• by Wendy Davis  @wendyndavis, February 6, 2025

Lawmakers in Virginia's senate this week voted 35-5 to revise the state's privacy statute by outlawing the sale of precise location data -- regardless of whether consumers consent.

The Consumer Data Protection Act (SB 1023), introduced last month by state Senator Russet Perry, now moves to Virginia's House of Delegates.

“Fraudsters and other bad actors can use location data, often aggregated by data brokers, to target vulnerable individuals and otherwise use personal information to cause harm,” Perry said this week on the senate floor.

“Some data brokers sell lists of consumers sorted by location-based characteristics, like rural and barely making it, and credit-crunched city families, which can then be used to target those individuals,” she added.

The Virginia measure defines precise location data as information that can identify someone's location within a 1,750-foot radius.

The proposed law has drawn support from advocacy groups including the Electronic Privacy Information Center and Consumer Reports. 

But the major ad industry groups oppose the bill, arguing in a letter sent this week to state lawmakers that the proposed ban is unnecessary and would "unreasonably restrict the free flow of information that powers the economy and Virginians’ access to helpful resources.”

“Under Virginia law today, upon a consumer’s consent, precise geolocation data may be transferred to provide them benefits, such as coupons or other relevant advertising for products and services close in proximity to them,” the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance say in a letter sent this week to Virginia lawmakers.

They add that the bill “would inhibit Virginia businesses’ ability to provide useful services, including marketing and advertising.”

Virginia defines the sale of data as a transfer in exchange for money -- but excludes transfers to a company that processes data on behalf of app that collected the information.

Given that definition, the new bill apparently would allow an app developer to transfer precise location data it collects with opt-in consent to a service provider, but only for use on behalf of that particular developer. The bill would not allow an app developer to transfer precise location data it collects with consent to programmatic platforms that let companies other than the original collector draw on the data for ads.

The bill's ban on sales of precise location information -- which is similar to a Maryland ban slated to take effect in October -- comes as policymakers are increasingly expressing concern about how location information collected from apps can be used to track people. The Federal Trade Commission, for instance, recently entered into a settlement with Mobilewalla that prohibits the company from collecting or retaining consumer data while participating in online real-time bidding ad auctions -- except in order to participate in the auction.