5 ms·
Virginia bans sale of precise geolocation data
https://lis.virginia.gov/bill-details/20261/SB338/text/SB338 https://lis.virginia.gov/bill-details/20261/SB338/text/SB338
- toomuchtodo 4mo agoBill: https://lis.virginia.gov/bill-details/20261/SB338/text/SB338 https://lis.virginia.gov/bill-details/20261/SB338/text/SB338 > Virginia follows Maryland and Oregon in banning the sale of geolocation data. Both Maryland and Oregon more broadly define “sale” to mean the exchange of personal data “for monetary or other valuable consideration.” Virginia joins several other states that have recently proposed legislation with similar bans, including California, Massachusetts, Vermont and Washington State. The legislative activity follows regulatory scrutiny on the sale of geolocation data, including the California Attorney General’s investigation into the location data industry in March 2025, and a 2024 FTC settlement banning a data broker from selling geolocation data. (i could not find a state legislation tracker regarding this type of legislation, please feel free to drop it in a reply if you find one!)
- kevin_thibedeau 4mo agoFunny how two states with a large number of elected officials living in them opt for privacy first.
- deleted 4mo ago[deleted]
- cvoss 4mo agoIn fact, most states have a large number of elected officials in them, especially those elected officials who hold the legislative power of that state. But if you meant the 500ish elected federal officials, most of whom are not Virginians or Marylanders, and so have neither any influence as voters nor as legislators, then... well I'm still not sure what you mean. Privacy laws are good. I don't see a reason to be cynical.
- hoppyhoppy2 4mo agohttps://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/ https://law.lis.virginia.gov/vacode/title59.1/chapter53/sect...
- janalsncm 4mo agoNote that this article is from April and the ban went into effect July 1.
- nekusar 4mo agoSo, instead you buy a "custom computer", and the data is completely free! Its like how FLOCK gets around pesky data laws. The devices coat a lot, but the software dashboard access is "Completely free*"
- fastball 4mo agoIs that what Flock does?
- blitzar 4mo agoI for one am glad to hear they have some standards over there and refuse to profit from exploiting peoples private information.
- hydrogen7800 4mo agoI can't find it so it's probably just a myth, but I recall hearing about "free beer with purchase of food" at bars during prohibition. However, I think it was more than just the sale that was prohibited.
- colechristensen 4mo agoI've been to bars that required you to buy a bowl of popcorn or some such in order to abide by their restrictive liquor license which only allowed sale with food.
- VBprogrammer 4mo agoI used to regularly go to a comedy show on the site of an old brewery in Wandsworth. The comedy cost £20 but the beer was free. Apparently the site was the oldest continuous used brewery in Europe and the head brewer decided to keep the record going after the site was sold to a property development company. However, there was a prohibition against competition and licensing issues meaning they couldn't charge for beer.
- Cycl0ps 4mo agoRaines Law in that late 1800s put restrictions on the sale of alcohol in NY on Sundays. Bartenders used a loophole of the drinks being served with a meal to get around it. They would make a single sandwich, "serve" it to the patron along with their drink, then immediately take back the sandwich to "serve" it to the next person wanting a drink https://www.atlasobscura.com/articles/raines-sandwich https://www.atlasobscura.com/articles/raines-sandwich
- peter303 4mo agoNYTimes article a few years ago on how car insurance companies were using such data. Tracking sudden stoos, driving at night, driving faster than 80 mph, etc.
- baranul 4mo agoExactly. Exchanging private and personal user data without consent and without users being aware of it, for their profits.
- thephyber 4mo agoIt’s important to understand that in the USA, data is owned by the collector (eg. The app or SaaS who generated it), not the person who is described by it. Until this legal regime changes, we will constantly be playing whack-a-mole with laws like this.
- Hikikomori 4mo agoThat sounds like something Europeans would do, so it's anti american.
- dotancohen 4mo agoIn Europe, who owns the copyright of a photograph? The subject or the photographer?
- Hikikomori 4mo agoIf a company writes down my personal information do they now own it?
- dotancohen 4mo agoI believe that the Bern convention stipulates that they now own that particular expression (e.g. formatting) of your personal information. Check before relying on that.
