New Privacy Concern for State Lawmakers: Geolocation Data Privacy

Geolocation data has become a new frontier in privacy protection.

This year, Virginia could join Maryland and Oregon as the first states to prohibit the sale of information that provides the precise geographic location of a device, object or user through GPS, IP address tracking, Wi-Fi triangulation or cellular network signals, among other means.

Maryland’s and Oregon’s bans were only recently enacted in the past four months (SB 541 [2025] and HB 2008 [2025], respectively). Virginia’s SB 338, by Sens. Russet Perry (D) and David Suetterlein (R), would ban geolocation data sales in the Old Dominion starting in July.

Consumer Reports, the nonpartisan consumer advocacy organization that publishes an investigative journalism magazine with the same name, has announced its support for the Virginia bill.

“Location data is among the most sensitive information companies can collect, potentially revealing visits to reproductive or mental health clinics, political rallies, places of worship, and other potentially sensitive locations,” said Matt Schwartz, policy analyst at Consumer Reports. “At a time when location tracking is increasingly being weaponized against consumers, stopping the commercial sale of consumers’ location data is one of the most effective steps lawmakers can take to safeguard consumer privacy.”

In a January letter to the chair of the Virginia Senate General Laws and Technology Committee, Consumer Reports joined the Electronic Privacy Information Center, the Public Interest Research Group and Tech Equity Action in urging passage of SB 338.

“The location data market is a multi-billion-dollar industry centered on collecting and selling people’s everyday comings and goings, often collected from people’s mobile devices and often without their knowledge or explicit consent,” they wrote. “Location data is an extremely sensitive form of personal data. Researchers have shown that 95 percent of individuals can be uniquely identified from just four spatio-temporal points; most companies that collect this information have orders of magnitude more data than that.”

SB 338 was unanimously passed by both the committee and the Senate as a whole, and it has now moved on to the House of Representatives where a similar bill also supported by Consumer Reports floundered last year.

The organization, which has developed model legislation for stopping the sale of geolocation data, said it expects other states to at least consider bans in 2026, including California, Maine, Massachusetts, New Mexico, Vermont and Washington.

Other Bans Under Consideration

According to the LexisNexis® State Net® legislative tracking system, over 80 bills referring to “geolocation data” and “privacy” have been introduced in 26 states this year.

Only five of those measures, however, including Virginia SB 338, focus directly on geolocation data privacy, according to their bill summaries.

• Hawaii Sen. Chris Lee (D) introduced two bills to ban the sale of both geolocation data and internet browser data. SB 3017 and SB 1163 both bar selling geolocation information without explicit, opt-in consent, while the latter bill adds exemptions for law enforcement investigations, Customer Proprietary Network Information and telecommunications carriers operating according to federal CPNI rules.

• Maryland SB 569 by Sen. Arthur Ellis (D) seeks to strengthen the state’s online data privacy laws by establishing stricter limits on geolocation information and other personal and sensitive data. The bill targets the sensitive data of consumers under the age of 18.

• New Jersey AB 441, by Assemblyman Michael Venezia (D) would bar businesses that track or sell precise geolocation data from disclosing any information about someone at or near a reproductive health care facility. Two years ago, U.S. Sen. Ron Wyden (D-OR) reported that an anti-abortion group used mobile phone location data to send misinformation to people who visited 600 reproductive health clinics in 48 states.

Industry Opposition to Bans

In a letter to Oregon lawmakers considering HB 2008 last year, a coalition of advertisers provided a “non-exhaustive list of concerns” they had with the bill.

Noting first that the state’s privacy law already required companies to obtain consumers’ consent before processing or selling their location data, the officials from the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance said HB 2008 would deprive Oregon residents of “access to critical services and benefits that depend on location data.”

One of those benefits was receiving “relevant content and ads.”

“Without the ability to disclose location data for advertising purposes, subject to consumers’ opt-in consent, businesses will have a more difficult time, and face higher costs, reaching individuals with relevant marketing, and Oregonians will not be alerted to products and services they desire that are near to them,” they wrote.

The groups also argued that the measure could impede emergency notifications.

“Oregonians may lose access to emergency alerts for floods, wildfires, and other community emergencies, as these important, real-time alerts rely on disclosure of location data to function,” they stated.

In addition, they argued the bill could hinder “effective fraud prevention.”

“The responsible disclosure of location data allows anti-fraud and identity protection services to flag suspicious behavior and protect vulnerable communities,” they wrote. “For example, companies can more easily detect credit card theft or fraud if they or their service providers have access to location data showing that a consumer is not in the location where a purchase is being made. If passed, HB 2008 would impede entities’ ability to responsibly use and disclose location data to prevent fraudulent activity and reach out to consumers to confirm their purchases.”

Bills Dealing with Geolocation Data Privacy Introduced in Half of States

Bills referring to “location data” and “privacy” have been introduced in at least 26 states this year, according to the LexisNexis State Net legislative tracking system. Bills in five of those states focus directly on geolocation data privacy, according to their bill summaries.

Start of Trend?

The advertisers’ objections didn’t stop Oregon lawmakers from passing HB 2008. And in mid-February, Bloomberg Law’s privacy reporter Tonya Riley wrote that at least a half dozen unidentified states “without comprehensive privacy laws” are considering bills to ban the sale of geolocation data, highlighting “an evolution in lawmakers’ understanding of consumer privacy since California passed its first-in-the-nation law nearly a decade ago.”

Riley noted that attorneys general in both California and Texas have also raised concerns over geolocation data.

This certainly appears to be an emerging legislative trend. It wasn’t on our radar when we published our forecast of the top issues for 2026—but it is now.

—By SNCJ Correspondent BRIAN JOSEPH

Visit our webpage to connect with a LexisNexis® State Net® representative and learn how the State Net legislative and regulatory tracking service can help you identify, track, analyze and report on relevant legislative and regulatory developments.