Illinois General Assembly - Full Text of HB3712

LRB104 12247 JRC 22354 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
HB3712

Introduced 2/18/2025, by Rep. Ann M. Williams

SYNOPSIS AS INTRODUCED:

New Act

Creates the Privacy Protections for Location Information Derived from Electronic Devices Act. Makes it unlawful for a covered entity to collect or process an individual's location information except for a permissible purpose. Provides that before collecting or processing an individual's location information for one of those permissible purposes, a covered entity shall provide the individual with a copy of the location privacy policy and obtain consent from that individual Authorizes a civil action in which if the plaintiff prevails, the court may award (1) actual damages including damages for emotional distress, or $5,000 per violation, whichever is greater; (2) punitive damages; and (3) any other relief. Provides that in addition to any relief awarded, the court shall award reasonable attorney's fees and costs to any prevailing plaintiff. Defines terms. Makes other changes.

A BILL FOR

AN ACT concerning civil law.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Privacy Protections for Location Information Derived from Electronic Devices Act.

Section 5. Legislative intent. The General Assembly intends to protect the reproductive health access, safety of LGBTQ lives, religious liberty, and freedom of movement by passage of this Act.

Section 10. Definitions. As used in this Act:

"Application" means a software program that runs on the operating system of a device.

"Collect" means to obtain, infer, generate, create, receive, or access an individual's location information.

"Consent" means freely given, specific, informed, unambiguous, opt-in consent. "Consent" does not include (i) agreement secured without first providing to the individual a clear and conspicuous disclosure of all information material to the provision of consent, apart from any privacy policy, terms of service, terms of use, general release, user agreement, or other similar document; or (ii) agreement obtained through the use of a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice.

"Covered entity" means any individual, partnership, corporation, limited liability company, association, or other group, however organized. "Covered entity" includes all agents of the entity. "Covered entity" does not include a State or local government agency, or a State court, a clerk of the court, or a judge or justice. "Covered entity" does not include an individual acting in a noncommercial context.

"Device" means a mobile telephone or any other electronic device that is or may commonly be carried by or on an individual or that is a component part of a motor vehicle and is capable of connecting to a cellular, bluetooth, or other wireless network.

"Disclose" means to make location information available to a third party, including, but not limited to, by sharing, publishing, releasing, transferring, disseminating, providing access to, or otherwise communicating such location information orally, in writing, electronically, or by any other means.

"Individual" means a person located in the State.

"Location information" means information derived from a device or from interactions between devices, with or without the knowledge of the user and regardless of the technological method used, that pertains to or directly or indirectly reveals the present or past geographical location of an individual or device within the State with sufficient precision to identify street-level location information within a range of 1,850 feet or less. "Location information" includes, but is not limited to, (i) an internet protocol address capable of revealing the physical or geographical location of an individual, (ii) Global Positioning System (GPS) coordinates; and (iii) cell-site location information. "Location information" does not include location information identifiable or derived solely from the visual content of a legally obtained image, including the location of the device that captured such image or publicly posted words.

"Location privacy policy" means a description of the policies, practices, and procedures controlling a covered entity's collection, processing, management, storage, retention, and deletion of location information.

"Monetize" means to collect, process, or disclose an individual's location information for profit or in exchange for monetary or other consideration. "Monetize" includes, but is not limited to, selling, renting, trading, or leasing location information.

"Person" means any natural person.

"Permissible purpose" means one of the following purposes: (i) provision of a product, service, or service feature to the individual to whom the location information pertains when that individual requested the provision of such product, service, or service feature by subscribing to, creating an account, or otherwise contracting with a covered entity; (ii) initiation, management, execution, or completion of a financial or commercial transaction or fulfill an order for specific products or services requested by an individual, including any associated routine administrative, operational, and account-servicing activity such as billing, shipping, delivery, storage, and accounting; (iii) compliance with an obligation under federal or State law; or (iv) response to an emergency service agency, an emergency alert, a 911 communication, or any other communication reporting an imminent threat to human life.

