Illinois 2025-2026 Regular Session

Illinois House Bill HB3712 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026 HB3712 Introduced , by Rep. Ann M. Williams SYNOPSIS AS INTRODUCED: New Act Creates the Privacy Protections for Location Information Derived from Electronic Devices Act. Makes it unlawful for a covered entity to collect or process an individual's location information except for a permissible purpose. Provides that before collecting or processing an individual's location information for one of those permissible purposes, a covered entity shall provide the individual with a copy of the location privacy policy and obtain consent from that individual Authorizes a civil action in which if the plaintiff prevails, the court may award (1) actual damages including damages for emotional distress, or $5,000 per violation, whichever is greater; (2) punitive damages; and (3) any other relief. Provides that in addition to any relief awarded, the court shall award reasonable attorney's fees and costs to any prevailing plaintiff. Defines terms. Makes other changes. LRB104 12247 JRC 22354 b A BILL FOR 104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026 HB3712 Introduced , by Rep. Ann M. Williams SYNOPSIS AS INTRODUCED: New Act New Act Creates the Privacy Protections for Location Information Derived from Electronic Devices Act. Makes it unlawful for a covered entity to collect or process an individual's location information except for a permissible purpose. Provides that before collecting or processing an individual's location information for one of those permissible purposes, a covered entity shall provide the individual with a copy of the location privacy policy and obtain consent from that individual Authorizes a civil action in which if the plaintiff prevails, the court may award (1) actual damages including damages for emotional distress, or $5,000 per violation, whichever is greater; (2) punitive damages; and (3) any other relief. Provides that in addition to any relief awarded, the court shall award reasonable attorney's fees and costs to any prevailing plaintiff. Defines terms. Makes other changes. LRB104 12247 JRC 22354 b LRB104 12247 JRC 22354 b A BILL FOR
2	2	104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026 HB3712 Introduced , by Rep. Ann M. Williams SYNOPSIS AS INTRODUCED:
3	3	New Act New Act
4	4	New Act
5	5	Creates the Privacy Protections for Location Information Derived from Electronic Devices Act. Makes it unlawful for a covered entity to collect or process an individual's location information except for a permissible purpose. Provides that before collecting or processing an individual's location information for one of those permissible purposes, a covered entity shall provide the individual with a copy of the location privacy policy and obtain consent from that individual Authorizes a civil action in which if the plaintiff prevails, the court may award (1) actual damages including damages for emotional distress, or $5,000 per violation, whichever is greater; (2) punitive damages; and (3) any other relief. Provides that in addition to any relief awarded, the court shall award reasonable attorney's fees and costs to any prevailing plaintiff. Defines terms. Makes other changes.
6	6	LRB104 12247 JRC 22354 b LRB104 12247 JRC 22354 b
7	7	LRB104 12247 JRC 22354 b
8	8	A BILL FOR
9	9	HB3712LRB104 12247 JRC 22354 b HB3712 LRB104 12247 JRC 22354 b
10	10	HB3712 LRB104 12247 JRC 22354 b
11	11	1 AN ACT concerning civil law.
12	12	2 Be it enacted by the People of the State of Illinois,
13	13	3 represented in the General Assembly:
14	14	4 Section 1. Short title. This Act may be cited as the
15	15	5 Privacy Protections for Location Information Derived from
16	16	6 Electronic Devices Act.
17	17	7 Section 5. Legislative intent. The General Assembly
18	18	8 intends to protect the reproductive health access, safety of
19	19	9 LGBTQ lives, religious liberty, and freedom of movement by
20	20	10 passage of this Act.
21	21	11 Section 10. Definitions. As used in this Act:
22	22	12 "Application" means a software program that runs on the
23	23	13 operating system of a device.
24	24	14 "Collect" means to obtain, infer, generate, create,
25	25	15 receive, or access an individual's location information.
26	26	16 "Consent" means freely given, specific, informed,
27	27	17 unambiguous, opt-in consent. "Consent" does not include (i)
28	28	18 agreement secured without first providing to the individual a
29	29	19 clear and conspicuous disclosure of all information material
30	30	20 to the provision of consent, apart from any privacy policy,
31	31	21 terms of service, terms of use, general release, user
32	32	22 agreement, or other similar document; or (ii) agreement
33	33
34	34
35	35
36	36	104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026 HB3712 Introduced , by Rep. Ann M. Williams SYNOPSIS AS INTRODUCED:
37	37	New Act New Act
38	38	New Act
39	39	Creates the Privacy Protections for Location Information Derived from Electronic Devices Act. Makes it unlawful for a covered entity to collect or process an individual's location information except for a permissible purpose. Provides that before collecting or processing an individual's location information for one of those permissible purposes, a covered entity shall provide the individual with a copy of the location privacy policy and obtain consent from that individual Authorizes a civil action in which if the plaintiff prevails, the court may award (1) actual damages including damages for emotional distress, or $5,000 per violation, whichever is greater; (2) punitive damages; and (3) any other relief. Provides that in addition to any relief awarded, the court shall award reasonable attorney's fees and costs to any prevailing plaintiff. Defines terms. Makes other changes.
