) selling data collected from Virginia residents.
- Speculation that cross-state enforcement would rely on courts, presence in the state, or infrastructure located in Virginia (e.g., data centers).
Privacy, Consent, and Coercion
- Strong theme that geolocation data is highly sensitive and prior unfettered sale was “wild.”
- Debate over whether data should be considered “owned” by collectors or individuals.
- Concerns about:
- Use in insurance pricing, lending, healthcare, and potential redlining.
- “Coercive” consent where access to products/services is tied to surrendering data.
- Some want broader bans on personal data sale nationwide and meaningful criminal liability for abusive practices.
Broader Context and Reactions
- Many see this as a positive, overdue step and hope it “spreads like wildfire.”
- Others think it’s too weak, given extensive existing surveillance (carriers, ALPRs, data brokers) and the law’s loopholes and limited enforcement.