- So let's say a Delaware incorporated company sells location data that happens to be collected in Virginia, but its sold from the corporation with no operations in Virginia. What happens? On the other hand us-east-1 is in Virginia with who knows how many payment processing servers running.
- The article is misleading. The sale of geolocation data can still take place but not for precise locations. The bill prevents the sale of data that can identify you within 1750ft. You can still be tracked just not precisely. i.e. companies will just sell fuzzy geolocation data.
by toomuchtodo
2 subcomments
- Bill: https://lis.virginia.gov/bill-details/20261/SB338/text/SB338
> Virginia follows Maryland and Oregon in banning the sale of geolocation data. Both Maryland and Oregon more broadly define “sale” to mean the exchange of personal data “for monetary or other valuable consideration.” Virginia joins several other states that have recently proposed legislation with similar bans, including California, Massachusetts, Vermont and Washington State. The legislative activity follows regulatory scrutiny on the sale of geolocation data, including the California Attorney General’s investigation into the location data industry in March 2025, and a 2024 FTC settlement banning a data broker from selling geolocation data.
(i could not find a state legislation tracker regarding this type of legislation, please feel free to drop it in a reply if you find one!)
- Note that this article is from April and the ban went into effect July 1.
- Would love if someone with experience could chime in. I've been reading about the geo data market for over two decades now but still have no real sense of its value. What does this data typically cost? And can you specify particular locations/targeting points, or do you just get whatever's available in a broader dataset?
- Given the actual informed and uncoerced choice, people say no to this kind of collection and especially its sale or use for any purpose other than the explicit service they thought they were allowing it for (navigation, setting the time, etc etc). This is true for basically all information collected. I'm glad to see there is some minor protection language being included but it needs to have real teeth and get to the point. If you collect data from me under false pretenses or using coercive methods (you can't use the thing you just paid a lot of money for if you say no) you will not only be fined but criminally prosecuted.
- As long as this is actually about "sale" of data and actually imposes strict limits on data brokers and all the nefarious actors out there, I am all for it.
If it's more similar to the California law, which just calls all uses of data "selling data" and just ends up muddying the waters without actually imposing any regulations of value on the bad actors in the industry, then that would be a shame.
There is value to actually keeping the meaning of words clear and consistent. I have no issues with Google using its first-party Google Maps data to serve me better recommendations. I have massive issues with AT&T selling aggregated geolocation data that makes it easy to identify individuals to third parties. I hope this is a clear path towards banning the latter without touching the former.
- Honestly, it’s wild that selling people’s precise location data was ever treated like a normal business model.
We already know massive data harvesting has happened. Laws like this are just the bare minimum for catching up.
Would be nice if they could bring in laws that would punish these companies out of existence, but I doubt it.
- What is the rationale for going to the trouble of such a law but only banning sale, rather than all sharing?
- NYTimes article a few years ago on how car insurance companies were using such data. Tracking sudden stoos, driving at night, driving faster than 80 mph, etc.
by danielrmay
2 subcomments
- A good start. From 2024: "A company allegedly tracked people’s visits to nearly 600 Planned Parenthood locations across 48 states and provided that data for one of the largest anti-abortion ad campaigns in the nation, according to an investigation" - https://www.politico.com/news/2024/02/13/planned-parenthood-...
- As someone who works in a space where we buy ads, I love things like this. Data points like this just shouldn't be on the table for sale. Just makes sure that we don't depend on best intentions alone to make sure we protect people. A step in the right direction.
by petercooper
2 subcomments
- I was intrigued, because even a broad location given for an IP address is "geolocation data", but the law says "precise geolocation data" which limits it to device-reported data, I assume.
by smalltorch
0 subcomment
- So, what sort of gymnastics do alpr companies need to play to defend their activities don't break this new ban?
My puny brain can't understand why it wouldn't be relevant. Or is it?
- Is that just point of sale geolocation data, vendor location, or…datacenter location facilitating the transaction
- Have any other states banned the sale of geolocation data?
by heroprotagonist
0 subcomment
- Great, now you have to ban sharing of it, or banning sale is worthless.
Or rather, only worthwhile as a straw-man you can point to and say "Look, we stopped it!" when you know that's false.
- Why not make selling any personal data illegal in the entire country?
by pineapple_opus
1 subcomments
- I am intrigued as an outsider, that state in US can have much stronger authority to restrict sale of such personal data.
- I didn't read the law but the article referred to it as "personal data". It's important to note that Big Tech believes it can "anonymize" fine-grained location data but just stripping PII and assigning a semi-stable random ID. They'll then argue this law doesn't apply because of that.
That's absolute crap because geolocation data is extremely easy to de-anonymize. I wonder whose phone is at my house 12am-8am everyday, takes more or less the same route through the city, and spends hours in my office everyday. I wonder.
- That's a step into the right direction. I can only imagine how much pain has been inflicted with metadata.
by CodeByBryant
0 subcomment
- This is an actually great move.
- This is going to spread like wildfire. ("We can do that?")
- I cant wait for the feds to sue them for.. something
- What a coincidence that northern Virginia is spy central.
by shevy-java
0 subcomment
- They are a bit confused in the USA. For instance, flock
cameras are used as mass spying tool. That also yields
geolocation data. And also bypasses (parts of) the
amendment. There is a lack of consistency here.
- “ Virginia follows Maryland and Oregon in banning the sale of geolocation data. Both Maryland and Oregon more broadly define “sale” to mean the exchange of personal data “for monetary or other valuable consideration.”
I didn’t know this, but I am glad my State already had this! We do some things right.
- As someone who frequently travels to Virginia, this is great news.
- What I find confusing is that I know an infinite plethora of companies have geolocation data in everyone.... But I look at my fairly-stock Pixel phone and the only things with background geolocation permissions are Google apps, and I know google famously hoards that data like a dragon.
Is it just that people are happily allowing every app access to live geoloc data even in background? Is there some edge where "while in use" apps are "in use" during cases you wouldn't think they are? Is it my Samsung watch?
by throwaway85825
0 subcomment
- *except sale to the government?
by arcticbison
0 subcomment
- [dead]
- [flagged]
- [flagged]
- So, instead you buy a "custom computer", and the data is completely free!
Its like how FLOCK gets around pesky data laws. The devices coat a lot, but the software dashboard access is "Completely free*"
Hacker News