"Process" means to perform any action or set of actions on or with location information, including, but not limited to, collecting, accessing, using, storing, retaining, analyzing, creating, generating, aggregating, altering, correlating, operating on, recording, modifying, organizing, structuring, disposing of, destroying, deidentifying, or otherwise manipulating location information. "Process" does not include disclosing location information.

"Reasonably understandable" means of length and complexity such that an individual with an 8th-grade reading level, as established by the State Board of Education, can read and comprehend.

"Service feature" means a discrete aspect of a service provided by a covered entity, including, but not limited to, real-time directions, real-time weather, and identity authentication.

"Service provider" means an individual, partnership, corporation, limited liability company, association, or other group, however organized, that collects, processes, or transfers location information for the sole purpose of, and only to the extent that such service provider is, conducting business activities on behalf of, for the benefit of, at the direction of, and under contractual agreement with a covered entity.

"Third party" means any covered entity or person other than (i) a covered entity that collected or processed location information in accordance with this Act or its service providers or (ii) the individual to whom the location information pertains.

Section 15. Protection of location information.

(a) It is unlawful for a covered entity to collect or process an individual's location information except for a permissible purpose. Before collecting or processing an individual's location information for one of those permissible purposes, a covered entity shall provide the individual with a copy of the location privacy policy and obtain consent from that individual; however, this shall not be required when the collection and processing is done in (i) compliance with an obligation under federal or State law or (ii) in response to an emergency service agency, an emergency alert, a 911 communication, or any other communication reporting an imminent threat to human life. For purposes of this subsection, a consumer accessing, procuring, or searching for services regarding contraception, pregnancy care, including, but not limited to, abortion services, does not constitute an imminent threat to human life.

(b) If a covered entity collects location information for the provision of multiple permissible purposes, it should be mentioned in the location privacy policy and individuals shall provide discrete consent for each purpose; however, this shall not be required for the purpose of collecting and processing location information to comply with an obligation under federal or State law or to respond to an emergency service agency, an emergency alert, a 911 communication, or any other communication reporting an imminent threat to human life.

(c) A covered entity that directly delivers targeted advertisements as part of its product or services shall provide individuals with a clear, conspicuous, and simple means to opt out of the processing of their location information for purposes of selecting and delivering targeted advertisements.

(d) Consent provided under this Section expires (i) after one year, (ii) when the initial purpose for processing the information has been satisfied, or (iii) when the individual revokes consent, whichever occurs first, as long as the consent may be renewed pursuant to the same procedures. Upon expiration of consent, any location information possessed by a covered entity must be permanently destroyed.

(e) It shall be unlawful for a covered entity or service provider that lawfully collects and processes location information to:

(1) collect more precise location information than necessary to carry out the permissible purpose;

(2) retain location information longer than necessary to carry out the permissible purpose;

(3) sell, rent, trade, or lease location information to third parties;

(4) derive or infer from location information any data that is not necessary to carry out a permissible purpose; or

(5) disclose, cause to disclose, or assist with or facilitate the disclosure of an individual's location information to third parties, unless such disclosure is (i) necessary to carry out the permissible purpose for which the information was collected or (ii) requested by the individual to whom the location data pertains.

(f) It is unlawful for a covered entity or service providers to disclose location information to any federal, State, or local government agency or official unless:

(1) the agency or official serves the covered entity or service provider with a valid warrant;

(2) disclosure is mandated under federal or State law;

(3) the data subject requests such disclosure; or

(4) a natural person is at risk or danger of death or serious physical injury, as long as:

(A) the request is approved by a high-ranking agency officer for emergency access to a consumer's personal information;

(B) the request is based on the agency's good faith determination that it has a lawful basis to access the information on a nonemergency basis; and

(C) the agency agrees to petition a court for an appropriate order within 3 days and to destroy the information if that order is not granted.

For purposes of this subsection, a consumer accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services, does not constitute a natural person being at risk or danger of death or serious physical injury.