40	40	LRB104 12247 JRC 22354 b LRB104 12247 JRC 22354 b
41	41	LRB104 12247 JRC 22354 b
42	42	A BILL FOR
43	43
44	44
45	45
46	46
47	47
48	48	New Act
49	49
50	50
51	51
52	52	LRB104 12247 JRC 22354 b
53	53
54	54
55	55
56	56
57	57
58	58
59	59
60	60
61	61
62	62	HB3712 LRB104 12247 JRC 22354 b
63	63
64	64
65	65	HB3712- 2 -LRB104 12247 JRC 22354 b HB3712 - 2 - LRB104 12247 JRC 22354 b
66	66	HB3712 - 2 - LRB104 12247 JRC 22354 b
67	67	1 obtained through the use of a user interface designed or
68	68	2 manipulated with the substantial effect of subverting or
69	69	3 impairing user autonomy, decision making, or choice.
70	70	4 "Covered entity" means any individual, partnership,
71	71	5 corporation, limited liability company, association, or other
72	72	6 group, however organized. "Covered entity" includes all agents
73	73	7 of the entity. "Covered entity" does not include a State or
74	74	8 local government agency, or a State court, a clerk of the
75	75	9 court, or a judge or justice. "Covered entity" does not
76	76	10 include an individual acting in a noncommercial context.
77	77	11 "Device" means a mobile telephone or any other electronic
78	78	12 device that is or may commonly be carried by or on an
79	79	13 individual or that is a component part of a motor vehicle and
80	80	14 is capable of connecting to a cellular, bluetooth, or other
81	81	15 wireless network.
82	82	16 "Disclose" means to make location information available to
83	83	17 a third party, including, but not limited to, by sharing,
84	84	18 publishing, releasing, transferring, disseminating, providing
85	85	19 access to, or otherwise communicating such location
86	86	20 information orally, in writing, electronically, or by any
87	87	21 other means.
88	88	22 "Individual" means a person located in the State.
89	89	23 "Location information" means information derived from a
90	90	24 device or from interactions between devices, with or without
91	91	25 the knowledge of the user and regardless of the technological
92	92	26 method used, that pertains to or directly or indirectly
93	93
94	94
95	95
96	96
97	97
98	98	HB3712 - 2 - LRB104 12247 JRC 22354 b
99	99
100	100
101	101	HB3712- 3 -LRB104 12247 JRC 22354 b HB3712 - 3 - LRB104 12247 JRC 22354 b
102	102	HB3712 - 3 - LRB104 12247 JRC 22354 b
103	103	1 reveals the present or past geographical location of an
104	104	2 individual or device within the State with sufficient
105	105	3 precision to identify street-level location information within
106	106	4 a range of 1,850 feet or less. "Location information"
107	107	5 includes, but is not limited to, (i) an internet protocol
108	108	6 address capable of revealing the physical or geographical
109	109	7 location of an individual, (ii) Global Positioning System
110	110	8 (GPS) coordinates; and (iii) cell-site location information.
111	111	9 "Location information" does not include location information
112	112	10 identifiable or derived solely from the visual content of a
113	113	11 legally obtained image, including the location of the device
114	114	12 that captured such image or publicly posted words.
115	115	13 "Location privacy policy" means a description of the
116	116	14 policies, practices, and procedures controlling a covered
117	117	15 entity's collection, processing, management, storage,
118	118	16 retention, and deletion of location information.
119	119	17 "Monetize" means to collect, process, or disclose an
120	120	18 individual's location information for profit or in exchange
121	121	19 for monetary or other consideration. "Monetize" includes, but
122	122	20 is not limited to, selling, renting, trading, or leasing
123	123	21 location information.
124	124	22 "Person" means any natural person.
