FYI: Three States Now Ban Selling Your Location Data. Here’s What That Means for Geofencing.

If you buy geofencing, or you’re thinking about it, this is worth five minutes. A handful of states changed the rules on location data over the past year, and a lot of vendor pitches still read like it’s 2023. No need to panic. You just have a few new questions to ask.

What passed

Maryland, Oregon and Virginia now ban selling precise geolocation data. “Precise” means data that can place a person or a device within about 1,750 feet, roughly a third of a mile. Maryland went first. Oregon’s ban started in January. Virginia’s governor signed his in April and it kicked in July 1.

Virginia’s version has a quirk. It only counts a sale when money changes hands, while Maryland and Oregon also count trades for other kinds of value. Lawyers will argue about that for years, so we’ll leave it to them.

California went another way. Its AB 45, in effect since January 1, bars using geofencing around healthcare facilities to track people or send them targeted ads. Other states have bills in the works too, so treat this as a snapshot and not the final list. In plain terms: if a business model depends on collecting phone location data and selling it, three states have told it to stop.

Why now

Where someone goes says a lot about them. A few weeks of movement can show where they worship, where they see a doctor, who they spend time with. Privacy groups have complained for years that data brokers collect all of it and sell it to just about anyone, and most people have no idea which of their apps are sharing it. Lawmakers finally noticed. You can disagree with a particular law and still see why it exists.

Geofencing itself is fine

Nobody banned drawing a virtual line around a convention center. These laws go after selling precise location data, so the question shifts from “can I use geofencing?” to “where did the data behind it come from?”

Data that people knowingly shared with an app, with their consent, is one situation. A giant file that a broker sold to a vendor, who passed it to another vendor, is a different one. Anyone who’s played telephone knows how that second chain ends.

In B2B, the usual setup is a fence around a venue, like a convention center or a competitor’s office, with the ads delivered to phones inside it. The data behind those phones is the part to check.

What to ask your vendor

Put these in an email:

• Where does your location data come from? Apps, an SDK, a broker, something else?
• Was it collected with consent, and can you show how?
• Do you buy or sell location data, or just use it?
• How do you handle the states with bans?
• Do you exclude sensitive places, like healthcare facilities?

A good vendor answers without much fuss. Something like: the data comes from apps where users agreed to share their location, here’s how consent works, we don’t sell it onward, here’s how we handle the ban states, and healthcare sites are excluded by default. Specific, and a little dull. That’s what you want.

Watch for the other kind of answer. Refusing to say where the data comes from. “We’re compliant everywhere” with nothing behind it. “We get it from a partner,” then silence when you ask which one. A vendor who says “proprietary” five times in a row has answered your question, just not the way you hoped.

If you already have a campaign running, ask anyway. A short email now beats a long one later, and it leaves you with something on file if anyone asks.

Before you sign anything

Find out which states the campaign will touch and whether any of them are ban states. Ask what happens if a law changes halfway through, and whether you can pause or get out without a penalty. Then get the answers to the five questions into the contract or a follow-up email, not just a call. It’s dull paperwork, but it’s the part that protects you.

Trade shows make it messier

Event geofencing is one of our favorite uses of the tool, and it shows the problem well. People fly into a convention center from all over the country, so a single geofence can pick up devices belonging to residents of a dozen states. Which rules apply to which device is a fair thing to raise before launch, not after the invoice shows up.

Where this is going

More of it. US privacy law is a patchwork and it gets patchier every legislative session. A campaign that’s fine in one state can be a headache in the next, so the habit to build is asking early and asking again. Good vendors will have answers ready, and they won’t mind being asked. Some vendors will adjust quietly, some will get loud about their compliance, and a few will hope nobody asks. You’ll learn a lot about which kind you’ve got from how they answer one short email.

One last thing. This is a snapshot as of October 2026, written by marketers and not lawyers, and it isn’t legal advice. Run anything you’re about to launch past someone who does this for a living. We’d like our legal careers to stay short.