- dv_dt 4mo agoSo let's say a Delaware incorporated company sells location data that happens to be collected in Virginia, but its sold from the corporation with no operations in Virginia. What happens? On the other hand us-east-1 is in Virginia with who knows how many payment processing servers running.
- b40d-48b2-979e 4mo agoThe same thing that happens in court cases across state lines. It goes to one of the jurisdictions in a lawsuit unless it qualifies for diversity jurisdiction and goes to a federal court.
- piker 4mo agoOkay I tend to agree with the CivPro analysis here, but the parent was probably more concerned with the result on the merits.
- thephyber 4mo agoMost likely the vendor will make a judgement call about whether they care to comply. If they do want to comply, they will likely exempt all Virginia data from the collected data set and contractually require and downstream user to indemnify them if a Virginia person is affected by their data set.
- HoldOnAMinute 4mo agoSo, they are collecting geolocation data to avoid selling geolocation data. BRILLIANT
- 8note 4mo agofrom the Youtube kids business, its pretty clear that even when they pretend to not know the details of whos being targeted, they still do, and sell targeted data as such soo, might as well have the proper details be collected and not sellable, than collected/inferred and still sellable
- raychis 4mo agoHonestly, it’s wild that selling people’s precise location data was ever treated like a normal business model. We already know massive data harvesting has happened. Laws like this are just the bare minimum for catching up. Would be nice if they could bring in laws that would punish these companies out of existence, but I doubt it.
- danielrmay 4mo agoA good start. From 2024: "A company allegedly tracked people’s visits to nearly 600 Planned Parenthood locations across 48 states and provided that data for one of the largest anti-abortion ad campaigns in the nation, according to an investigation" - https://www.politico.com/news/2024/02/13/planned-parenthood-location-track-abortion-ads-00141172 https://www.politico.com/news/2024/02/13/planned-parenthood-...
- giantg2 4mo agoAnd that's pretty much the most benign use case too.
- deleted 4mo ago[deleted]
- lelandfe 4mo agoIt gets so awful. Here's one of the worst I remember, 2019: https://www.nbcnews.com/news/us-news/missouri-health-director-tracked-menstrual-periods-planned-parenthood-patients-n1073701 https://www.nbcnews.com/news/us-news/missouri-health-directo...
- petercooper 4mo agoI was intrigued, because even a broad location given for an IP address is "geolocation data", but the law says "precise geolocation data" which limits it to device-reported data, I assume.
- mathgeek 4mo agoIt likely fits the definition of precise location data that you can configure on mobile settings (it's a finer grained option you can enable when sharing your location).
- kube-system 4mo agoLaws typically define terms like this, and this law is no exception. > "Precise geolocation data" means information derived from technology, including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet. "Precise geolocation data" does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility. https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/ https://law.lis.virginia.gov/vacode/title59.1/chapter53/sect...
- mathgeek 4mo agoYep, definitely fits with plenty of space. Thanks for confirming.
- smalltorch 4mo ago>"Precise geolocation data" does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility. What exactly does this mean?
- wizzwizz4 4mo ago
- arcticbison 4mo ago[dead]
- lysace 4mo agoThis is going to spread like wildfire. ("We can do that?")
- heroprotagonist 4mo agoGreat, now you have to ban sharing of it, or banning sale is worthless. Or rather, only worthwhile as a straw-man you can point to and say "Look, we stopped it!" when you know that's false.
- throwaway85825 4mo ago*except sale to the government?
- jmward01 4mo agoGiven the actual informed and uncoerced choice, people say no to this kind of collection and especially its sale or use for any purpose other than the explicit service they thought they were allowing it for (navigation, setting the time, etc etc). This is true for basically all information collected. I'm glad to see there is some minor protection language being included but it needs to have real teeth and get to the point. If you collect data from me under false pretenses or using coercive methods (you can't use the thing you just paid a lot of money for if you say no) you will not only be fined but criminally prosecuted.
- amatecha 4mo agoCompletely agreed. Even for people who are like "I have nothing to hide", the only people who think this way are simply unaware of just how much harm can come to them without the protection of privacy (and laws that ensure this)... or they just have no self-preservation instinct, I guess?
