Virginia bans sale of precise geolocation data
hunton.com
hunton.com
BRILLIANT
soo, might as well have the proper details be collected and not sellable, than collected/inferred and still sellable
The presence of us-east-1 in Virginia probably will complicate the matter considerably and I'm guessing it's something the courts would need to sort out.
> Virginia follows Maryland and Oregon in banning the sale of geolocation data. Both Maryland and Oregon more broadly define “sale” to mean the exchange of personal data “for monetary or other valuable consideration.” Virginia joins several other states that have recently proposed legislation with similar bans, including California, Massachusetts, Vermont and Washington State. The legislative activity follows regulatory scrutiny on the sale of geolocation data, including the California Attorney General’s investigation into the location data industry in March 2025, and a 2024 FTC settlement banning a data broker from selling geolocation data.
(i could not find a state legislation tracker regarding this type of legislation, please feel free to drop it in a reply if you find one!)
But if you meant the 500ish elected federal officials, most of whom are not Virginians or Marylanders, and so have neither any influence as voters nor as legislators, then... well I'm still not sure what you mean. Privacy laws are good. I don't see a reason to be cynical.
It’s a lot of work but this is what you need to do to guarantee a given (non-zero) level of privacy. It can be done if people are serious about it.
we know every single person that went to Epstein Island from their cellphone geolocation data being sold
absolutely nothing has happened to any of them
* https://www.wired.com/story/jeffrey-epstein-island-visitors-...
This seems weak.
See, peasants, we passed a bill to stop location data selling and the organs of the state called the mainstream media have triangulated and validated that for you; so now you can stop talking about your location data or that you live in a surveillance state that is inherently legitimizing of this fake American government that is a contradiction to the Constitution and the revolution in every single possible way.
Corporate stalking has become so normalised (and provides so many livings) that we are through the other side.
Half a millennium ago they tried to control us by restricting our access to information to control what we think, now they bombard us with it to control what we think.
I actually feel this way very often when talking to some younger people online. I wonder if they really competely lack this skill, or their desire for upvotes online leads to them expressing compassionate, but stupid and dangerous, conclusions.
It’s easy to point fingers at young people and treat them as ignorant/not caring about what matters, but they were born into and grew up in the world we built and continue to build.
Can someone provide a product that loudly says "we will sell your geolocation data" on checkout?
Is it coercion if you simply want the product?
This includes having a discount larger than what your location data is worth. IE: I’ll sell you this car for 50k, o you want it without location tracking that will be 150k.
Putting the semantics aside, Who decides what it is worth and to whom?
Why wouldn't a company sell a car without geodata for what it is worth? Maybe it is worth 150k to them because that is what some people will pay the maximum return price point for that package?
The question isn’t what’s the value of not being tracked, the question is what’s tracking data itself is worth. Here what the company actually makes selling the data puts an actual price on what that data is worth.
If you can make 50$/year selling the data and want to pay someone 40$ to be tracked that’s a reasonable transaction, if you want to charge them 1,000$/year not to be tracked than it’s no longer about what the data itself is worth.
However, If Elon wants your leg as a sex toy, a court won't set a price and force you to sell it.
The point is Elon can’t price Starlink at 1 billion dollars a month then give a 999,999,900 discount if you give up your privacy. At that point the bundle is coercive.
The difference is leveraging something else in the transaction not just payment.
The law seems to recognize that companies coercing someone to give up money using tie-ins may be illegal but is not yet recognizing data as a monetary equivalent. Because it’s not money it’s not regulated.
Isn’t it time that our data be treated as the exchange of value that it is? And the coercion should be something we are protected against?
1. abuse of monopoly power in tie-in sales.
https://www.ftc.gov/advice-guidance/competition-guidance/gui...
2. Freebie marketing
https://en.wikipedia.org/wiki/Razor-and-blades_model
3. RESPA
https://www.investopedia.com/terms/r/real-estate-settlement-...
gating the product on unrelated data access is coercive
Edit: Okay my brain processed the information now, criminal prosecution sounds like slightly more deterrence. (Nobody would do an illegal thing, after all ;)
https://liberationnews.org/pges-rap-sheet-the-criminal-histo...
If the law of the government doesn't catch up, eventually the law of the jungle will. But maybe not in their lifetimes.
As President John Fitzgerald Kennedy said: "Those who make peaceful revolution impossible, make violent revolution inevitable."
We already know massive data harvesting has happened. Laws like this are just the bare minimum for catching up.
Would be nice if they could bring in laws that would punish these companies out of existence, but I doubt it.
