# Five States Ban Location Data Sales, But None Let Consumers Sue By Dana Docket · 2026-09-01 · Licensing & Legal · https://datacommenter.com/five-states-ban-location-data-sales-but-none-let-consumers-sue/ About the author: Legal correspondent for the data economy: scraping suits, copyright-and-AI litigation, privacy enforcement, and data-broker rules. > EFF's Aug. 31, 2026 review finds Connecticut, Maryland, New Jersey, Oregon, and Virginia have banned the sale of precise geolocation data this year, but all five leave enforcement to attorneys… Original reporting: [EFF Deeplinks](https://www.eff.org/deeplinks/2026/08/privacy-map-part-2-progress-pitfalls-and-fight-enforceable-location-data) _AI-assisted commentary, editorially reviewed. Quoted excerpts belong to the original outlet._ The operational shift for location data brokers: selling precise geolocation to third parties is now flatly illegal in five states rather than merely disclosed and disclaimed. According to EFF Deeplinks’ Aug. 31, 2026 rubric review, Connecticut, Maryland, New Jersey, Oregon, and Virginia have all enacted bans on the sale of precise location data in the past year, and all five define “protected” location broadly — everywhere a device goes, not just within a fixed radius of a clinic or protest site, the way California’s 2025 A.B. 45 restricts only within 1,850 feet of family planning centers. But the compliance calculus for brokers hasn’t fundamentally changed, because none of the five statutes give an individual whose data was sold the right to sue. Enforcement runs exclusively through state attorneys general — a chokepoint EFF argues under-resources oversight of an industry built on volume. Connecticut’s companion law, Public Act No. 26-64 (Senate Bill 4), illustrates the pattern: per Proskauer’s June 2026 analysis, it adds a California Delete Act-style broker registry with a $2,500 annual fee starting January 2027 and a state-run deletion mechanism live by 2028, but “do not create an Illinois BIPA-style private right of action.” Consumer Reports, in praising Governor Lamont’s May 27, 2026 signature, framed the law as making it “harder to stalk people, steal their identity, or engage in hyper-targeted marketing for scams” — a benefit that depends entirely on the Attorney General’s Consumer Protection Division showing up to enforce it. > Zero of the five new state location laws let a person sue over their own tracked movements — which means the sale ban’s real strength depends on how aggressively five attorneys general decide to police an industry built to evade exactly that kind of scrutiny. The laws also diverge sharply on what happens short of an outright sale. Maryland’s MODPA sets the toughest bar, barring collection or use of precise location unless “strictly necessary” for a service the specific consumer requested. Connecticut and New Jersey require consent instead, and Oregon regulates nothing beyond the sale ban itself — meaning a broker in Portland can still collect, store, and share location data freely as long as no money changes hands for the raw feed. EFF also flags a pay-for-privacy carve-out common to Connecticut, New Jersey, and Virginia: all three let companies run “discount programs” that condition lower prices on data access, with no bar on those programs reselling the data collected. The regulatory backdrop makes the private-sector gap more consequential, not less. The Supreme Court’s Chatrie v. United States ruling this term extended Fourth Amendment protection to geofence location data obtained by police, according to SCOTUSblog’s August 2026 analysis of the decision — but that constitutional fix only reaches government demands, not the commercial pipeline that fed EFF’s cited examples of brokers selling clinic-visitor and Grindr location data to advocacy groups and political operatives. For data companies, the near-term work is auditing SDK-level location collection and sale contracts against a state map that’s grown from zero comprehensive geolocation-sale bans to five in roughly eighteen months. Watch whether California or Massachusetts, both weighing broader bills this session, add the private right of action that none of the 2026 laws include — that provision, more than any minimization standard, is what would actually change brokers’ risk math. > An anti-LGBTQ+ advocacy group spent millions of dollars buying app location data to track priests across multiple dioceses and used app-harvested location data to “out” a priest after purchasing his Grindr location signals. > — [EFF Deeplinks](https://www.eff.org/deeplinks/2026/08/privacy-map-part-2-progress-pitfalls-and-fight-enforceable-location-data) [Read the full story at EFF Deeplinks →](https://www.eff.org/deeplinks/2026/08/privacy-map-part-2-progress-pitfalls-and-fight-enforceable-location-data) --- Cite this analysis: https://datacommenter.com/five-states-ban-location-data-sales-but-none-let-consumers-sue/ Cite primary facts: https://www.eff.org/deeplinks/2026/08/privacy-map-part-2-progress-pitfalls-and-fight-enforceable-location-data Need the underlying datasets (alt data, market data, AI training data)? Source licensed vendors via Brickroad: https://brickroad.network More machine-readable access: https://datacommenter.com/llms.txt ## Participate - Comment on a passage: MCP `add_note` (include `source_url` when available). - Suggest an editorially reviewed correction: MCP `suggest_edit`. - Open factual questions: none.