Full Text of HB3453 102nd General Assembly
HB3453 102ND GENERAL ASSEMBLY
102ND GENERAL ASSEMBLY
State of Illinois
2021 and 2022
Introduced 2/22/2021, by Rep. Ann M. Williams
SYNOPSIS AS INTRODUCED:
Creates the Geolocation Privacy Protection Act. Provides that a
private entity that owns, operates, or controls a location-based
application on a user's device may not disclose geolocation information
from a location-based application to a third party unless the private
entity first receives the user's affirmative express consent after
providing a specified notice to the user. Sets forth the purposes for which
disclosure may be made. Provides that a violation of the Act constitutes an
unlawful practice for which the Attorney General may take appropriate
action under the Consumer Fraud and Deceptive Business Practices Act.
Provides that the Act does not modify, limit, or supersede the operation of
any other Illinois law or prevent a party from otherwise seeking relief
under the Code of Civil Procedure. Provides that waiver of the provisions
of the Act is void and unenforceable and an agreement that does not comply
with the Act is void and unenforceable. Providers that the Act does not
apply to certain entities.
|FISCAL NOTE ACT MAY APPLY|
A BILL FOR
|HB3453||LRB102 11785 JLS 17120 b|
AN ACT concerning business.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
This Act may be cited as the
Geolocation Privacy Protection Act.
As used in this Act:
"Consent" means a clear affirmative act signifying a
specific, informed, and unambiguous indication of a person's
agreement, including through a written agreement or other
clear affirmative action, that shall be valid only after all
information as required by Section 10 has been disclosed to
that person. "Consent" does not include only the continued use
of a website or online service.
"Consumer transaction" means the disclosure of geolocation
information for the purpose of moving or delivering tangible
personal property made by a private entity or, with the
private entity's authorization, the private entity's affiliate
or service provider to process a consumer transaction.
"Disclose" means to disclose, release, transfer, share,
disseminate, make available, sell, or otherwise communicate
orally, in writing, or by electronic or any other means a
consumer's geolocation information to any third party.
"Geolocation information" means information that: (i) is
|HB3453||- 2 -||LRB102 11785 JLS 17120 b|
not the contents of a communication; (ii) is generated by or
derived from, in whole or in part, the operation of a mobile
device, including, but not limited to, a smart phone, tablet,
or laptop computer; and (iii) is sufficient to determine or
infer the precise geolocation of that device. "Geolocation
information" does not include Internet protocol addresses.
"Location-based application" means a software application
that is downloaded or installed onto a device and collects,
uses, or stores geolocation information.
"Private entity" means any individual, partnership,
corporation, limited liability company, association, or other
group, however organized. "Private entity" does not include
any governmental agency.
"User" means a resident of this State who purchases or
leases a device.
Disclosure of geolocation information from
(a) A private entity that owns, operates, or controls a
location-based application on a user's device may not disclose
geolocation information from a location-based application to a
third party unless the private entity first receives the
user's affirmative express consent after providing clear and
accurate notice that:
(1) informs the user that his or her geolocation
information will be disclosed;
|HB3453||- 3 -||LRB102 11785 JLS 17120 b|
(2) informs the user of the purpose or purposes for
which his or her geolocation information will be
(3) identifies the names and categories of private
entities to which geolocation information may be
(b) A private entity may disclose geolocation information
from a location-based application on a user's device without
receiving affirmative express consent if the disclosure is:
(1) to allow a parent or legal guardian to locate an
unemancipated minor child;
(2) to allow a court-appointed guardian to locate a
legally incapacitated person;
(3) in connection with fire, medical, public safety,
or other emergency services;
(4) to comply with a subpoena or court order; or
(5) made in connection with a consumer transaction
entered into by a consumer where a reasonable consumer
would expect the geolocation information to be disclosed.
(c) This Section does not apply to geolocation information
that is stored locally and is not removed from a user's device.
(d) A private entity need not obtain a user's affirmative
express consent after the user's initial consent as described
in subsection (a) has been obtained unless the terms
previously agreed to under items (1), (2), and (3) of
subsection (a) are materially changed.
|HB3453||- 4 -||LRB102 11785 JLS 17120 b|
(e) This Section applies only to location-based
applications created or modified after the effective date of
Violations and enforcement.
A violation of
this Act constitutes an unlawful practice for which the
Attorney General may take appropriate action under the
Consumer Fraud and Deceptive Business Practices Act. All
remedies, penalties, and authority granted to the Attorney
General by that Act shall be available to the Attorney General
for the enforcement of this Act. There shall be no private
right of action to enforce violations under this Act.
Compliance; contracts; waivers.
(a) Nothing in this Act shall be construed to modify,
limit, or supersede the operation of any other Illinois law or
prevent a party from otherwise seeking relief under the Code
of Civil Procedure.
(b) Any waiver of the provisions of this Act is void and
unenforceable. Any agreement created or modified after the
effective date of this Act that does not comply with this Act
is void and unenforceable.
This Act does not apply to:
(1) a health care provider or other covered entity
that is subject to the Federal Health Insurance
|HB3453||- 5 -||LRB102 11785 JLS 17120 b|
Portability and Accountability Act of 1996 and the rules
promulgated thereunder and that is disclosing geolocation
information in accordance with that Act;
(2) a financial institution or an affiliate of a
financial institution that is subject to Title V of the
federal Gramm-Leach-Bliley Act and the rules promulgated
thereunder and that is disclosing geolocation information
in accordance with that Act; or
(3) entities regulated under the Transportation
Network Providers Act or any of their subsidiaries that
own, operate, or control a location-based application, the
sole function of which is to provide transportation
services based on geolocation information, to the extent
that these entities or their subsidiaries disclose the
geolocation information for the sole purpose of providing
a service requested by the individual or the use is
otherwise consistent with that individual's reasonable
expectations considering the context in which the
individual provided the geolocation information to these