- Affric 4mo agoSo, aside from nothing to hide domestic/family violence and stalking, the fact that they can and will build an inference about you to attempt to influence your choices is fundamentally menacing to every person. Corporate stalking has become so normalised (and provides so many livings) that we are through the other side. Half a millennium ago they tried to control us by restricting our access to information to control what we think, now they bombard us with it to control what we think.
- xor_589 4mo agoThe "I have nothing to hide people" are the reason our privacy rights have eroded.
- dotancohen 4mo ago> or they just have no self-preservation instinct I actually feel this way very often when talking to some younger people online. I wonder if they really competely lack this skill, or their desire for upvotes online leads to them expressing compassionate, but stupid and dangerous, conclusions.
- avarun 4mo agoAs long as this is actually about "sale" of data and actually imposes strict limits on data brokers and all the nefarious actors out there, I am all for it. If it's more similar to the California law, which just calls all uses of data "selling data" and just ends up muddying the waters without actually imposing any regulations of value on the bad actors in the industry, then that would be a shame. There is value to actually keeping the meaning of words clear and consistent. I have no issues with Google using its first-party Google Maps data to serve me better recommendations. I have massive issues with AT&T selling aggregated geolocation data that makes it easy to identify individuals to third parties. I hope this is a clear path towards banning the latter without touching the former.
- jboggan 4mo agoTo be fair, the reason the CA laws are much more expansive on all uses of data is because companies have tried a number of arrangements to get around the definition of "sale". This was Sephora's defense back in the first CCPA case, that their data sharing relationship in exchange for targeted marketing services was not "selling" data: https://ccpa.world/enforcement/sephora-sale-of-pi https://ccpa.world/enforcement/sephora-sale-of-pi
- prasadjoglekar 4mo agoThe biggest issue is that enforcement and litigation is limited to the VA AG. You and I as wronged citizens can't go sue. That's corny capitalism. A sibling post that talked about 1750 ft or whatever is just noise.
- nickvec 4mo agoHave any other states banned the sale of geolocation data?
- erentz 4mo agoWhat is the rationale for going to the trouble of such a law but only banning sale, rather than all sharing?
- Frost1x 4mo agoGood question, I’m curious too. 911 services and cell providers come to mind, as well as subpoenaed data from law enforcement? Perhaps? Third party commercial entities like cell providers are collecting and sharing it out of necessity but I’m guessing not selling it? But that opens an interesting loop hole it seems where you could open a share agreement and then through other mechanisms recover the fee you’d otherwise charge for. Provider A wants to sell data to provider B and provider B wants to buy from provider A but they legally can’t. So instead provider A just tucks the cost in some other unrelated contract with provider B with a wink wink, handshake, nod, their “relationship” then just makes them want to share the data at “no charge.” Both know the fees are tucked in other agreements, although only provider A knows the itemized cost, provider B just wonders if the cost of the other package + their friendship handshake sharing of geolocation data is worth that total cost. To be fair, until money comes into play people tend to be less nefarious about their uses of information and intentions. Not always, but on average.
- polski-g 4mo agoBecause the data is very helpful in pricing risk of drivers in insurance premiums. Obviously risky drivers should be charged a higher rate.
- doginasuit 4mo agoCompanies who want to use this data should gather it themselves, and transparently. Insurance companies do this, my dad had a little tracking unit in his car that I assume allowed him to pay a lower rate. It is not gathering or using the data that is a problem, it is gathering or sharing it without awareness and consent. To be fair, even sharing/selling it would be fine assuming it happens with awareness and consent. Not buried in some ToS, but active consent.
- underlipton 4mo ago
- macinjosh 4mo agoWhat a coincidence that northern Virginia is spy central.
- CodeByBryant 4mo agoThis is an actually great move.
- deaton 4mo agoI cant wait for the feds to sue them for.. something
- bflesch 4mo agoThat's a step into the right direction. I can only imagine how much pain has been inflicted with metadata.
- Pxtl 4mo agoWhat I find confusing is that I know an infinite plethora of companies have geolocation data in everyone.... But I look at my fairly-stock Pixel phone and the only things with background geolocation permissions are Google apps, and I know google famously hoards that data like a dragon. Is it just that people are happily allowing every app access to live geoloc data even in background? Is there some edge where "while in use" apps are "in use" during cases you wouldn't think they are? Is it my Samsung watch?
