VA SB338

Prohibits data controllers from selling or offering for sale precise geolocation data concerning consumers, adding this as a new responsibility under Virginia's Consumer Data Protection Act

Amends § 59.1-578 of the Code of Virginia to expand data controller transparency and responsibility requirements

Maintains existing protections requiring consumer consent before processing sensitive data and compliance with the federal Children's Online Privacy Protection Act (COPPA) for children's data

Preserves requirements that controllers limit data collection to what is adequate, relevant, and reasonably necessary for disclosed purposes and maintain appropriate security practices