States Target Sensitive Data, Location Data, and Data Brokers

States continued to adopt more targeted privacy requirements in 2026, including new restrictions on precise geolocation and sensitive personal data and expanded requirements for data brokers. These laws are important even for businesses that have already determined whether they are subject to each state’s comprehensive privacy law because some requirements apply based on the type of data or activity involved rather than traditional consumer-volume or revenue thresholds.

Recent developments in Vermont, Maryland, Virginia, and New Jersey illustrate this broader shift toward regulating specific categories of data and data-processing activities.

Vermont Expands Data Broker Requirements

Vermont expanded its data broker requirements in 2026, adding new disclosure and financial requirements for registered data brokers.

The amendments expand required registration disclosures to include certain sensitive-data practices and disclosures to government bodies, law enforcement, foreign actors, and generative AI developers.

These requirements may be particularly relevant for data brokers that maintain detailed consumer profiles or provide personal information to multiple types of recipients. The specific inclusion of disclosures to generative AI developers also illustrates the increasing overlap between state privacy and AI regulation.

Vermont’s amendments also require registered data brokers to maintain a $20,000 bond for liabilities arising under the law.

Businesses that buy, sell, or license personal information should determine whether they qualify as a data broker under Vermont law and, if so, confirm that their registration disclosures and financial requirements reflect the amendments.

Maryland Expands Its Definition of Precise Geolocation

Maryland expanded the definition of precise geolocation information under its privacy law.

The definition now includes information identifying the location of a consumer, mobile device, or vehicle within a radius of 1,750 feet.

Businesses that collect location information should review whether data they previously treated as general location information may now fall within Maryland’s definition of precise geolocation information and become subject to additional restrictions.

Virginia Prohibits the Sale of Precise Geolocation Information

Virginia has adopted a more direct restriction on precise geolocation data by prohibiting businesses from selling or offering to sell precise geolocation information.

Businesses that collect location information should therefore understand not only whether they collect precise geolocation data, but also how that information moves through advertising, analytics, vendor, and other third-party relationships.

The Maryland and Virginia developments demonstrate the growing importance of treating location information as a distinct category when conducting data inventories and reviewing third-party data flows.

New Jersey Prohibits Sale of Sensitive Personal Data

New Jersey has taken an even broader approach to sensitive information by prohibiting the sale of sensitive personal data.

Significantly, the prohibition applies regardless of the number of New Jersey consumers whose information a company processes. A business may therefore fall outside the applicability thresholds of New Jersey’s comprehensive privacy law and still be subject to the sensitive-data sale prohibition.

As we discussed in our separate article on New Jersey’s new data broker law, the restriction applies broadly to sensitive information, including certain health, financial, biometric, precise geolocation, and other sensitive personal data.

What Businesses Should Do Now

These developments reinforce the need to look beyond the applicability thresholds of state comprehensive privacy laws. Businesses should:

Map sensitive and location data. Identify sensitive personal data, precise geolocation information, biometric data, and other specially regulated information and understand how that information is used, sold, licensed, and shared.
Review data sales and third-party disclosures. Determine whether advertising, analytics, licensing, or other data-sharing arrangements involve information subject to state-specific restrictions.
Review data broker requirements separately. Businesses that buy, sell, or license personal information should evaluate data broker laws on a state-by-state basis rather than assuming their status under one state’s law determines their obligations elsewhere.
Do not rely solely on comprehensive-law thresholds. Identify requirements that apply based on the type of data or processing activity even where the business does not otherwise meet a state’s general privacy-law thresholds.

The growing number of targeted state requirements means that a traditional state-by-state applicability analysis may not capture all of a business’s privacy obligations. Businesses should increasingly consider both where they operate and the specific types of data and processing activities involved.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.