# Selling company data to AI companies in Virginia URL: https://sellmydatatoai.net/guides/sell-company-data-to-ai-in-virginia Reviewed: 2026-11-08 Virginia lets companies license data to AI buyers, and its Consumer Data Protection Act defines a sale narrowly, as an exchange of personal data for monetary consideration. Sensitive data needs consent, staff data is exempt, and from July 1, 2026 precise geolocation data cannot be sold at all. Governor Youngkin vetoed Virginia's high-risk AI bill in March 2025. ## Key takeaways - The VCDPA has applied since January 1, 2023 to businesses controlling or processing data of at least 100,000 Virginians, or 25,000 with over half their revenue from sales. - A sale under the VCDPA is an exchange of personal data for monetary consideration only, a narrower test than California's or Colorado's. - SB 338, signed on April 13, 2026, bans selling precise geolocation data from July 1, 2026. - The Attorney General enforces the VCDPA with a 30-day cure period and civil penalties of up to $7,500 per violation. This guide covers Virginia law for companies licensing records to AI buyers. Federal law and other states' laws still apply, as our [US guide](https://sellmydatatoai.net/guides/sell-company-data-to-ai-from-united-states) explains. Virginia's Consumer Data Protection Act was the model for many later state laws, so its definitions recur across the country. > **Not legal advice** This guide summarizes the Code of Virginia and published commentary. It is not advice on your situation. Take independent legal advice before licensing data. ## Does the Virginia Consumer Data Protection Act apply to your company? The Virginia Consumer Data Protection Act applies to your company if it does business in Virginia or targets Virginians and, in a calendar year, controls or processes the personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data. That test is in section 59.1-576(A). Section 59.1-576 also lists exemptions. The Act does not apply to financial institutions and data subject to GLBA, HIPAA covered entities and business associates, nonprofit organizations or institutions of higher education. Data exemptions cover protected health information, FERPA and Fair Credit Reporting Act data, and employment-related data used within that role. Section 59.1-575 defines a consumer as a Virginia resident acting only in an individual or household context, and excludes anyone acting in a commercial or employment context. Staff email and business contact records are therefore largely outside the Act. ## Is licensing data to an AI company a sale under the VCDPA? Licensing personal data to an AI company for money is a sale under the VCDPA. Section 59.1-575 defines a sale of personal data as the exchange of personal data for monetary consideration by the controller to a third party. That definition is narrower than California's and Colorado's, which also cover other valuable consideration. Proskauer notes that the VCDPA's narrow definition of sale and its exceptions may limit the reach of new sale restrictions. A license paid in credits, services or equity rather than cash may be analyzed differently, so take advice on how your deal is structured. The definition excludes disclosures to processors, to affiliates, to provide a product the consumer requested, of information the consumer intentionally made public, and transfers as part of a merger, acquisition or bankruptcy. Our guide to [selling customer data in bankruptcy](https://sellmydatatoai.net/guides/selling-customer-data-in-bankruptcy) covers the last case. ## What duties apply to sensitive and de-identified data? Sensitive data under section 59.1-575 includes data revealing racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation and citizenship or immigration status, genetic or biometric data processed to identify a person, data from a known child and precise geolocation data. The VCDPA requires consent to process sensitive data. Section 59.1-575 also defines de-identified data as data that cannot reasonably be linked to an identified or identifiable natural person, and says a controller holding it must comply with section 59.1-581. That section sets out the controls a holder must keep, such as reasonable measures against re-identification and contract terms for recipients. Our guide to [de-identification for AI training data](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) covers methods. Consumers can opt out of the sale of their personal data, and the Act requires controllers to carry out data protection assessments for activities such as selling personal data. Prepare