Bill Text: IL HB3449 | 2017-2018 | 100th General Assembly | Enrolled


Bill Title: Creates the Geolocation Privacy Protection Act. Defines "geolocation information", "location-based application", and "private entity". Provides that a private entity may not collect, use, store, or disclose geolocation information from a location-based application on a person's device unless the private entity first receives the person's affirmative express consent after complying with specified notice requirements. Provides exceptions. Provides that a person whose rights are violated may recover: (1) liquidated damages of $1,000 or actual damages, whichever is greater; (2) reasonable attorney's fees and costs; and (3) other relief, including an injunction, as the court may deem appropriate. Provides that authority to seek remedies and impose penalties granted to the Attorney General under the Consumer Fraud and Deceptive Business Practices Act is also granted to the Attorney General for the enforcement of the Geolocation Privacy Protection Act. Provides that in any action brought by the Attorney General to enforce the Act, the court may order that persons who incurred actual damages be awarded 3 times the amount at which actual damages are assessed. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Provides that the provisions of the Act may not be waived. Contains applicability language. Makes a corresponding change in the Consumer Fraud and Deceptive Business Practices Act. Effective immediately.

Spectrum: Partisan Bill (Democrat 41-1)

Status: (Enrolled) 2017-07-26 - Sent to the Governor [HB3449 Detail]

Download: Illinois-2017-HB3449-Enrolled.html



HB3449 EnrolledLRB100 08543 HEP 18668 b
1 AN ACT concerning business.
2 Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
4 Section 1. Short title. This Act may be cited as the
5Geolocation Privacy Protection Act.
6 Section 5. Definitions. As used in this Act:
7 "Geolocation information" means information that: (i) is
8not the contents of a communication; (ii) is generated by or
9derived from, in whole or in part, the operation of a mobile
10device, including, but not limited to, a smart phone, tablet,
11or laptop computer; and (iii) is sufficient to determine or
12infer the precise location of that device. "Geolocation
13information" does not include Internet protocol addresses.
14 "Location-based application" means a software application
15that is downloaded or installed onto a mobile device and
16collects, uses, or stores geolocation information.
17 "Private entity" means any individual, partnership,
18corporation, limited liability company, association, or other
19group, however organized. "Private entity" does not include any
20governmental agency.
21 Section 10. Collection, use, storage, and disclosure of
22geolocation information from location-based applications.

HB3449 Enrolled- 2 -LRB100 08543 HEP 18668 b
1 (a) A private entity may not collect, use, store, or
2disclose geolocation information from a location-based
3application on a person's device unless the private entity
4first receives the person's affirmative express consent after
5providing clear, prominent, and accurate notice that:
6 (1) informs the person that his or her geolocation
7 information will be collected, used, or disclosed;
8 (2) informs the person in writing of the specific
9 purposes for which his or her geolocation information will
10 be collected, used, or disclosed; and
11 (3) provides the person a hyperlink or comparably
12 easily accessible means to access the information
13 specified in this subsection.
14 (b) A private entity may collect, use, store, or disclose
15geolocation information from a location-based application on a
16person's device without receiving affirmative express consent
17if the collection, storage, or disclosure is:
18 (1) to allow a parent or legal guardian to locate an
19 unemancipated minor child;
20 (2) to allow a court-appointed guardian to locate a
21 legally incapacitated person;
22 (3) for the provision of fire, medical, public safety,
23 or other emergency services; or
24 (4) for the limited purpose of providing storage,
25 security, or authentication services.
26 (c) A private entity need not obtain a person's affirmative

HB3449 Enrolled- 3 -LRB100 08543 HEP 18668 b
1express consent after the person's initial consent as described
2in subsection (a) has been obtained unless the terms previously
3agreed to under items (1), (2), and (3) of subsection (a) are
4materially changed.
5 (d) This Section applies to location-based applications
6created or modified after the effective date of this Act.
7 Section 15. Violation.
8 (a) A violation of this Act constitutes a violation of the
9Consumer Fraud and Deceptive Business Practices Act. Only a
10State's Attorney or the Attorney General may enforce a
11violation of this Act as an unlawful practice under the
12Consumer Fraud and Deceptive Business Practices Act, including
13when an agreement is void and unenforceable pursuant to Section
1420 of this Act.
15 (b) A private entity, other than an individual, that is in
16violation of this Act shall have 15 days after being notified
17of a violation to rectify that violation before the Attorney
18General or appropriate State's Attorney's Office may seek an
19enforcement action against that private entity.
20 Section 20. Waivers; contracts.
21 (a) Any waiver of the provisions of this Act is void and
22unenforceable.
23 (b) Any agreement created or modified after the effective
24date of this Act that does not comply with this Act is void and

