A good start. From 2024: "A company allegedly tracked people’s visits to nearly 600 Planned Parenthood locations across 48 states and provided that data for one of the largest anti-abortion ad campaigns in the nation, according to an investigation" - https://www.politico.com/news/2024/02/13/planned-parenthood-...
So let's say a Delaware incorporated company sells location data that happens to be collected in Virginia, but its sold from the corporation with no operations in Virginia. What happens? On the other hand us-east-1 is in Virginia with who knows how many payment processing servers running.
Most likely the vendor will make a judgement call about whether they care to comply. If they do want to comply, they will likely exempt all Virginia data from the collected data set and contractually require and downstream user to indemnify them if a Virginia person is affected by their data set.
The same thing that happens in court cases across state lines. It goes to one of the jurisdictions in a lawsuit unless it qualifies for diversity jurisdiction and goes to a federal court.
NYTimes article a few years ago on how car insurance companies were using such data. Tracking sudden stoos, driving at night, driving faster than 80 mph, etc.
I wonder why “80 mph” was picked as an arbitrary value (I also know you didn’t mention this out of thin air). In rural areas of Utah we have 80 mph posted limits and prima facie speed laws. A lot of Utah drivers regularly exceed 80 MPH and I’d argue legally. It’s just a weird number to for them to pick.
It’s important to understand that in the USA, data is owned by the collector (eg. The app or SaaS who generated it), not the person who is described by it.
Until this legal regime changes, we will constantly be playing whack-a-mole with laws like this.
I was intrigued, because even a broad location given for an IP address is "geolocation data", but the law says "precise geolocation data" which limits it to device-reported data, I assume.
It likely fits the definition of precise location data that you can configure on mobile settings (it's a finer grained option you can enable when sharing your location).
Laws typically define terms like this, and this law is no exception.
> "Precise geolocation data" means information derived from technology, including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet. "Precise geolocation data" does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
> Virginia follows Maryland and Oregon in banning the sale of geolocation data. Both Maryland and Oregon more broadly define “sale” to mean the exchange of personal data “for monetary or other valuable consideration.” Virginia joins several other states that have recently proposed legislation with similar bans, including California, Massachusetts, Vermont and Washington State. The legislative activity follows regulatory scrutiny on the sale of geolocation data, including the California Attorney General’s investigation into the location data industry in March 2025, and a 2024 FTC settlement banning a data broker from selling geolocation data.
(i could not find a state legislation tracker regarding this type of legislation, please feel free to drop it in a reply if you find one!)
I can't find it so it's probably just a myth, but I recall hearing about "free beer with purchase of food" at bars during prohibition. However, I think it was more than just the sale that was prohibited.
I used to regularly go to a comedy show on the site of an old brewery in Wandsworth. The comedy cost £20 but the beer was free. Apparently the site was the oldest continuous used brewery in Europe and the head brewer decided to keep the record going after the site was sold to a property development company. However, there was a prohibition against competition and licensing issues meaning they couldn't charge for beer.
Raines Law in that late 1800s put restrictions on the sale of alcohol in NY on Sundays. Bartenders used a loophole of the drinks being served with a meal to get around it.
They would make a single sandwich, "serve" it to the patron along with their drink, then immediately take back the sandwich to "serve" it to the next person wanting a drink
I've been to bars that required you to buy a bowl of popcorn or some such in order to abide by their restrictive liquor license which only allowed sale with food.
BRILLIANT
Until this legal regime changes, we will constantly be playing whack-a-mole with laws like this.
> Exchanging private and personal user data without consent and without users being aware of it
> "Precise geolocation data" means information derived from technology, including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet. "Precise geolocation data" does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
https://law.lis.virginia.gov/vacode/title59.1/chapter53/sect...
We already know massive data harvesting has happened. Laws like this are just the bare minimum for catching up.
Would be nice if they could bring in laws that would punish these companies out of existence, but I doubt it.
> Virginia follows Maryland and Oregon in banning the sale of geolocation data. Both Maryland and Oregon more broadly define “sale” to mean the exchange of personal data “for monetary or other valuable consideration.” Virginia joins several other states that have recently proposed legislation with similar bans, including California, Massachusetts, Vermont and Washington State. The legislative activity follows regulatory scrutiny on the sale of geolocation data, including the California Attorney General’s investigation into the location data industry in March 2025, and a 2024 FTC settlement banning a data broker from selling geolocation data.
(i could not find a state legislation tracker regarding this type of legislation, please feel free to drop it in a reply if you find one!)
Its like how FLOCK gets around pesky data laws. The devices coat a lot, but the software dashboard access is "Completely free*"
They would make a single sandwich, "serve" it to the patron along with their drink, then immediately take back the sandwich to "serve" it to the next person wanting a drink
https://www.atlasobscura.com/articles/raines-sandwich