The editorial argues that every prior US privacy regime (CCPA/CPRA, CPA, CTDPA, original VCDPA) treated precise location as sensitive data requiring opt-in consent, but in practice that consent became a buried onboarding checkbox that legitimized the entire ad-tech supply chain. Virginia's amendment removes consent as a defense entirely, recognizing that no meaningful user choice exists in the current SDK-driven architecture.
Hunton's compliance-focused analysis frames the amendment as going further than any state privacy law to date by banning sale outright rather than conditioning it on consent. Their read positions this as a categorical break from the notice-and-choice model that has defined US privacy law.
The editorial argues that most engineers building consumer apps don't realize their app sells location data because the exfiltration happens through embedded SDKs — MMPs for install attribution, ad SDKs, weather widgets, offline mapping libraries — not through first-party code. Companies like Kochava, X-Mode/Outlogic, Cuebiq, Veraset, and SafeGraph built their entire business on shipping SDKs inside thousands of apps to siphon coordinates, which is exactly the architecture Virginia's ban targets
The editorial highlights that Virginia adopted the industry-standard ~533-meter radius definition of 'precise geolocation,' which is exactly the resolution ad networks need for foot-traffic attribution and that data brokers sell to hedge funds tracking retail visits. This isn't about city-level location — it's about block, building, and floor-level identification, so the ban strikes directly at the economics of location-based advertising and alternative-data trading.
By submitting the Hunton legal analysis to HN with the headline framing 'Virginia bans sale of geolocation data,' the submitter foregrounded the substantive prohibition (not the consent nuance) as the newsworthy development for a technical audience. The 906-point score signals developer-community agreement that the precise-location ban is a meaningful line in the sand.
Virginia's General Assembly passed an amendment to the Virginia Consumer Data Protection Act (VCDPA) that goes further than any state privacy law to date: it doesn't just require consent for selling precise geolocation data — it bans the sale outright. The Hunton privacy blog broke it down for the compliance crowd; the developer audience needs a different read.
The distinction matters. Every other major US privacy regime — California's CCPA/CPRA, Colorado's CPA, Connecticut's CTDPA, and the original VCDPA itself — treats precise location as "sensitive data" and requires opt-in consent to sell it. In practice, that consent is a checkbox buried in an onboarding flow, and the ad-tech supply chain proceeds as normal. Virginia's new law removes the checkbox as a defense: no amount of consent authorizes the sale of precise geolocation to a third party for monetary or other valuable consideration.
The statute defines "precise geolocation" using the industry-standard threshold — a radius of roughly 1,750 feet (about 533 meters) around a device. That's not "which city you're in." That's "which block, which building, which floor of the parking garage." It's the resolution ad networks need for foot-traffic attribution and the resolution data brokers sell to hedge funds tracking retail visits.
Most engineers building consumer apps have no idea their app sells location data. That's not sloppiness — it's the architecture. The location data isn't leaving through your code; it's leaving through the third-party SDKs you shipped with your app. The mobile measurement partner (MMP) you added for install attribution. The ad SDK your growth team wired in. The weather widget. The offline mapping library that phones home with coordinates to "improve accuracy."
Kochava, X-Mode (now Outlogic), Cuebiq, Veraset, SafeGraph — these companies didn't build consumer apps. They built SDKs that shipped inside thousands of consumer apps, siphoning coordinates back to a central warehouse and reselling them to advertisers, hedge funds, insurance underwriters, and, in a handful of well-documented cases, US government agencies. The FTC settled with Kochava in 2024 over precisely this pattern. Virginia just made the resale side of that business illegal within its borders.
The secondary effect is where it gets interesting for platform teams. The law reaches any entity that "processes" the data of a Virginia resident — the standard extraterritorial hook. It doesn't matter that your servers are in Oregon. If a Virginian opens your app and your Firebase Analytics or your AppsFlyer SDK pipes a lat/long back to a broker, that transfer is now a compliance event. The compliance surface has shifted from your terms-of-service page to your `Podfile` and `build.gradle`.
