On April 13, 2026, Virginia Governor Abigail Spanberger signed SB338 into law, amending Virginia’s Consumer Data Protection Act (VCDPA) to prohibit controllers of personal data from selling consumers’ precise geolocation data. This ban, which takes effect on July 1, 2026, makes Virginia the third state in recent years to prohibit the sale of such data and reflects a trend that is likely to continue. Somewhat surprisingly, Virginia was the second state, behind California, to enact a comprehensive consumer privacy law and is continuing within that vein with this early expansion of privacy rights.

The VCDPA defines “precise geolocation data” as information derived from technology that directly identifies the specific location of a person within a radius of 1,750 feet. The law prohibits the sale or offering for sale of such data by the controller to a third party. Maryland and Oregon have enacted similar prohibitions. However, unlike Virginia, Maryland and Oregon define “sale” in broader fashion to include disclosures of personal data in exchange for money or “other valuable consideration,” whereas Virginia’s definition of sale is limited to disclosures of personal data for “monetary consideration.”

Federal Agency Action – An Early Predictor

Increased scrutiny over the processing of consumer geolocation data has been driven, in part, by federal enforcement activity. Most recently, in May 2024, the Federal Trade Commission (FTC) reached a settlement with InMarket Media, which prohibited InMarket from selling or licensing sensitive location data, meaning data that can link an individual to a specific sensitive location, including sexual and reproductive health providers, religious organizations, labor union offices, locations predominantly providing services to LGBTQ+ individuals, locations predominantly providing services to specific racial or ethnic groups, and locations of public gatherings of individuals during political or social demonstrations, marches, and protests. Notably, while the FTC has focused on sensitive location data in its enforcement, states have sought to more broadly regulate location data; Virginia, Maryland, and Oregon prohibit the sale of precise geolocation data generally, regardless of proximity to a sensitive location.

Regulatory Scrutiny of Geolocation Data Not Limited to Virginia, Maryland, and Oregon

Even in states that have not yet prohibited the sale of precise geolocation data, regulators are increasing enforcement using location-agnostic laws. In March 2025, California Attorney General Rob Bonta announced “an ongoing investigative sweep into the location data industry” and reminded consumers of their rights under the California Consumer Privacy Act to opt out of the sale or sharing of their personal information. State attorneys general also will turn to general consumer privacy and Unfair and Deceptive Acts and Practices (UDAP) laws to pursue investigations where they believe a company’s privacy policy or other consumer-facing disclosures do not accurately reflect its collection, use, or disclosure of precise geolocation data. At the same time, multiple states, including Massachusetts and Connecticut, are considering similar legislation that would restrict or ban the sale of precise geolocation data.

Given increased regulatory scrutiny, companies should consider the following risk mitigating actions:

• Evaluate location data collection anduse. Assess what categories of location data are collected (e.g., Wi-Fi network data, IP addresses, GPS signals), whether those data elements, alone or in combination with other data, can be used to determine a consumer’s precise location, and the business purposes for which they are used.
• Assess the necessity and scope of precise geolocation data. Consider whether collecting precise geolocation data is necessary for the stated business purposes and whether data minimization principles are being applied to its collection and use.
• Confirm availability and operation of opt-out/consent mechanisms. In states that require consent to collect sensitive personal data or provide opt-out rights, confirm that consent processes and opt-out mechanisms are applied to precise geolocation data where required.
• Strengthen governance and documentation. Review and, as necessary, update internal policies, data maps, and data protection impact assessments to document how precise geolocation data is collected, used, disclosed, sold, and retained. External privacy disclosures should align with internal documentation.
• Monitor legal and regulatory developments. Track emerging state legislation and attorney general enforcement activity related to geolocation data to adjust practices and disclosures as requirements and expectations evolve.

In addition to the above actions, businesses must generally implement decision-making processes that involve all leadership and stakeholders, including competent outside counsel, to further mitigate privacy-related regulatory risk. As usual, Troutman will continue to monitor related developments and provide updates as warranted.

