Bill Text: IL HB3453 | 2021-2022 | 102nd General Assembly | Introduced

---

Bill Title: Creates the Geolocation Privacy Protection Act. Provides that a private entity that owns, operates, or controls a location-based application on a user's device may not disclose geolocation information from a location-based application to a third party unless the private entity first receives the user's affirmative express consent after providing a specified notice to the user. Sets forth the purposes for which disclosure may be made. Provides that a violation of the Act constitutes an unlawful practice for which the Attorney General may take appropriate action under the Consumer Fraud and Deceptive Business Practices Act. Provides that the Act does not modify, limit, or supersede the operation of any other Illinois law or prevent a party from otherwise seeking relief under the Code of Civil Procedure. Provides that waiver of the provisions of the Act is void and unenforceable and an agreement that does not comply with the Act is void and unenforceable. Provides that the Act does not apply to certain entities.

Spectrum: Partisan Bill (Democrat 3-0)

Status: (Introduced - Dead) 2022-02-18 - Rule 19(a) / Re-referred to Rules Committee [HB3453 Detail]

Download: Illinois-2021-HB3453-Introduced.html

---

102ND GENERAL ASSEMBLY State of Illinois 2021 and 2022 HB3453 Introduced , by Rep. Ann M. Williams SYNOPSIS AS INTRODUCED:
New Act
Creates the Geolocation Privacy Protection Act. Provides that a private entity that owns, operates, or controls a location-based application on a user's device may not disclose geolocation information from a location-based application to a third party unless the private entity first receives the user's affirmative express consent after providing a specified notice to the user. Sets forth the purposes for which disclosure may be made. Provides that a violation of the Act constitutes an unlawful practice for which the Attorney General may take appropriate action under the Consumer Fraud and Deceptive Business Practices Act. Provides that the Act does not modify, limit, or supersede the operation of any other Illinois law or prevent a party from otherwise seeking relief under the Code of Civil Procedure. Provides that waiver of the provisions of the Act is void and unenforceable and an agreement that does not comply with the Act is void and unenforceable. Providers that the Act does not apply to certain entities.
LRB102 11785 JLS 17120 b
FISCAL NOTE ACT MAY APPLY
A BILL FOR
HB3453 LRB102 11785 JLS 17120 b
AN ACT concerning business.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 1. Short title. This Act may be cited as the
Geolocation Privacy Protection Act.
Section 5. Definitions. As used in this Act:
"Consent" means a clear affirmative act signifying a
specific, informed, and unambiguous indication of a person's
agreement, including through a written agreement or other
clear affirmative action, that shall be valid only after all
information as required by Section 10 has been disclosed to
that person. "Consent" does not include only the continued use
of a website or online service.
"Consumer transaction" means the disclosure of geolocation
information for the purpose of moving or delivering tangible
personal property made by a private entity or, with the
private entity's authorization, the private entity's affiliate
or service provider to process a consumer transaction.
"Disclose" means to disclose, release, transfer, share,
disseminate, make available, sell, or otherwise communicate
orally, in writing, or by electronic or any other means a
consumer's geolocation information to any third party.
"Geolocation information" means information that: (i) is

HB3453 - 2 - LRB102 11785 JLS 17120 b
not the contents of a communication; (ii) is generated by or
derived from, in whole or in part, the operation of a mobile
device, including, but not limited to, a smart phone, tablet,
or laptop computer; and (iii) is sufficient to determine or
infer the precise geolocation of that device. "Geolocation
information" does not include Internet protocol addresses.
"Location-based application" means a software application
that is downloaded or installed onto a device and collects,
uses, or stores geolocation information.
"Private entity" means any individual, partnership,
corporation, limited liability company, association, or other
group, however organized. "Private entity" does not include
any governmental agency.
"User" means a resident of this State who purchases or
leases a device.
Section 10. Disclosure of geolocation information from
location-based applications.
(a) A private entity that owns, operates, or controls a
location-based application on a user's device may not disclose
geolocation information from a location-based application to a
third party unless the private entity first receives the
user's affirmative express consent after providing clear and
accurate notice that:
(1) informs the user that his or her geolocation
information will be disclosed;

HB3453 - 3 - LRB102 11785 JLS 17120 b
(2) informs the user of the purpose or purposes for
which his or her geolocation information will be
disclosed; and
(3) identifies the names and categories of private
entities to which geolocation information may be
disclosed.
(b) A private entity may disclose geolocation information
from a location-based application on a user's device without
receiving affirmative express consent if the disclosure is:
(1) to allow a parent or legal guardian to locate an
unemancipated minor child;
(2) to allow a court-appointed guardian to locate a
legally incapacitated person;
(3) in connection with fire, medical, public safety,
or other emergency services;
(4) to comply with a subpoena or court order; or
(5) made in connection with a consumer transaction
entered into by a consumer where a reasonable consumer
would expect the geolocation information to be disclosed.
(c) This Section does not apply to geolocation information
that is stored locally and is not removed from a user's device.
(d) A private entity need not obtain a user's affirmative
express consent after the user's initial consent as described
in subsection (a) has been obtained unless the terms
previously agreed to under items (1), (2), and (3) of
subsection (a) are materially changed.

HB3453 - 4 - LRB102 11785 JLS 17120 b
(e) This Section applies only to location-based
applications created or modified after the effective date of
this Act.
Section 15. Violations and enforcement. A violation of
this Act constitutes an unlawful practice for which the
Attorney General may take appropriate action under the
Consumer Fraud and Deceptive Business Practices Act. All
remedies, penalties, and authority granted to the Attorney
General by that Act shall be available to the Attorney General
for the enforcement of this Act. There shall be no private
right of action to enforce violations under this Act.
Section 20. Compliance; contracts; waivers.
(a) Nothing in this Act shall be construed to modify,
limit, or supersede the operation of any other Illinois law or
prevent a party from otherwise seeking relief under the Code
of Civil Procedure.
(b) Any waiver of the provisions of this Act is void and
unenforceable. Any agreement created or modified after the
effective date of this Act that does not comply with this Act
is void and unenforceable.
Section 25. Applicability. This Act does not apply to:
(1) a health care provider or other covered entity
that is subject to the Federal Health Insurance

HB3453 - 5 - LRB102 11785 JLS 17120 b
Portability and Accountability Act of 1996 and the rules
promulgated thereunder and that is disclosing geolocation
information in accordance with that Act;
(2) a financial institution or an affiliate of a
financial institution that is subject to Title V of the
federal Gramm-Leach-Bliley Act and the rules promulgated
thereunder and that is disclosing geolocation information
in accordance with that Act; or
(3) entities regulated under the Transportation
Network Providers Act or any of their subsidiaries that
own, operate, or control a location-based application, the
sole function of which is to provide transportation
services based on geolocation information, to the extent
that these entities or their subsidiaries disclose the
geolocation information for the sole purpose of providing
a service requested by the individual or the use is
otherwise consistent with that individual's reasonable
expectations considering the context in which the
individual provided the geolocation information to these
entities.