Protecting Geolocation Data Emerges as State Privacy Priority

State legislatures are weighing a wave of protections for sensitive geolocation data that would redefine comprehensive privacy legislation.

At least six states without comprehensive privacy laws have introduced bills that would ban the sale of precise geolocation data. Some with privacy laws already on the books, such as Virginia, are seeking to update their consumer protections to reflect growing concerns with how sensitive location data can be used to harm consumers.

The push to ban geolocation data sales highlights an evolution in lawmakers’ understanding of consumer privacy since California passed its first-in-the-nation law nearly a decade ago. Most states have followed a model first passed by Virginia in 2021 that emphasizes opt-in rights for the collection of sensitive data. But the most recent privacy laws from states including Maryland and Minnesota offer alternative models focused on stricter data protections, giving states more options, said Jordan Francis, senior policy counsel at the Future of Privacy Forum.

Maryland’s privacy law, which went into effect last year, was the first to ban the sale of precise geolocation data. Oregon also passed a law to ban the sale, which went into effect on Jan. 1.

“In places that already had comprehensive laws, we saw interest in going further on location information, partly in response to news stories about misuse by law enforcement or commercial actors,” said Matt Schwartz, a policy analyst at Consumer Reports who consulted on the Oregon law as well as a California data location bill that has been reintroduced this year.

Lawmakers say the push to protect geolocation data shows that privacy laws don’t have to be static.

“I think every day we’re seeing more and more why that matters and how location data is used in ways that people don’t want and don’t anticipate,” said Virginia Sen. Russet Perry (D), who sponsored a bill to prohibit the sale of precise geolocation data. “This is a bipartisan, non-partisan issue. I think it’s something all states should take a look at and is a common sense way to protect people.”

Her bill, which passed the state Senate earlier this month, will move to the House of Delegates.

Consumer Reports recently unveiled separate model legislation on data location privacy which calls for stricter data retention limits than Perry’s bill and the Oregon law, as well as a consumer private right of action for violations.

“We think its especially important for this type of information that companies have proper incentives to comply,” said Schwartz.

Meanwhile, advertising and data broker companies that staunchly opposed the Oregon and Maryland bans are seeking to prevent more states from passing similar restrictions.

“This sweeping ban would unnecessarily disrupt data practices that allow companies to reach consumers with relevant content and advertising, enabling consumers to learn about goods and services that are near to them,” the Association of National Advertisers, American Association of Advertising Agencies, American Advertising Federation and Digital Advertising Alliance said in a letter sent earlier this month to Virginia state legislators.

For many companies, however, the impact of such legislation would be limited, said David Stauss, partner at Troutman Pepper Locke.

“If it’s prohibiting the sale, most companies are fine,” said Stauss. Legislation that would prohibit the processing of geolocation data would pose broader compliance challenges, he said.

Stauss cautioned that even if states don’t pass specific geolocation data protections, they can still bring enforcement actions against companies.

Last year, California’s attorney general launched an investigative sweep into the location data industry for violations of the California Consumer Privacy Act (or CPPA). Texas’s attorney general also cited its privacy law in a lawsuit against General Motors in 2024.

Enforcement trends will continue to shape how lawmakers think about developing more comprehensive approaches to privacy, said Francis.

“We’re eight years out from the CPPA,” he said. " Lawmakers have enforcement data and we’re seeing them use that to go back and tweak laws accordingly.”