- Grombobulous 4mo agoThe cellular companies themselves are a source for this, as they don't even need GPS or app permissions to triangulate your rough location. Apps that have access to look for networks can also be used to infer location. E.g., combine multiple known WiFi SSIDs or Bluetooth devices together and you can get a rough location. Also, most people just hit "accept" for a whole bunch of app permissions and just forget about it. The fact that you even know which apps have which permissions at all means you are almost certainly more careful than the average person, even though you are saying this in the context of a stock Pixel phone. And, oh yeah, most people have much more invasive Android phone brands than Pixel...cheap phones with a bunch of carrier/advertising partner spyware sell far better than Google's phones. Does Samsung still install the Facebook app by default like they used to? I think it used to be impossible to fully delete, even!
- gulugawa 4mo agoAs someone who frequently travels to Virginia, this is great news.
- joshawash 4mo agoAs someone who works in a space where we buy ads, I love things like this. Data points like this just shouldn't be on the table for sale. Just makes sure that we don't depend on best intentions alone to make sure we protect people. A step in the right direction.
- Slovian 4mo ago[flagged]
- smalltorch 4mo agoSo, what sort of gymnastics do alpr companies need to play to defend their activities don't break this new ban? My puny brain can't understand why it wouldn't be relevant. Or is it?
- dlev_pika 4mo ago“ Virginia follows Maryland and Oregon in banning the sale of geolocation data. Both Maryland and Oregon more broadly define “sale” to mean the exchange of personal data “for monetary or other valuable consideration.” I didn’t know this, but I am glad my State already had this! We do some things right.
- ascotan 4mo agoThe article is misleading. The sale of geolocation data can still take place but not for precise locations. The bill prevents the sale of data that can identify you within 1750ft. You can still be tracked just not precisely. i.e. companies will just sell fuzzy geolocation data.
- abustamam 4mo agoYeesh. Collect enough fuzzy data and you can identify a lot about someone.
- somenameforme 4mo agoYeah I don't understand how something like this makes any sense. Just average out the data points and you're going to get pretty much a straight line path of where and what somebody did. Maybe if there's like one data point per week per person, but even that's going to be pretty informative when averaged as to exactly where somebody lives, works, and so on.
- breppp 4mo agoI assume this depends if 1750ft means the location you can derive from the data (together with other data) or the precision of the individual data point
- ascotan 4mo agoits the definition of precise geolocation data in the va code: https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/ https://law.lis.virginia.gov/vacode/title59.1/chapter53/sect...
- ezwoodland 4mo agoDepends on if the independent events are uncorrelated. For example, if they had to be quantized to a grid of length 1750ft and quantized sufficiently in time as well, it might be impossible to average out since the various data points provide no new information.
- emsign 4mo agoWhy not make selling any personal data illegal in the entire country?
- pineapple_opus 4mo agoI am intrigued as an outsider, that state in US can have much stronger authority to restrict sale of such personal data.
- geonineties 4mo agoThe thing to remember about US states is that conceptually they are countries bound together in a Federation. There's a crap ton of complicated rules, but generally your state has a lot more power over your life than the US Federal Government does.
- shevy-java 4mo agoThey are a bit confused in the USA. For instance, flock cameras are used as mass spying tool. That also yields geolocation data. And also bypasses (parts of) the amendment. There is a lack of consistency here.
- trentor 4mo agoWould love if someone with experience could chime in. I've been reading about the geo data market for over two decades now but still have no real sense of its value. What does this data typically cost? And can you specify particular locations/targeting points, or do you just get whatever's available in a broader dataset?
- titzer 4mo agoI didn't read the law but the article referred to it as "personal data". It's important to note that Big Tech believes it can "anonymize" fine-grained location data but just stripping PII and assigning a semi-stable random ID. They'll then argue this law doesn't apply because of that. That's absolute crap because geolocation data is extremely easy to de-anonymize. I wonder whose phone is at my house 12am-8am everyday, takes more or less the same route through the city, and spends hours in my office everyday. I wonder.
- ricksunny 4mo agoIs that just point of sale geolocation data, vendor location, or…datacenter location facilitating the transaction
- tomeow 4mo ago[flagged]