Virginia legislation · 2026 Regular Session
Virginia SB338: An Act to amend and reenact § 59.1-578 of the Code of Virginia, relating to Consumer Data Protection Act; data controller responsibilities; precise geolocation data.
Status: Chaptered, April 13, 2026
Consumer Data Protection Act; data controller responsibilities; precise geolocation data. Provides that, for purposes of the Consumer Data Protection Act, a controller of personal data shall not sell or offer for sale precise geolocation data concerning a consumer.
What the bill says
An Act to amend and reenact § 59.1-578 of the Code of Virginia, relating to Consumer Data Protection Act; data controller responsibilities; precise geolocation data. [S 338] Approved April 13, 2026 1. That § 59.1-578 of the Code of Virginia is amended and reenacted as transparency. A. A controller 2. Except as otherwise provided in this chapter, not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which such personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent; 3.
From the enrolled text, April 13, 2026:
An Act to amend and reenact § 59.1-578 of the Code of Virginia, relating to Consumer Data Protection Act; data controller responsibilities; precise geolocation data. [S 338] Approved April 13, 2026 1. That § 59.1-578 of the Code of Virginia is amended and reenacted as transparency. A. A controller 2. Except as otherwise provided in this chapter, not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which such personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent; 3. Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. Such data security practices shall be appropriate to the volume and nature of the personal data at issue; 4. Not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers. A controller shall not discriminate against a consumer for exercising any of the consumer rights contained in this chapter, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods and services to the consumer. However, nothing in this subdivision shall be construed to require a controller to provide a product or service that requires …