HB3449 Enrolled- 4 -LRB100 08543 HEP 18668 b
1unenforceable. An agreement that is void and unenforceable
2under this Section does not give rise to a private right of
3action under this Act.
4 Section 25. Applicability. This Act does not apply to: (i)
5a health care provider or other covered entity subject to the
6Federal Health Insurance Portability and Accountability Act of
71996 and the rules promulgated thereunder; (ii) a financial
8institution or an affiliate of a financial institution that is
9subject to Title V of the Federal Gramm-Leach-Bliley Act of
101999 and the rules promulgated thereunder; (iii) Internet,
11wireless, or telecommunications service providers; (iv) video
12service providers under Article XXI of the Public Utilities
13Act; (v) a person licensed as a private detective pursuant to
14the Private Detective, Private Alarm, Private Security,
15Fingerprint Vendor, and Locksmith Act of 2004; (vi) an
16individual or firm licensed under the Illinois Professional
17Land Surveyor Act of 1989 or the Professional Engineering
18Practice Act of 1989; (vii) a public utility, as defined in
19Section 3-105 of the Public Utilities Act, an alternative
20retail electric supplier, as defined in Section 16-102 of the
21Public Utilities Act, an alternative gas supplier, as defined
22in Section 19-105 of the Public Utilities Act, or the employees
23or agents of those entities; or (viii) any candidate,
24volunteer, employee, agent, or vendor of a candidate political
25committee, political party committee, political action

HB3449 Enrolled- 5 -LRB100 08543 HEP 18668 b
1committee, ballot initiative committee, or independent
2expenditure committee, as defined in Section 9-1.8 of the
3Election Code.
4 Section 90. The Consumer Fraud and Deceptive Business
5Practices Act is amended by changing Section 2Z as follows:
6 (815 ILCS 505/2Z) (from Ch. 121 1/2, par. 262Z)
7 Sec. 2Z. Violations of other Acts. Any person who knowingly
8violates the Automotive Repair Act, the Automotive Collision
9Repair Act, the Home Repair and Remodeling Act, the Dance
10Studio Act, the Geolocation Privacy Protection Act, the
11Physical Fitness Services Act, the Hearing Instrument Consumer
12Protection Act, the Illinois Union Label Act, the Job Referral
13and Job Listing Services Consumer Protection Act, the Travel
14Promotion Consumer Protection Act, the Credit Services
15Organizations Act, the Automatic Telephone Dialers Act, the
16Pay-Per-Call Services Consumer Protection Act, the Telephone
17Solicitations Act, the Illinois Funeral or Burial Funds Act,
18the Cemetery Oversight Act, the Cemetery Care Act, the Safe and
19Hygienic Bed Act, the Pre-Need Cemetery Sales Act, the High
20Risk Home Loan Act, the Payday Loan Reform Act, the Mortgage
21Rescue Fraud Act, subsection (a) or (b) of Section 3-10 of the
22Cigarette Tax Act, subsection (a) or (b) of Section 3-10 of the
23Cigarette Use Tax Act, the Electronic Mail Act, the Internet
24Caller Identification Act, paragraph (6) of subsection (k) of

HB3449 Enrolled- 6 -LRB100 08543 HEP 18668 b
1Section 6-305 of the Illinois Vehicle Code, Section 11-1431,
218d-115, 18d-120, 18d-125, 18d-135, 18d-150, or 18d-153 of the
3Illinois Vehicle Code, Article 3 of the Residential Real
4Property Disclosure Act, the Automatic Contract Renewal Act,
5the Reverse Mortgage Act, Section 25 of the Youth Mental Health
6Protection Act, or the Personal Information Protection Act
7commits an unlawful practice within the meaning of this Act.
8(Source: P.A. 99-331, eff. 1-1-16; 99-411, eff. 1-1-16; 99-642,
9eff. 7-28-16.)
feedback