102ND GENERAL ASSEMBLY
State of Illinois
2021 and 2022
HB3453

 

Introduced 2/22/2021, by Rep. Ann M. Williams

 

SYNOPSIS AS INTRODUCED:
 
New Act

    Creates the Geolocation Privacy Protection Act. Provides that a private entity that owns, operates, or controls a location-based application on a user's device may not disclose geolocation information from a location-based application to a third party unless the private entity first receives the user's affirmative express consent after providing a specified notice to the user. Sets forth the purposes for which disclosure may be made. Provides that a violation of the Act constitutes an unlawful practice for which the Attorney General may take appropriate action under the Consumer Fraud and Deceptive Business Practices Act. Provides that the Act does not modify, limit, or supersede the operation of any other Illinois law or prevent a party from otherwise seeking relief under the Code of Civil Procedure. Provides that waiver of the provisions of the Act is void and unenforceable and an agreement that does not comply with the Act is void and unenforceable. Providers that the Act does not apply to certain entities.


LRB102 11785 JLS 17120 b

FISCAL NOTE ACT MAY APPLY

 

 

A BILL FOR

 

HB3453LRB102 11785 JLS 17120 b

1    AN ACT concerning business.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 1. Short title. This Act may be cited as the
5Geolocation Privacy Protection Act.
 
6    Section 5. Definitions. As used in this Act:
7    "Consent" means a clear affirmative act signifying a
8specific, informed, and unambiguous indication of a person's
9agreement, including through a written agreement or other
10clear affirmative action, that shall be valid only after all
11information as required by Section 10 has been disclosed to
12that person. "Consent" does not include only the continued use
13of a website or online service.
14    "Consumer transaction" means the disclosure of geolocation
15information for the purpose of moving or delivering tangible
16personal property made by a private entity or, with the
17private entity's authorization, the private entity's affiliate
18or service provider to process a consumer transaction.
19    "Disclose" means to disclose, release, transfer, share,
20disseminate, make available, sell, or otherwise communicate
21orally, in writing, or by electronic or any other means a
22consumer's geolocation information to any third party.
23    "Geolocation information" means information that: (i) is

 

 

HB3453- 2 -LRB102 11785 JLS 17120 b

1not the contents of a communication; (ii) is generated by or
2derived from, in whole or in part, the operation of a mobile
3device, including, but not limited to, a smart phone, tablet,
4or laptop computer; and (iii) is sufficient to determine or
5infer the precise geolocation of that device. "Geolocation
6information" does not include Internet protocol addresses.
7    "Location-based application" means a software application
8that is downloaded or installed onto a device and collects,
9uses, or stores geolocation information.
10    "Private entity" means any individual, partnership,
11corporation, limited liability company, association, or other
12group, however organized. "Private entity" does not include
13any governmental agency.
14    "User" means a resident of this State who purchases or
15leases a device.
 
16    Section 10. Disclosure of geolocation information from
17location-based applications.
18    (a) A private entity that owns, operates, or controls a
19location-based application on a user's device may not disclose
20geolocation information from a location-based application to a
21third party unless the private entity first receives the
22user's affirmative express consent after providing clear and
23accurate notice that:
24        (1) informs the user that his or her geolocation
25    information will be disclosed;

 

 

HB3453- 3 -LRB102 11785 JLS 17120 b

1        (2) informs the user of the purpose or purposes for
2    which his or her geolocation information will be
3    disclosed; and
4        (3) identifies the names and categories of private
5    entities to which geolocation information may be
6    disclosed.
7    (b) A private entity may disclose geolocation information
8from a location-based application on a user's device without
9receiving affirmative express consent if the disclosure is:
10        (1) to allow a parent or legal guardian to locate an
11    unemancipated minor child;
12        (2) to allow a court-appointed guardian to locate a
13    legally incapacitated person;
14        (3) in connection with fire, medical, public safety,
15    or other emergency services;
16        (4) to comply with a subpoena or court order; or
17        (5) made in connection with a consumer transaction
18    entered into by a consumer where a reasonable consumer
19    would expect the geolocation information to be disclosed.
20    (c) This Section does not apply to geolocation information
21that is stored locally and is not removed from a user's device.
22    (d) A private entity need not obtain a user's affirmative
23express consent after the user's initial consent as described
24in subsection (a) has been obtained unless the terms
25previously agreed to under items (1), (2), and (3) of
26subsection (a) are materially changed.

 

 

HB3453- 4 -LRB102 11785 JLS 17120 b

1    (e) This Section applies only to location-based
2applications created or modified after the effective date of
3this Act.
 
4    Section 15. Violations and enforcement. A violation of
5this Act constitutes an unlawful practice for which the
6Attorney General may take appropriate action under the
7Consumer Fraud and Deceptive Business Practices Act. All
8remedies, penalties, and authority granted to the Attorney
9General by that Act shall be available to the Attorney General
10for the enforcement of this Act. There shall be no private
11right of action to enforce violations under this Act.
 
12    Section 20. Compliance; contracts; waivers.
13    (a) Nothing in this Act shall be construed to modify,
14limit, or supersede the operation of any other Illinois law or
15prevent a party from otherwise seeking relief under the Code
16of Civil Procedure.
17    (b) Any waiver of the provisions of this Act is void and
18unenforceable. Any agreement created or modified after the
19effective date of this Act that does not comply with this Act
20is void and unenforceable.
 
21    Section 25. Applicability. This Act does not apply to:
22        (1) a health care provider or other covered entity
23    that is subject to the Federal Health Insurance

 

 

HB3453- 5 -LRB102 11785 JLS 17120 b

1    Portability and Accountability Act of 1996 and the rules
2    promulgated thereunder and that is disclosing geolocation
3    information in accordance with that Act;
4        (2) a financial institution or an affiliate of a
5    financial institution that is subject to Title V of the
6    federal Gramm-Leach-Bliley Act and the rules promulgated
7    thereunder and that is disclosing geolocation information
8    in accordance with that Act; or
9        (3) entities regulated under the Transportation
10    Network Providers Act or any of their subsidiaries that
11    own, operate, or control a location-based application, the
12    sole function of which is to provide transportation
13    services based on geolocation information, to the extent
14    that these entities or their subsidiaries disclose the
15    geolocation information for the sole purpose of providing
16    a service requested by the individual or the use is
17    otherwise consistent with that individual's reasonable
18    expectations considering the context in which the
19    individual provided the geolocation information to these
20    entities.