Sen. Kwame Raoul

Filed: 4/20/2018





10000SB0575sam001LRB100 04833 HEP 39116 a


2    AMENDMENT NO. ______. Amend Senate Bill 575 by replacing
3everything after the enacting clause with the following:
4    "Section 1. Short title. This Act may be cited as the Keep
5Internet Devices Safe Act.
6    Section 5. Legislative findings; intent. The General
7Assembly finds the following:
8    (a) An increasing number of everyday household devices,
9such as smartphones, televisions, cars, toys, and home
10appliances, are being enhanced by speech recognition and other
11technologies that use microphones to listen for environmental
12triggers. As a result, private companies are gaining
13unprecedented and near constant access to Illinois citizens and
14their families' private lives, including what they do in their
15homes and their daily habits.
16    (b) While there are tremendous benefits from these



10000SB0575sam001- 2 -LRB100 04833 HEP 39116 a

1technologies, the collection of personal information from
2Internet connected devices pose serious privacy and physical
3safety risks to Illinois citizens and children. Children's toys
4now have microphones that can record and collect personal
5information from conversations within earshot of the device.
6    (c) The increasing prevalence of these technologies in
7everyday devices enables companies to collect, store, analyze,
8and share increasing amounts of personal data, often without
9Illinois families ever knowing. Illinois citizens have a right
10to their personal data and the public welfare, security, and
11safety will be served by requiring companies to be transparent
12about their data collection and sharing practices.
13    (d) It is the public policy of the State of Illinois to
14ensure that Illinois citizens be aware of and have control over
15whether a private entity records, collects, stores, or
16discloses their personal information and to ensure that their
17personal information is maintained in a secure manner.
18    Section 10. Definitions. In this Act:
19    "Digital device" means a smartphone, tablet, television,
20computer, car, toy, home appliance, or any other device that
21may be used for personal, family, or household purposes that
22contains a microphone.
23    "Microphone" means an instrument capable of listening for,
24collecting, recording, storing, analyzing, transmitting,
25interpreting, or otherwise using spoken words or other audible



10000SB0575sam001- 3 -LRB100 04833 HEP 39116 a

1or inaudible sounds.
2    "Private entity" means any partnership, corporation,
3limited liability company, association, organization or other
4group, regardless of organizational structure, or any agent
5thereof. "Private entity" does not include a state or local
6government agency.
7    "Minor" means a person who is between the ages of 13 and 17
8years old.
9    "User" means a person who purchases, leases, or otherwise
10uses a digital device.
11    "Verifiable parental consent" means any reasonable effort
12(taking into consideration available technology), including a
13request for authorization for future collection, use, and
14disclosure described in the notice, to ensure that a parent of
15a minor receives notice of the private entity's personal
16information collection, use, and disclosure practices, and
17authorizes the collection, use, and disclosure, as applicable,
18of personal information and the subsequent use of that
19information before that information is collected from that
21    Section 15. Collection, use, storage, or disclosure of
22information from a digital device's microphone.
23    (a) No private entity may turn on or enable, cause to be
24turned on or enabled, or otherwise use a digital device's
25microphone to listen for or collect information, including



10000SB0575sam001- 4 -LRB100 04833 HEP 39116 a

1spoken words or other audible or inaudible sounds, unless a
2user first agrees to a written policy, made available to the
3public, informing the user:
4        (1) that the microphone in his or her digital device
5    will be turned on, enabled, or used;
6        (2) of the frequency and length of time the microphone
7    will be turned on, enabled, or used;
8        (3) of the specific categories of information, such as
9    spoken words or audible or inaudible sounds, the microphone
10    will be listening for, collecting, storing, and
11    disclosing; and
12        (4) of the specific purpose for which the information
13    will be collected, used, stored, and disclosed.
14    (b) In addition to any other requirement under this
15Section, no private entity may turn on or enable, cause to be
16turned on or enabled, or otherwise use a digital device's
17microphone to knowingly listen for or collect information about
18a minor, including spoken words or other audible or inaudible
19sounds, unless the private entity first obtains verifiable
20parental consent.
21    (c) A private entity need not obtain a user's affirmative
22express consent after initial consent as described in
23subsection (a) has been properly obtained, unless the terms
24previously agreed to under paragraph (1), (2), (3), or (4) of
25subsection (a) are materially changed.



