The firm's privacy blog frames HB 2724 as a categorical prohibition — no consent workaround, no legitimate-interest balancing — that aligns Virginia's 1,750-foot threshold with California's CPRA and Colorado's CPA, making it the emerging US standard. They emphasize the broad 'monetary or other valuable consideration' definition of sale as the mechanism that kills the common ad-tech dodge of trading location data for measurement or attribution services.
Argues the operative word is 'sale' as defined broadly to include any exchange for 'other valuable consideration,' which torpedoes the standard workaround of characterizing data transfers as service exchanges. Warns mobile developers that attribution SDKs sending lat/lng to third parties are directly in scope and that the AG's $7,500-per-violation authority will make enforcement sweeps costly.
Highlights the January 1, 2027 effective date as a practical deadline for the mobile ecosystem to audit SDKs, renegotiate attribution and measurement contracts, and strip precise lat/lng from data-sharing pipelines aimed at Virginia users. Notes that with no private right of action, the risk vector is concentrated in AG-led sweeps where 'per violation' has historically been read as per-consumer, per-transaction — a multiplier that turns even modest data flows into six- and seven-figure exposure.
By surfacing the Hunton legal analysis to the HN front page with 817 points, the submitter signals that the developer community should treat this as an operationally urgent compliance matter rather than a distant policy story. The choice of a law-firm advisory as the canonical link frames the story around what builders need to do, not the political process that produced the bill.
On July 1, Virginia's HB 2724 — quietly signed by Governor Youngkin in the spring session — took its place in the amended Virginia Consumer Data Protection Act (VCDPA). Buried in the bill is a flat prohibition: no controller or processor may sell a Virginia consumer's precise geolocation data, period. Not with consent, not with a disclosure, not with a legitimate-interest balancing test. Sale is off the table.
The statutory definition is the part every mobile developer needs to memorize. "Precise geolocation data" means information derived from technology, including GPS-level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with an accuracy of a radius of 1,750 feet or less. That 1,750-foot number (roughly 533 meters, or a third of a mile) is the same threshold California adopted in the CPRA and Colorado adopted in the CPA — Virginia is aligning to what is quickly becoming the de facto US standard rather than inventing a new one.
Enforcement lives with the Virginia Attorney General. Under the existing VCDPA framework, violations carry civil penalties of up to $7,500 per violation, plus recovery of reasonable expenses and attorney fees. There is no private right of action — you will not be sued by a class of Virginians — but the AG can and will bring enforcement sweeps, and "per violation" has historically been read as per-consumer, per-transaction. The effective date is January 1, 2027, giving the ecosystem roughly 18 months to unwind existing data-sharing contracts.
The interesting word in the statute is *sale*. Virginia, like California, defines it broadly: any exchange of personal data for monetary or other valuable consideration. That "other valuable consideration" clause is what kills the standard ad-tech workaround of "we don't sell data, we exchange it for measurement services." If your attribution SDK sends lat/lng to a third party and you receive install-attribution data back, Virginia's AG has a plausible argument that this is a sale — regardless of whether money changed hands.
Contrast this with what came before. The original VCDPA (effective January 2023) treated precise geolocation as "sensitive data," which required opt-in consent before processing. That was a checkbox problem — annoying, but solvable with a consent-management platform. HB 2724 upgrades it to a prohibition on one specific downstream use, which is a fundamentally different engineering problem. You can't consent your way out of it. The pipeline itself has to change.
The direct casualties are the location data brokers whose entire business model is aggregating and reselling movement patterns — SafeGraph, Veraset, Placer.ai, and the smaller shops that quietly power everything from real-estate analytics to defense contracting. Reuters and Motherboard have spent five years documenting how a Muslim prayer app's location SDK ended up in the hands of US Special Operations Command via a chain of intermediaries. Virginia just cut one node out of that graph. This is the first US state law that targets not the collection of location data but its trade — a distinction the FTC has been fighting for in individual cases since the Kochava consent decree, but never won at the statutory level.