the assessment before you share samples. ## What changed for geolocation data in 2026? Virginia banned the sale of precise geolocation data in 2026. Proskauer reports that Governor Abigail Spanberger signed SB 338 on April 13, 2026, that it takes effect on July 1, 2026 and that it bars controllers from selling or offering to sell a consumer's precise geolocation data. The VCDPA defines precise geolocation data as information that directly identifies a person's specific location within a radius of 1,750 feet. Proskauer notes that the ban does not cover imprecise or aggregated location data. Logistics, field service and app records often hold precise location, so check them before you license. See our [logistics](https://sellmydatatoai.net/sell-your-data/logistics) page. Willkie Farr and Gallagher says Virginia joins Maryland and Oregon as the only states that ban the sale of consumers' precise geolocation data, and MultiState reports that Oregon's HB 2008 uses the same 1,750-foot radius. Location data is becoming one of the hardest categories to license anywhere in the US. ## Does Virginia have an AI law that affects training data? Virginia does not have an enacted high-risk AI law. The General Assembly passed HB 2094, the High-Risk Artificial Intelligence Developer and Deployer Act, in February 2025, and ArentFox Schiff reported that it would have required developer documentation, risk management and impact assessments, enforced by the Attorney General. Steptoe reports that Governor Glenn Youngkin vetoed HB 2094 on March 24, 2025, calling it burdensome and saying it would harm innovation. Check whether a new AI bill has passed since, because the Governor changed in 2026. ### Can you license data you hold for clients? You usually cannot license data you hold for clients as a processor. The VCDPA, like the GDPR, separates controllers from processors, and a processor acts on the controller's instructions. Our guide to [whether you can legally sell company data](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai) explains why agencies, software companies and outsourcers should exclude client data. The narrow definition of sale does not end the analysis either. The FTC Act, contracts, professional duties and the privacy laws of other states where your customers live still apply to the same records, as our US guide sets out. ## Who enforces the VCDPA? The Virginia Attorney General enforces the VCDPA and has exclusive authority under section 59.1-584. The Attorney General must give 30 days' written notice before suing, and no action follows if the controller cures the violation and gives a written assurance. Civil penalties reach $7,500 per violation where a violation continues after the cure period or a written assurance is broken. The Act says it does not provide the basis for a private right of action. ## Is Virginia a one-party consent state for call recordings? Virginia is a one-party consent state for call recordings. It is not on the Reporters Committee for Freedom of the Press list of about 11 all-party consent states, which includes neighboring Maryland. Check where callers were before licensing a recording archive. ## Which buyers accept Virginia sellers? Buyers that accept US sellers accept Virginia companies. [micro1](https://sellmydatatoai.net/data-buyers/micro1) says demand is strongest in the US, [Endless Data](https://sellmydatatoai.net/data-buyers/endless-data) prioritizes the US, UK and Canada, and AWS Data Exchange lists the US as an eligible seller jurisdiction. ## What are Virginia's rules at a glance? | Area | Rule | Enforced by | | --- | --- | --- | | Scope | 100,000 consumers, or 25,000 with over 50 percent of revenue from sales | Virginia Attorney General | | Sale | Exchange for monetary consideration only | Virginia Attorney General | | Staff data | Outside the definition of consumer and exempt as employment data | Not applicable | | Sensitive data | Consent required | Virginia Attorney General | | Precise geolocation | Sale banned from July 1, 2026 | Virginia Attorney General | | High-risk AI | HB 2094 vetoed March 24, 2025 | Not applicable | | Penalties | Up to $7,500 per violation after a 30-day cure period | Virginia Attorney General | | Call recordings | One-party consent | Prosecutors | ## What should a Virginia seller do before licensing? A Virginia seller should confirm whether the Act applies, then decide how each category of personal data will be handled. The steps below follow the Code of Virginia sections cited above. 1. **Check the thresholds and exemptions**: Count Virginia consumers in your records and check whether a GLBA, HIPAA, nonprofit or higher education exemption applies. 