10000SB0575sam001- 5 -LRB100 04833 HEP 39116 a

1    Section 20. Security measures.
2    (a) A private entity that collects, stores, or transmits
3any information collected through a digital device's
4microphone concerning an Illinois resident shall implement and
5maintain reasonable security measures to protect those records
6from unauthorized access, acquisition, destruction, use,
7modification, and disclosure.
8    (b) A contract for the disclosure of information collected
9through a digital device's microphone concerning an Illinois
10resident that is maintained by a private entity subject to this
11Act must include a provision requiring the person or private
12entity to whom the information is disclosed to implement and
13maintain reasonable security measures to protect those records
14from unauthorized access, acquisition, destruction, use,
15modification, or disclosure.
16    Section 25. Unlawful practice. A violation of this Act
17constitutes an unlawful practice under the Consumer Fraud and
18Deceptive Business Practices Act.
19    Section 30. General provisions.
20    (a) Any waiver of the provisions of this Act is void and
22    (b) Any agreement created or modified after the effective
23date of this Act that does not comply with this Act is void and



10000SB0575sam001- 6 -LRB100 04833 HEP 39116 a

1    Section 35. The Consumer Fraud and Deceptive Business
2Practices Act is amended by changing Section 2Z as follows:
3    (815 ILCS 505/2Z)  (from Ch. 121 1/2, par. 262Z)
4    Sec. 2Z. Violations of other Acts. Any person who knowingly
5violates the Automotive Repair Act, the Automotive Collision
6Repair Act, the Home Repair and Remodeling Act, the Dance
7Studio Act, the Physical Fitness Services Act, the Hearing
8Instrument Consumer Protection Act, the Illinois Union Label
9Act, the Installment Sales Contract Act, the Job Referral and
10Job Listing Services Consumer Protection Act, the Travel
11Promotion Consumer Protection Act, the Credit Services
12Organizations Act, the Automatic Telephone Dialers Act, the
13Pay-Per-Call Services Consumer Protection Act, the Telephone
14Solicitations Act, the Illinois Funeral or Burial Funds Act,
15the Cemetery Oversight Act, the Cemetery Care Act, the Safe and
16Hygienic Bed Act, the Illinois Pre-Need Cemetery Sales Act, the
17High Risk Home Loan Act, the Payday Loan Reform Act, the
18Mortgage Rescue Fraud Act, subsection (a) or (b) of Section
193-10 of the Cigarette Tax Act, subsection (a) or (b) of Section
203-10 of the Cigarette Use Tax Act, the Electronic Mail Act, the
21Internet Caller Identification Act, paragraph (6) of
22subsection (k) of Section 6-305 of the Illinois Vehicle Code,
23Section 11-1431, 18d-115, 18d-120, 18d-125, 18d-135, 18d-150,
24or 18d-153 of the Illinois Vehicle Code, Article 3 of the



10000SB0575sam001- 7 -LRB100 04833 HEP 39116 a

1Residential Real Property Disclosure Act, the Automatic
2Contract Renewal Act, the Reverse Mortgage Act, Section 25 of
3the Youth Mental Health Protection Act, the Personal
4Information Protection Act, or the Student Online Personal
5Protection Act, or the Keep Internet Devices Safe Act commits
6an unlawful practice within the meaning of this Act.
7(Source: P.A. 99-331, eff. 1-1-16; 99-411, eff. 1-1-16; 99-642,
8eff. 7-28-16; 100-315, eff. 8-24-17; 100-416, eff. 1-1-18;
9revised 10-6-17.)".