On April 13, 2026, Virginia Governor Abigail Spanberger signed Virginia Senate Bill 338 (“S.B. 338”) to amend Virginia’s Consumer Data Protection Act by prohibiting the sale of consumers’ precise geolocation data without first obtaining their consent. Virginia joins Maryland and Oregon as the only states that have banned the sale of consumers’ precise geolocation data. The law will go into effect on July 1, 2026.
S.B. 338 also includes a requirement for companies that process the sensitive data of children to comply with the federal Children’s Online Privacy Protection Act (“COPPA”) and expressly prohibits the collection of a child’s geolocation data without the express consent of the parent or legal guardian, in accordance with COPPA. If consent is obtained, the bill limits the collection of a child’s precise geolocation data to that which is reasonably necessary to provide online services, products, or features only for the time necessary to provide such services and requires the company to provide a “signal” that is available to the child for the duration of the collection.