The indirect casualties are more interesting for practitioners. Any SDK that sends precise coordinates off-device and provides value in return is now in scope. Attribution: AppsFlyer, Adjust, Branch, Kochava (yes, that Kochava). Analytics with location dimensions turned on: Firebase Analytics, Amplitude, Mixpanel, Segment. Marketing automation and geo-fenced push: Braze, Airship, OneSignal, Iterable. Ad networks that use location for targeting: Meta Audience Network, AppLovin, Unity Ads. None of these are inherently unlawful, but each vendor's DPA needs a Virginia-specific rider that clarifies (a) whether they act as processor or third-party recipient, and (b) whether the return value from their pipeline constitutes "other valuable consideration."
Community reaction on the Hacker News thread (817 points at time of writing) split along predictable lines. Privacy engineers pointed out the 1,750-foot threshold is trivially defeated by cell-tower triangulation, which returns coordinates at roughly that same accuracy — meaning the definition may sweep in data sources developers don't think of as "GPS." Ad-tech engineers pointed out, correctly, that most attribution vendors already have California-and-Colorado-compliant modes that can be flipped on for Virginia with a config change. Both are right. The bill closes a loophole and creates a compliance line item; it does not restructure the industry overnight.
Start with a data-flow audit, not a legal review. Grep your mobile codebases for `CoreLocation`, `LocationManager`, `fused_location_provider`, and every SDK's initialization call. For each hit, answer three questions: (1) does this data leave the device at precision finer than 1,750 feet, (2) does it flow to a party that provides valuable consideration in return, and (3) is that party contractually a processor acting on your instructions or an independent controller. If the answer to (3) is "we don't know," that's your first fix.
Second, coarsen by default. Rounding coordinates to three decimal places (~110 meters) still exceeds Virginia's 1,750-foot threshold; four decimal places (~11 meters) does not — so "lower precision" is not a get-out-of-jail-free card, only "don't send lat/lng at all" is. Consider whether your feature actually needs geolocation or just city/region — most marketing and analytics use cases work fine with a resolved region code, which is explicitly outside the definition. Firebase's "approximate" location mode and iOS's `.reducedAccuracy` request are your friends.
Third, get the contracts right. Every DPA with a vendor that touches location needs a Virginia amendment by Q4 2026 at the latest. The specific language you want is a representation that the vendor processes the data solely on your documented instructions and does not use it for its own commercial purposes — that's the standard processor-vs-controller distinction, and it's what pulls the transaction out of the "sale" definition. If a vendor won't sign that language, they've told you their business model, and you have your answer.
Virginia is the fifth state to move in this direction (California, Colorado, Connecticut, and Maryland have variations), but it's the first to reach for an outright sale ban rather than a consent regime. Washington's My Health My Data Act already did something similar for health-adjacent location. Expect Texas, New Jersey, and Oregon to copy the sale-ban structure verbatim in their 2027 sessions — the interstate compliance calculus at that point pushes national SDK vendors to just turn the feature off everywhere rather than maintain 15 state-specific pipelines. The path of least resistance for the ad-tech industry is a federal preemption bill, which is precisely why one has been stalled in committee for three straight Congresses. Until then, the compliance date on your calendar is January 1, 2027 — and if your app is still shipping raw GPS to a third party on that date, you are the test case.
The article is misleading. The sale of geolocation data can still take place but not for precise locations. The bill prevents the sale of data that can identify you within 1750ft. You can still be tracked just not precisely. i.e. companies will just sell fuzzy geolocation data.
Note that this article is from April and the ban went into effect July 1.
Would love if someone with experience could chime in. I've been reading about the geo data market for over two decades now but still have no real sense of its value. What does this data typically cost? And can you specify particular locations/targeting points, or do you just get whatever&#
Given the actual informed and uncoerced choice, people say no to this kind of collection and especially its sale or use for any purpose other than the explicit service they thought they were allowing it for (navigation, setting the time, etc etc). This is true for basically all information collected
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
So let's say a Delaware incorporated company sells location data that happens to be collected in Virginia, but its sold from the corporation with no operations in Virginia. What happens? On the other hand us-east-1 is in Virginia with who knows how many payment processing servers running.