The enforcement mechanism is the Virginia Attorney General, with a 30-day cure period for first violations and civil penalties up to $7,500 per violation after that. There is no private right of action — the VCDPA has never had one, and this amendment preserves that carve-out. That sounds toothless until you count violations per device per day; a single ad SDK making one location call per session across 100,000 Virginia users adds up fast. The AG's office has been staffing up a data-privacy unit since 2023.
Smart practitioners will notice this is not really a Virginia story. It's a template. Maryland passed a similar-in-spirit "data minimization" law that already restricts sensitive-data sale beyond consent. Washington's My Health My Data Act does the same for health-adjacent location signals. Once one state bans the transaction outright, the compliance-cost math for data brokers flips: it's cheaper to stop selling nationwide than to maintain a state-by-state pipeline. That's how the CCPA became de facto federal — not because Congress passed anything, but because Salesforce and Google gave up on running two stacks.
The practical work splits into three buckets, and none of them are legal review.
First, inventory. Pull up your mobile app's dependency list and answer one question for each third-party SDK: does this thing read `CLLocationManager` or `FusedLocationProviderClient`? If yes, does it send that data off-device? The honest answer for most ad, attribution, and weather SDKs is yes, and the SDK vendor's privacy policy is what backs the transfer. When Virginia's ban lands, you own that transfer — the SDK vendor's ToS won't shield you if the coordinates originated in your app.
Second, granularity. The 1,750-foot threshold is a knob you can turn. iOS has offered `CLLocationAccuracy` presets since forever; Android's `Priority.PRIORITY_BALANCED_POWER_ACCURACY` gets you to ~100m, which is still "precise" under the statute, but `PRIORITY_LOW_POWER` yields city-block resolution. If your feature actually needs a ZIP code (weather, regional content), stop requesting GPS. This isn't just compliance hygiene — it's battery-life hygiene your users will notice.
Third, the resale clause. Every SDK contract you signed almost certainly grants the vendor rights to "aggregated or de-identified" data. That language was written before every reversal-of-anonymization paper of the last decade. Under Virginia's law, if the vendor's downstream use includes sale to a broker, and the data can be re-associated with a device or household, you have a problem. Ask your vendor, in writing, whether they sell derived location data. Their answer determines whether you swap them out or draft a data-processing amendment.
The pattern here isn't new. Every SaaS company that got serious about GDPR in 2018 went through the same exercise: catalog the sub-processors, get the DPAs, cut the ones who couldn't sign. The Virginia law is smaller in scope than GDPR but higher in specificity — it names one data type and forbids one transaction. That's easier to audit and harder to hand-wave through.
The over-under on this becoming the pattern in five more states by end of 2027 is well under. Colorado and Connecticut have both been circling data-minimization amendments; Maryland's law already forbids collection of most sensitive data beyond what's "reasonably necessary," which is a stricter standard by a different route. The location-data-broker business model was built on a specific regulatory assumption — that consent-with-a-checkbox would remain sufficient — and that assumption is now demonstrably wrong in at least one state. For app developers, the takeaway is small and boring: audit your SDKs this quarter, before the compliance team makes it a fire drill next quarter.
The article is misleading. The sale of geolocation data can still take place but not for precise locations. The bill prevents the sale of data that can identify you within 1750ft. You can still be tracked just not precisely. i.e. companies will just sell fuzzy geolocation data.
Note that this article is from April and the ban went into effect July 1.
Would love if someone with experience could chime in. I've been reading about the geo data market for over two decades now but still have no real sense of its value. What does this data typically cost? And can you specify particular locations/targeting points, or do you just get whatever&#
Given the actual informed and uncoerced choice, people say no to this kind of collection and especially its sale or use for any purpose other than the explicit service they thought they were allowing it for (navigation, setting the time, etc etc). This is true for basically all information collected
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
So let's say a Delaware incorporated company sells location data that happens to be collected in Virginia, but its sold from the corporation with no operations in Virginia. What happens? On the other hand us-east-1 is in Virginia with who knows how many payment processing servers running.