(g) A covered entity shall maintain and make available to the data subject a location privacy policy, which shall include, at a minimum, the following:

(1) the permissible purpose for which the covered entity is collecting, processing, or disclosing any location information;

(2) the type of location information collected, including the precision of the data;

(3) the identities of service providers with which the covered entity contracts with respect to location data;

(4) any disclosures of location data necessary to carry out a permissible purpose and the identities of the third parties to whom the location information could be disclosed;

(5) whether the covered entity's practices include the internal use of location information for purposes of targeted advertisement;

(6) the data management and data security policies governing location information; and

(7) the retention schedule and guidelines for permanently deleting location information.

(h) A covered entity in lawful possession of location information shall provide notice to individuals to whom that information pertains of any change to its location privacy policy at least 20 business days before the change goes into effect and shall request and obtain consent before collecting or processing location information in accordance with the new location privacy policy.

(i) It shall be unlawful for a governmental entity to monetize location information.

Section 20. Prohibition against retaliation. A covered entity may not take adverse action against an individual because the individual exercised or refused to waive any of such individual's rights under this Act, unless location data is essential to the provision of the good, service, or service feature that the individual requests, and then only to the extent that this data is essential. This prohibition includes, but is not limited to:

(1) refusing to provide a good or service to the individual;

(2) charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; or

(3) providing a different level or quality of goods or services to the individual.

Section 25. Enforcement.

(a) A violation of this Act or a rule adopted by the Department of Innovation and Technology regarding an individual's location information constitutes an injury to that individual.

(b) Any individual alleging a violation of this Act by a covered entity or service provider may bring a civil action in State court.

(c) An individual protected by this Act may not be required, as a condition of service or otherwise, to accept mandatory arbitration of a claim arising under this Act.

(d) In a civil action in which the plaintiff prevails, the court may award:

(1) actual damages, including damages for emotional distress, or $5,000 per violation, whichever is greater;

(2) punitive damages; and

(3) any other relief, including, but not limited to, an injunction or declaratory judgment that the court deems to be appropriate.

(e) For purposes of subsection (e) of Section 15, a covered entity that, in more than one instance, violates (1) through (4) of Section 15, from the same person using the same method of collection or sale in violation of subsection (e) of Section 15 has committed a single violation of subsection (e) of Section 15 for which the aggrieved person is entitled to, at most, one recovery under this Section.

(f) For purposes of subsection (f) of Section 15, the court shall consider each instance in which a covered entity or service provider collects, processes, or discloses location information in a manner prohibited by subsection (f) of Section 15 as constituting a separate violation of this Act or rule adopted under this Act.

(g) Upon motion, a court shall award reasonable attorney's fees and costs, including expert witness fees and other litigation expenses, to a plaintiff who is a prevailing party in any action brought under this Act. In awarding reasonable attorney's fees, the court shall consider the degree to which the relief obtained relates to the relief sought.

(h) For the purpose of this Act, "prevailing party" includes any party:

(1) who obtains some of the requested relief through a favorable judicial judgment;

(2) who obtains some of the requested relief through any settlement agreement approved by the court; or

(3) whose pursuit of a nonfrivolous claim was a catalyst for a unilateral change in position by the opposing party relative to the relief sought.

(i) Any provision of a contract or agreement of any kind, including a covered entity's terms of service or policies, including, but not limited to, the location privacy policy, that purports to waive or limit in any way an individual's rights under this Act, including, but not limited to, any right to a remedy or means of enforcement, is deemed contrary to State law and is void and unenforceable.

(j) No private or government action brought under this Act precludes any other action under this Act.

Section 30. Nonapplicability. This Act does not apply to location information collected from a patient by a health care provider or health care facility, or collected, processed, used, or stored exclusively for medical education or research, public health or epidemiological purposes, health care treatment, health insurance, payment, or operations, if the information is protected from disclosure under the federal Health Insurance Portability and Accountability Act of 1996 or other applicable federal and State laws, rules, and regulations.