HB3449enr 100TH GENERAL ASSEMBLY

HB3449 Enrolled LRB100 08543 HEP 18668 b

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Geolocation Privacy Protection Act.

Section 5. Definitions. As used in this Act:

"Geolocation information" means information that: (i) is not the contents of a communication; (ii) is generated by or derived from, in whole or in part, the operation of a mobile device, including, but not limited to, a smart phone, tablet, or laptop computer; and (iii) is sufficient to determine or infer the precise location of that device. "Geolocation information" does not include Internet protocol addresses.

"Location-based application" means a software application that is downloaded or installed onto a mobile device and collects, uses, or stores geolocation information.

"Private entity" means any individual, partnership, corporation, limited liability company, association, or other group, however organized. "Private entity" does not include any governmental agency.

Section 10. Collection, use, storage, and disclosure of geolocation information from location-based applications.

(a) A private entity may not collect, use, store, or disclose geolocation information from a location-based application on a person's device unless the private entity first receives the person's affirmative express consent after providing clear, prominent, and accurate notice that:

(1) informs the person that his or her geolocation information will be collected, used, or disclosed;

(2) informs the person in writing of the specific purposes for which his or her geolocation information will be collected, used, or disclosed; and

(3) provides the person a hyperlink or comparably easily accessible means to access the information specified in this subsection.

(b) A private entity may collect, use, store, or disclose geolocation information from a location-based application on a person's device without receiving affirmative express consent if the collection, storage, or disclosure is:

(1) to allow a parent or legal guardian to locate an unemancipated minor child;

(2) to allow a court-appointed guardian to locate a legally incapacitated person;

(3) for the provision of fire, medical, public safety, or other emergency services; or

(4) for the limited purpose of providing storage, security, or authentication services.

(c) A private entity need not obtain a person's affirmative express consent after the person's initial consent as described in subsection (a) has been obtained unless the terms previously agreed to under items (1), (2), and (3) of subsection (a) are materially changed.

(d) This Section applies to location-based applications created or modified after the effective date of this Act.

Section 15. Violation.

(a) A violation of this Act constitutes a violation of the Consumer Fraud and Deceptive Business Practices Act. Only a State's Attorney or the Attorney General may enforce a violation of this Act as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, including when an agreement is void and unenforceable pursuant to Section 20 of this Act.

(b) A private entity, other than an individual, that is in violation of this Act shall have 15 days after being notified of a violation to rectify that violation before the Attorney General or appropriate State's Attorney's Office may seek an enforcement action against that private entity.

Section 20. Waivers; contracts.

(a) Any waiver of the provisions of this Act is void and unenforceable.

(b) Any agreement created or modified after the effective date of this Act that does not comply with this Act is void and unenforceable. An agreement that is void and unenforceable under this Section does not give rise to a private right of action under this Act.

Section 25. Applicability. This Act does not apply to: (i) a health care provider or other covered entity subject to the Federal Health Insurance Portability and Accountability Act of 1996 and the rules promulgated thereunder; (ii) a financial institution or an affiliate of a financial institution that is subject to Title V of the Federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder; (iii) Internet, wireless, or telecommunications service providers; (iv) video service providers under Article XXI of the Public Utilities Act; (v) a person licensed as a private detective pursuant to the Private Detective, Private Alarm, Private Security, Fingerprint Vendor, and Locksmith Act of 2004; (vi) an individual or firm licensed under the Illinois Professional Land Surveyor Act of 1989 or the Professional Engineering Practice Act of 1989; (vii) a public utility, as defined in Section 3-105 of the Public Utilities Act, an alternative retail electric supplier, as defined in Section 16-102 of the Public Utilities Act, an alternative gas supplier, as defined in Section 19-105 of the Public Utilities Act, or the employees or agents of those entities; or (viii) any candidate, volunteer, employee, agent, or vendor of a candidate political committee, political party committee, political action committee, ballot initiative committee, or independent expenditure committee, as defined in Section 9-1.8 of the Election Code.

Section 90. The Consumer Fraud and Deceptive Business Practices Act is amended by changing Section 2Z as follows:

(815 ILCS 505/2Z) (from Ch. 121 1/2, par. 262Z)

Sec. 2Z. Violations of other Acts. Any person who knowingly violates the Automotive Repair Act, the Automotive Collision Repair Act, the Home Repair and Remodeling Act, the Dance Studio Act, the Geolocation Privacy Protection Act, the Physical Fitness Services Act, the Hearing Instrument Consumer Protection Act, the Illinois Union Label Act, the Job Referral and Job Listing Services Consumer Protection Act, the Travel Promotion Consumer Protection Act, the Credit Services Organizations Act, the Automatic Telephone Dialers Act, the Pay-Per-Call Services Consumer Protection Act, the Telephone Solicitations Act, the Illinois Funeral or Burial Funds Act, the Cemetery Oversight Act, the Cemetery Care Act, the Safe and Hygienic Bed Act, the Pre-Need Cemetery Sales Act, the High Risk Home Loan Act, the Payday Loan Reform Act, the Mortgage Rescue Fraud Act, subsection (a) or (b) of Section 3-10 of the Cigarette Tax Act, subsection (a) or (b) of Section 3-10 of the Cigarette Use Tax Act, the Electronic Mail Act, the Internet Caller Identification Act, paragraph (6) of subsection (k) of Section 6-305 of the Illinois Vehicle Code, Section 11-1431, 18d-115, 18d-120, 18d-125, 18d-135, 18d-150, or 18d-153 of the Illinois Vehicle Code, Article 3 of the Residential Real Property Disclosure Act, the Automatic Contract Renewal Act, the Reverse Mortgage Act, Section 25 of the Youth Mental Health Protection Act, or the Personal Information Protection Act commits an unlawful practice within the meaning of this Act.

(Source: P.A. 99-331, eff. 1-1-16; 99-411, eff. 1-1-16; 99-642, eff. 7-28-16.)