Four States Now Ban Selling Your Customers' Exact Location — Is Yours Next
Four states have independently prohibited selling precise geolocation data within roughly the same window: Virginia (effective July 1, 2026), Connecticut (effective October 1, 2026), Maryland, and Oregon. None of these states coordinated this directly, each passed its own amendment through its own legislature, which makes the pattern more notable, not less. When several states reach the same specific restriction independently, it tends to be an early sign of where the broader legal landscape is heading, not a coincidence.
What "Precise Geolocation" Actually Means Here
These restrictions generally define precise geolocation as information capable of identifying a consumer, their mobile device, or their vehicle within a relatively tight radius, commonly in the range of roughly 1,750 feet or less. This is meaningfully more specific than general location data like a shipping city or state, it's the kind of precise, real-time positioning data collected by mobile apps, certain advertising SDKs, or location-based services.
Why This Matters Even If You Don't Think You Sell Location Data
Many businesses don't directly sell location data as a product, but do share it with third-party advertising or analytics partners in exchange for services, a relationship that can functionally qualify as a sale under these laws' typically broad definition of that term. A business that has never thought of itself as being "in the location data business" can still be affected if any ad network or analytics integration involves sharing this category of data for anything of value in return.
The Pattern Worth Watching
Privacy law trends in the U.S. have repeatedly shown this shape: a handful of states adopt a specific restriction independently, and within a year or two it becomes a standard feature appearing in most new or amended state privacy laws. Sensitive-data opt-in consent followed exactly this pattern a few years ago. Geolocation-specific sale bans appear to be following the same trajectory now.
What to Actually Check
If your store uses any third-party SDK, analytics tool, or advertising integration that could plausibly access precise device or vehicle location, it's worth confirming directly whether that data is being shared in a way that could qualify as a sale under these specific states' laws, rather than assuming general privacy policy language already covers it.
Check Your Exposure Across These States
All information in this article is sourced from the Virginia Consumer Data Protection Act amendment (SB 338), Connecticut Public Act 26-64, and independent legal analysis from Morgan Lewis and Bloomberg Law. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.
Regulens tracks Virginia and Connecticut as part of its ongoing state-by-state privacy coverage.
Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.
Further Reading
Utah's New Tax Has Nothing to Do With Nexus Thresholds — And That's the Point
As of this month, Utah taxes a specific category of digital content at 2%, tied to age-verification requirements. It's a genuinely different kind of obligation than the nexus thresholds most sellers are used to tracking.
California Just Expanded Your Deletion Obligations — Here's the New Scope
A newly signed California law changes what "delete my data" actually requires you to do. The old standard only covered what you collected directly. The new one goes further.