Don't Sell My Location: Virginia Draws the First Hard Line Against Surveillance Advertising

Right now, as you read this, your phone knows exactly where you are. The unsettling part is that nobody can fully account for where that information ends up. Virginia just did something about it. The state passed a law that bans the sale of precise location data — not “unless you opt out,” not “unless you consent,” but a flat prohibition on the transaction itself. It’s a quiet move with heavy implications, and it’s worth pulling apart.

What Actually Changed

Start with the core. Virginia has, as a matter of principle, banned the sale of precise location data.

Until now, nearly every US state privacy law worked one of two ways. Either the company had to get your consent, or it had to give you an opt-out button somewhere. If you didn’t go find that button and click it, your data kept flowing. The burden was on you.

Virginia flips the premise. Consent or no consent, opt-out or not, the act of handing over precise location coordinates for money is off the table. The center of gravity in privacy regulation just shifted — from “your right to refuse” to “a thing companies aren’t allowed to do in the first place.”

The key phrase is precise location. Not vague city-level data, but coordinates specific enough to place an individual inside a particular building, a particular clinic, a particular protest. Why that specificity is dangerous comes in a minute.

Why Ban the Sale Instead of Requiring Consent

The loophole in existing privacy law lives inside one word: consent.

Think about the last app you installed. That wall of terms and conditions — did you read it? Almost nobody does. And buried in there, more often than not, is a line like “I agree to share my location with third parties.” You tapped “I agree” because tapping “I agree” is the only way to get to the app.

The industry has a name for this: consent fatigue. The choices are so numerous and so convoluted that users end up saying yes to everything, essentially defenseless. Technically the company obtained consent, so it’s legal. Practically, no one made a real decision.

Virginia’s approach goes straight at this. If the sale is banned no matter how cleanly you collected consent, the whole fine-print game becomes pointless. Instead of offloading the defense onto each individual, the law shuts down the dangerous transaction itself. That’s not a tweak. It’s a different philosophy of what regulation is for.

The Shadow Industry of Location Brokers

The real target here is the data broker — an industry of companies you’ve never heard of, quietly hoovering up location signals from hundreds of millions of phones, packaging them, and reselling them.

Here’s the mechanics. Free apps — weather, games, coupon apps — don’t just make money on ads. Many also sell data. The location coordinates an app collects pass through an ad network, land with a broker, and the broker bundles them and sells them on to marketers, and in some cases to government agencies. The user has no idea their daily movements are being traded like a commodity.

Why is that so serious? Because “anonymized” location data isn’t really anonymous. Wherever you spend your nights is your home. Wherever you spend your days is your work. Those two points alone are enough to identify most people. Add a visit to a hospital, a place of worship, a demonstration, and an entire life is laid bare.

The First Cut in the Surveillance-Ad Economy

This is where the story gets bigger. For well over a decade, the internet economy has run on one model: surveillance advertising. Track users as precisely as possible, then sell targeted ads built on that data. Location has always been one of the most valuable raw materials in that supply chain.

Virginia just severed one strand of that chain by law. You might reach first for California’s CCPA or Europe’s GDPR — the heavyweights. But even those stop short of banning the sale itself. They mostly guarantee a right to opt out. Virginia went further.

One state’s law won’t rewrite US policy, let alone the global ad industry, overnight. Companies will fight in court over what “sale” even means. Expect creative relabeling — data that isn’t “sold” but “licensed,” or merely “shared.” The cat-and-mouse of regulation and evasion will continue.

Still, the symbolism is large. For the first time, the old assumption — “consent makes it sellable” — has met a legal counterargument: “No. This shouldn’t be for sale at all.” Worth noting: this hasn’t blown up in the usual online forums yet. It’s a story circulating first among lawyers and privacy specialists — early, but spreading.

The Takeaway

Virginia’s location-data ban looks small, but it’s an experiment in rewriting the grammar of privacy law — from “protect yourself” to “the dangerous deal is simply prohibited.” Whether other states copy the model or the whole thing gets lobbied into irrelevance is the storyline to watch. So here’s the question worth sitting with: should the job of guarding your location fall on you, or should the law just make sure it can’t be sold in the first place?