Troutman Pepper Locke State Attorneys General Team

	Ashley Taylor – Co-leader and Firm Vice Chair Ashley is co-leader of the firm’s nationally ranked State Attorneys General practice, vice chair of the firm, and a partner in its Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. He helps his clients navigate the complexities involved with multistate attorneys general investigations and enforcement actions, federal agency actions, and accompanying litigation.
	Clay Friedman – Co-leader Clay co-leads the firm’s State Attorneys General practice and is nationally ranked by Chambers USA for AG Government Relations and in Best Lawyers for Advertising Law. He has dedicated his entire career to state attorney general and federal work, serving for nearly a decade in a senior role and more than 25+ years in private practice. Clay focuses his practice on helping industry-leading companies mitigate the risks associated with state and federal regulatory investigations and associated litigation.
	Chris Carlson Chris advises clients on regulatory, civil, and criminal investigations and litigation. With a background as an assistant attorney general, he provides practical guidance to clients with matters involving state attorneys general and federal regulatory agencies.
	Lauren Fincher Lauren has vast experience handling state attorneys general investigations, navigating complex regulatory compliance matters, and providing strategic counsel in enforcement actions across various industries. She helps clients manage high-stakes regulatory matters and guides them through complex legal landscapes.
	Stephen Piepgrass Stephen leads the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, representing clients in single and multistate enforcement actions, including inquiries and investigations, as well as litigation involving state attorneys general and other state and federal governmental enforcement bodies. He has significant experience handling actions with federal agencies, including the CFPB and FTC, as well as single plaintiff and class action litigation for clients in highly regulated sectors such as financial services, health care, pharmaceutical, and education.
	Michael Yaghi Mike handles high-profile state attorneys general, FTC, and CFPB investigations by advising clients through these complex government inquiries. He assists clients through the entire life cycle of investigations, from regulatory enforcement through formal litigation.
	Matthew J. Berns Drawing on his experience in senior leadership roles in the New Jersey Attorney General’s and Governor’s Offices and as a trial attorney for the U.S. Department of Justice, Matt provides an insider’s perspective when guiding clients through complex government investigations, litigation, and other actions.
	Samuel E. “Gene” Fishel Gene is a former regulator with two decades of experience who has overseen state privacy and cybersecurity regulation enforcement, led national, multistate attorneys general privacy investigations, and prosecuted computer crimes at the state and federal levels. He has served at the forefront of state attorney general and federal enforcement, and utilizes this experience to proficiently represent client interests.
	Jeff Johnson Jeff helps clients navigate complex regulatory and litigation challenges with local, state, and federal authorities. His clients benefit from his decade of broad litigation experience, understanding of emerging state and federal regulatory issues, and strong relationships with attorneys general across the U.S. In addition to handling cases from trial through state or federal appeals, Jeff serves as amicus counsel in advancing legal rules to support his clients’ vital interests.
	Jay Myers Jay assists clients in heavily regulated industries, including health care, energy, insurance, emerging industries, and data privacy. He provides both regulatory legal advice and government relations strategies. Jay’s past and current clients include Fortune 10 companies, startups, nonprofits, industry associations, and advocacy groups. Recognizing that state government matters are often complex and multifaceted, he utilizes regulatory guidance, government advocacy, or both in tandem to deliver tailored solutions for each client’s unique needs.
	Zoe Schloss Zoe represents clients in litigation and government investigations. As former deputy attorney general for the Delaware Department of Justice, she is an experienced litigator who understands the enforcement priorities that impact her clients. Zoe works with individuals and corporate entities in highly regulated industries, including financial services, health care, and energy.
	Jessica Birdsong Jessica is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, magna cum laude, where she served as associate articles editor of the Journal of Law & Technology.
	Nick Gouverneur Nick is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. He received his J.D. from the University of Illinois College of Law, where he served as a member of the Journal of Law, Technology & Policy.
	Troy Homesley Troy is an accomplished litigator who has represented and defended clients across a wide range of complex, high-stakes disputes at both the trial and appellate levels. He has represented technology companies, business executives, law firms, investment funds, high-ranking federal officials, international non-profits, and asylum seekers. Troy draws on his broad litigation experience to advise clients before litigation arises, while claims are pending or threatened, and leading up to and through trial and appeals.
	Namrata Kang Namrata (Nam) is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, based in the Washington, D.C. office. She routinely advises clients on a wide variety of state and federal regulatory matters, with a particular emphasis on state consumer protection laws relating to consumer financial services and marketing and advertising. Nam’s experience transcends multiple industries, including financial services, telecommunications, media, and sports betting.
	Michael Lafleur Michael is an associate in the firm’s Regulatory Investigations, Strategy, and Enforcement Practice Group. Based out of the firm’s Boston office, Mike has deep experience in litigation, investigations, and other regulatory matters involving state-level regulators and state attorneys general.
	William LaRosa Bill represents clients in complex regulatory investigations, state attorneys general matters, and enforcement proceedings, drawing on his experience as a former assistant U.S. attorney and private sector litigator in high stakes, multistate AG and regulatory matters.
	Philip Nickerson Philip represents clients in sectors such as financial, tech, real estate, and energy in a range of litigation matters. He is experienced in matters involving trade secrets, government investigations, commercial contracts, construction and product defect.
	Lane Page Lane specializes in federal and state regulatory investigations and complex civil litigation. He focuses on representing financial institutions and other businesses, with a particular emphasis on consumer protection and fair lending issues.
	Dascher Pasco Dascher is an attorney within the Regulatory Investigations, Strategy, and Enforcement practice, based in the Richmond office. She joined our firm after working in personal injury and medical malpractice for a Virginia trial law firm. Dascher brings varied legal experience to the firm with strong litigation and regulatory strategy capabilities.
	Kyara Rivera Rivera Kyara is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, cum laude, where she served as publications and online editor of the Public Interest Law Review.
	Timothy Shyu Timothy is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group.
	Trey Smith Trey focuses his practice on representing and advising regulated utilities before state public utility commissions. He routinely helps clients obtain certificates of public convenience and necessity for transmission infrastructure. In this role, Trey works with his clients’ subject-matter experts to manage administrative proceedings, including by preparing initial filings; responding to discovery requests; drafting rebuttal testimony; and litigating any disputed issues.
	Daniel Waltz Dan helps clients navigate all aspects highly regulated relationships between industry participants and federal, state and local governments. Whether engaging with regulators, negotiating transactions or representing clients in the courtroom, he delivers solutions that help his clients achieve their strategic goals.
	Stephanie Kozol Stephanie is Troutman Pepper Locke’s senior government relations manager in the state attorneys general department.