Virginia bans sale of geolocation data

What did Virginia actually ban?

On 13 April 2026, Virginia Governor Abigail Spanberger signed SB 338, amending the Virginia Consumer Data Protection Act to ban the sale of consumers' precise geolocation data. The ban takes effect on 1 July 2026, making Virginia the third US state to prohibit this, after Maryland and Oregon.

"Precise geolocation" means data accurate enough to pinpoint someone within a 1,750 foot radius, close enough to reveal where they live, work, worship or shop. The law only bans selling this data for money. Companies can still share or sell "fuzzy" location data that is less exact, and the law only applies to firms handling data on 100,000 or more Virginia consumers a year (or 25,000 where over half of revenue comes from selling personal data). Most small businesses, in Virginia or anywhere else, sit outside that threshold entirely.

Does this law apply to my UK business?

Not directly. SB 338 is US state legislation covering companies processing Virginia consumer data at scale, and UK businesses are already governed by UK GDPR, which is stricter on location data than most American state laws. But the direction of travel matters more than the letter of this one law.

As of January 2026, 20 US states now have comprehensive consumer privacy laws in force, after Indiana, Kentucky and Rhode Island's laws started on 1 January 2026. Four states also now require data brokers to register, and California's centralised deletion platform requires registered brokers to honour deletion requests from 1 August 2026. That is a fast, consistent pattern: regulators on both sides of the Atlantic are closing down the trade in location and behavioural data.

Why should a UK small business owner care about a US state law?

Because it signals where every ad platform, data broker and third party tool you rely on is heading. If you depend on rented platforms for visibility, like a Facebook page, a booking marketplace, or a directory listing, you are exposed to decisions made by companies responding to laws like this one, not to your business.

When Facebook, Google or a data broker tightens what location and customer data it can sell or share, any business built on top of that data (retargeting audiences bought from a broker, location based ads sourced from third party data) can lose reach overnight with no warning and no recourse.

What should I actually do about it?

Own your data, don't rent access to it. The businesses least affected by tightening data laws are the ones already collecting and controlling their own customer information directly, rather than depending on a platform's dataset.

• Collect customer contact details yourself, through your own booking system or website form, not only through a third party app.
• Keep your Google Business Profile verified and current. It is first party information you control, not data bought from a broker, and it is not affected by this kind of legislation.
• Audit which tools you use that rely on third party location or audience data (ad retargeting, marketing platforms with "lookalike audiences") and check what happens to that targeting if the underlying data supply shrinks.
• Move customer follow ups (rebooking reminders, review requests) onto systems you own, such as your own database and email or SMS tool, so they cannot be switched off by someone else's policy change.

What is Braynex Services' view on this?

This law is a small, specific rule, but it confirms something we tell every client: rented infrastructure is a liability. A salon we worked with in Leeds went from no online presence to over 40 monthly calls within three weeks, purely from a verified, well optimised Google Business Profile, data it owns and controls directly. Compare that to a nail salon we moved off Fresha, which was costing roughly £1,800 a month in commission, onto its own booking system at £35 a month, saving around £21,000 a year and, just as importantly, keeping its own customer data instead of renting access to it.

Laws like Virginia's will keep arriving, state by state, and eventually in similar forms here. Businesses that already own their website, their bookings and their customer data will barely notice. Businesses that rely on borrowed platforms and borrowed data will keep discovering, too late, that they never really owned their customer relationships at all.

If you are not sure how exposed your business is, book a free audit at braynexservices.com and we will show you exactly where you are renting instead of owning, and what it is costing you.