Virginia VCDPA Treats Precise Geolocation as Sensitive Data Requiring Consent for Sale

The VCDPA amendment classifies precise geolocation as sensitive personal data. Controllers must obtain opt-in consent before any sale. This directly restricts data brokers and ad networks that previously relied on opt-out flows or legitimate interest claims. Enforcement begins with the Attorney General's office under existing VCDPA penalties of up to 7,500 dollars per violation.

California CCPA and Colorado CPA already treat geolocation as sensitive but permit broader opt-out mechanisms. Virginia's consent requirement is stricter and applies to any entity processing data of 100,000 Virginia residents or deriving 50 percent of revenue from data sales. SDK providers and location-based advertising platforms must re-architect consent prompts or segment Virginia traffic.

Apps and advertisers lose default access to continuous location signals for retargeting and attribution. Compliance timelines force changes to data contracts within six months. Measurement vendors report expected 25-40 percent reduction in addressable Virginia impressions once consent rates stabilize below 30 percent. Similar rules in additional states would compound fragmentation for cross-border campaigns.