Veraset Movement — Compliance Risk Assessment

Cohort Atlas LLC — Geospatial Analysis of Regulatory Exposure

Analysis period: Sep 2025 – Mar 2026 | Generated: March 24, 2026

Coverage Change

Oregon Transition

12.9M → 0 pings

100% drop in Oregon interior pings (10km buffer) when HB 2008 took effect Jan 1, 2026. All 108K residual pings are GPS drift within 2km of the border. Oregon appears to have been removed from the "USA" product.

3 dates compared ORS 646A.578
Regulatory Exposure

California AB-45 — Clinic Proximity

2.4M pings near 106 clinics

Device pings within 1,850 feet of family planning centers — the buffer zone defined by AB-45, which restricts sale of this data with no consent exception. Private right of action, treble damages.

654K devices Cal. Civ. Code §1798.99.91
Coverage Change

Maryland Transition

19.7M → 0 pings

100% drop in Maryland interior pings after MODPA took effect Oct 1, 2025. 10km inward buffer excludes GPS drift. Maryland appears to have been geofenced out of the "USA" product.

2 dates compared MODPA SB 541
Regulatory Exposure

Washington MHMDA — Healthcare

27.2M pings near 4,878 facilities

Device pings within 2,000 feet of healthcare facilities — the buffer zone defined by MHMDA, which restricts geofencing near healthcare with no consent exception. In effect since July 2023.

3.6M devices RCW 19.373
Regulatory Exposure

Nevada NRS 603A.540 — Healthcare

4.7M pings near 872 facilities

Device pings within 1,750 feet of healthcare facilities — the buffer zone defined by NRS 603A.540, which restricts geofencing near healthcare with no consent exception.

816K devices NRS 603A.540
Regulatory Exposure

New York GBL §394-G — Healthcare

78.3M pings near 7,455 facilities

Device pings within 1,850 feet of healthcare facilities — the buffer zone defined by GBL §394-G, which restricts geofencing near healthcare with no consent exception. In effect since June 2025.

18.7M devices GBL §394-G
Border Analysis

OR/MD State Ban Boundaries

232K border pings

Original analysis of pings near OR/MD borders. Updated finding: all are GPS drift from neighboring states — consistent with proper geofencing of both states.

GPS drift only Geofence confirmed

Summary of Findings

  1. Oregon and Maryland removed from "USA" product — 100% ping drops in both states (10km inward buffer). The product geography is narrowing as the regulatory landscape evolves.
  2. 112.7M pings within statutory healthcare buffer zones across CA, WA, NV, and NY on a single delivery day. These statutes restrict geofencing near healthcare facilities and generally do not provide consent-based exceptions.
  3. Regulatory trend is accelerating — Virginia (outright ban, awaiting governor) and Connecticut (July 2026) are next. Five industry peers have faced FTC enforcement in 2024–2025.
  4. Exposure is shared — these statutes generally apply to every entity in the data supply chain. Continued delivery compounds the risk surface for both parties.