2. **Separate consumer, staff and client data**: Staff data in its work role is exempt, and data held for clients as a processor should be excluded. 3. **Remove sensitive and location data**: Take out sensitive data unless you hold consent, and all precise geolocation data from July 1, 2026. 4. **De-identify the rest**: Meet the section 59.1-581 controls and bind the buyer by contract. 5. **Record the assessment**: Document a data protection assessment for the sale and keep it with the license. For a view of which buyers fit your records and what to clear first, request a free [data valuation](https://sellmydatatoai.net/data-valuation). ## Frequently asked questions ### Is a data license a sale under Virginia law? A data license paid in money is a sale under the Virginia Consumer Data Protection Act, which defines a sale as an exchange of personal data for monetary consideration. That is narrower than laws covering any valuable consideration, so deals paid in credits or services may be analyzed differently. Take advice on your deal structure. ### Does the VCDPA cover employee data? The VCDPA generally does not cover employee data. Section 59.1-575 excludes people acting in a commercial or employment context from the definition of consumer, and section 59.1-576 exempts employment-related data used within that role. Federal law, contracts and other states' laws still apply to staff records. ### Can I sell location data in Virginia? From July 1, 2026 you cannot sell precise geolocation data in Virginia. SB 338, signed on April 13, 2026, bars controllers from selling data that identifies a person's location within 1,750 feet. Proskauer notes that imprecise or aggregated location data is not covered by the ban, but it may still be personal data. ### Does Virginia regulate high-risk AI? Virginia does not have an enacted high-risk AI law. The General Assembly passed HB 2094 in 2025, but Governor Glenn Youngkin vetoed it on March 24, 2025. Check for any newer bill before relying on this, since Virginia's governor changed in 2026 and AI legislation moves quickly across states. ## Sources - [Code of Virginia chapter 53: Consumer Data Protection Act](https://law.lis.virginia.gov/vacode/title59.1/chapter53/), Virginia General Assembly, accessed November 2026 - [Code of Virginia section 59.1-575: definitions](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/), Virginia General Assembly, accessed November 2026 - [Code of Virginia section 59.1-576: scope and exemptions](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576/), Virginia General Assembly, accessed November 2026 - [Code of Virginia section 59.1-584: investigative authority and enforcement](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-584/), Virginia General Assembly, accessed November 2026 - [Virginia expands VCDPA with ban on sale of precise consumer geolocation data](https://newmedialaw.proskauer.com/2026/04/15/virginia-expands-vcdpa-with-ban-on-sale-of-precise-consumer-geolocation-data/), Proskauer Rose, accessed November 2026 - [Virginia becomes third state to ban the sale of consumers' geolocation data](https://complianceconcourse.willkie.com/articles/virginia-becomes-third-state-to-ban-the-sale-of-consumers-geolocation-data/), Willkie Farr and Gallagher, accessed November 2026 - [All of the comprehensive privacy laws that take effect in 2026](https://multistate.us/insider/2026/2/4/all-of-the-comprehensive-privacy-laws-that-take-effect-in-2026), MultiState, accessed November 2026 - [AI anti-discrimination bill heads to Governor's desk in Virginia](https://www.afslaw.com/perspectives/ai-law-blog/ai-anti-discrimination-bill-heads-governors-desk-virginia), ArentFox Schiff, accessed November 2026 - [Virginia high-risk AI bill vetoed: indications of future trends](https://www.steptoe.com/en/news-publications/virginia-high-risk-ai-bill-vetoed-indications-of-future-trends.html), Steptoe, accessed November 2026 - [Introduction to the Reporter's Recording Guide](https://www.rcfp.org/introduction-to-reporters-recording-guide/), Reporters Committee for Freedom of the Press, accessed November 2026 - [Data partnerships](https://www.micro1.ai/data-partnerships), micro1, accessed November 2026 - [Endless Data homepage and FAQ](https://endless-data.com/), Endless Data, accessed November 2026 - [Seller eligibility requirements](https://docs.aws.amazon.com/marketplace/latest/userguide/seller-eligibility.html), Amazon Web Services, accessed November 2026 --- Book a free consultation: https://sellmydatatoai.net/book-a-consultation