If it's more similar to the California law, which just calls all uses of data "selling data" and just ends up muddying the waters without actually imposing any regulations of value on the bad actors in the industry, then that would be a shame.
There is value to actually keeping the meaning of words clear and consistent. I have no issues with Google using its first-party Google Maps data to serve me better recommendations. I have massive issues with AT&T selling aggregated geolocation data that makes it easy to identify individuals to third parties. I hope this is a clear path towards banning the latter without touching the former.
That's corny capitalism. A sibling post that talked about 1750 ft or whatever is just noise.
Third party commercial entities like cell providers are collecting and sharing it out of necessity but I’m guessing not selling it?
But that opens an interesting loop hole it seems where you could open a share agreement and then through other mechanisms recover the fee you’d otherwise charge for.
Provider A wants to sell data to provider B and provider B wants to buy from provider A but they legally can’t. So instead provider A just tucks the cost in some other unrelated contract with provider B with a wink wink, handshake, nod, their “relationship” then just makes them want to share the data at “no charge.” Both know the fees are tucked in other agreements, although only provider A knows the itemized cost, provider B just wonders if the cost of the other package + their friendship handshake sharing of geolocation data is worth that total cost.
To be fair, until money comes into play people tend to be less nefarious about their uses of information and intentions. Not always, but on average.
It is not gathering or using the data that is a problem, it is gathering or sharing it without awareness and consent. To be fair, even sharing/selling it would be fine assuming it happens with awareness and consent. Not buried in some ToS, but active consent.
Until this legal regime changes, we will constantly be playing whack-a-mole with laws like this.
Check before relying on that.
> Exchanging private and personal user data without consent and without users being aware of it
It's like when the internet made it possible to look up the price of good easily how it made it less likely for buyers to be able to lowball people. These price guides may be bad for these buyers, but it provides a more fair deal for these seller.
It doesn’t hurt them, just lets us make better decisions, after all. There does not exist a good reason they’d object!
It’s positive sum from a wealth-weighted utility calculation though. And that’s why it happens.
I wonder why “80 mph” was picked as an arbitrary value. In rural areas of Utah we have 80 mph posted limits and prima facie speed laws. A lot of Utah drivers regularly exceed 80 MPH and I’d argue they do so legally. It’s just a weird number for them to pick.
iirc in CA it's 20mph over the speed limit, or speeds over 80.
The insurance companies probably want to know who to raise rates on.
Interesting to me. I wonder what are they doing right.
Note that they are also looking at night driving, which as far as I know is legal everywhere, but someone who spends a higher percentage of their time driving at night probably is a bigger risk for the insurance company than a similar person who doesn't drive as much at night.
legally and unlikely-to-make-expensive-consequences are separate items that insurance exists to differentiate
why shouldnt people driving on such dangerous roads have to pay higher insurance rates?
Is it just that people are happily allowing every app access to live geoloc data even in background? Is there some edge where "while in use" apps are "in use" during cases you wouldn't think they are? Is it my Samsung watch?
Apps that have access to look for networks can also be used to infer location. E.g., combine multiple known WiFi SSIDs or Bluetooth devices together and you can get a rough location.
Also, most people just hit "accept" for a whole bunch of app permissions and just forget about it. The fact that you even know which apps have which permissions at all means you are almost certainly more careful than the average person, even though you are saying this in the context of a stock Pixel phone.
And, oh yeah, most people have much more invasive Android phone brands than Pixel...cheap phones with a bunch of carrier/advertising partner spyware sell far better than Google's phones. Does Samsung still install the Facebook app by default like they used to? I think it used to be impossible to fully delete, even!
I didn’t know this, but I am glad my State already had this! We do some things right.
> "Precise geolocation data" means information derived from technology, including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet. "Precise geolocation data" does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
https://law.lis.virginia.gov/vacode/title59.1/chapter53/sect...
What exactly does this mean?
My puny brain can't understand why it wouldn't be relevant. Or is it?
Or rather, only worthwhile as a straw-man you can point to and say "Look, we stopped it!" when you know that's false.
That's absolute crap because geolocation data is extremely easy to de-anonymize. I wonder whose phone is at my house 12am-8am everyday, takes more or less the same route through the city, and spends hours in my office everyday. I wonder.
Its like how FLOCK gets around pesky data laws. The devices coat a lot, but the software dashboard access is "Completely free*"
They would make a single sandwich, "serve" it to the patron along with their drink, then immediately take back the sandwich to "serve" it to the next person wanting a drink
0: https://en.wikipedia.org/wiki/2014_Washington,_D.C.,_Initiat...
1: https://mjbizdaily.com/news/district-of-columbia-dc-gifting-...