125	125	23 "Permissible purpose" means one of the following purposes:
126	126	24 (i) provision of a product, service, or service feature to the
127	127	25 individual to whom the location information pertains when that
128	128	26 individual requested the provision of such product, service,
129	129
130	130
131	131
132	132
133	133
134	134	HB3712 - 3 - LRB104 12247 JRC 22354 b
135	135
136	136
137	137	HB3712- 4 -LRB104 12247 JRC 22354 b HB3712 - 4 - LRB104 12247 JRC 22354 b
138	138	HB3712 - 4 - LRB104 12247 JRC 22354 b
139	139	1 or service feature by subscribing to, creating an account, or
140	140	2 otherwise contracting with a covered entity; (ii) initiation,
141	141	3 management, execution, or completion of a financial or
142	142	4 commercial transaction or fulfill an order for specific
143	143	5 products or services requested by an individual, including any
144	144	6 associated routine administrative, operational, and
145	145	7 account-servicing activity such as billing, shipping,
146	146	8 delivery, storage, and accounting; (iii) compliance with an
147	147	9 obligation under federal or State law; or (iv) response to an
148	148	10 emergency service agency, an emergency alert, a 911
149	149	11 communication, or any other communication reporting an
150	150	12 imminent threat to human life.
151	151	13 "Process" means to perform any action or set of actions on
152	152	14 or with location information, including, but not limited to,
153	153	15 collecting, accessing, using, storing, retaining, analyzing,
154	154	16 creating, generating, aggregating, altering, correlating,
155	155	17 operating on, recording, modifying, organizing, structuring,
156	156	18 disposing of, destroying, deidentifying, or otherwise
157	157	19 manipulating location information. "Process" does not include
158	158	20 disclosing location information.
159	159	21 "Reasonably understandable" means of length and complexity
160	160	22 such that an individual with an 8th-grade reading level, as
161	161	23 established by the State Board of Education, can read and
162	162	24 comprehend.
163	163	25 "Service feature" means a discrete aspect of a service
164	164	26 provided by a covered entity, including, but not limited to,
165	165
166	166
167	167
168	168
169	169
170	170	HB3712 - 4 - LRB104 12247 JRC 22354 b
171	171
172	172
173	173	HB3712- 5 -LRB104 12247 JRC 22354 b HB3712 - 5 - LRB104 12247 JRC 22354 b
174	174	HB3712 - 5 - LRB104 12247 JRC 22354 b
175	175	1 real-time directions, real-time weather, and identity
176	176	2 authentication.
177	177	3 "Service provider" means an individual, partnership,
178	178	4 corporation, limited liability company, association, or other
179	179	5 group, however organized, that collects, processes, or
180	180	6 transfers location information for the sole purpose of, and
181	181	7 only to the extent that such service provider is, conducting
182	182	8 business activities on behalf of, for the benefit of, at the
183	183	9 direction of, and under contractual agreement with a covered
184	184	10 entity.
185	185	11 "Third party" means any covered entity or person other
186	186	12 than (i) a covered entity that collected or processed location
187	187	13 information in accordance with this Act or its service
188	188	14 providers or (ii) the individual to whom the location
189	189	15 information pertains.
190	190	16 Section 15. Protection of location information.
191	191	17 (a) It is unlawful for a covered entity to collect or
192	192	18 process an individual's location information except for a
193	193	19 permissible purpose. Before collecting or processing an
194	194	20 individual's location information for one of those permissible
195	195	21 purposes, a covered entity shall provide the individual with a
196	196	22 copy of the location privacy policy and obtain consent from
197	197	23 that individual; however, this shall not be required when the
198	198	24 collection and processing is done in (i) compliance with an
199	199	25 obligation under federal or State law or (ii) in response to an
200	200
201	201
202	202
203	203
204	204
205	205	HB3712 - 5 - LRB104 12247 JRC 22354 b
206	206
207	207
208	208	HB3712- 6 -LRB104 12247 JRC 22354 b HB3712 - 6 - LRB104 12247 JRC 22354 b
209	209	HB3712 - 6 - LRB104 12247 JRC 22354 b
210	210	1 emergency service agency, an emergency alert, a 911
211	211	2 communication, or any other communication reporting an
212	212	3 imminent threat to human life. For purposes of this
213	213	4 subsection, a consumer accessing, procuring, or searching for
214	214	5 services regarding contraception, pregnancy care, including,
215	215	6 but not limited to, abortion services, does not constitute an
216	216	7 imminent threat to human life.
217	217	8 (b) If a covered entity collects location information for
218	218	9 the provision of multiple permissible purposes, it should be
219	219	10 mentioned in the location privacy policy and individuals shall
220	220	11 provide discrete consent for each purpose; however, this shall
221	221	12 not be required for the purpose of collecting and processing
222	222	13 location information to comply with an obligation under
223	223	14 federal or State law or to respond to an emergency service
224	224	15 agency, an emergency alert, a 911 communication, or any other
225	225	16 communication reporting an imminent threat to human life.
226	226	17 (c) A covered entity that directly delivers targeted
227	227	18 advertisements as part of its product or services shall
228	228	19 provide individuals with a clear, conspicuous, and simple
229	229	20 means to opt out of the processing of their location
230	230	21 information for purposes of selecting and delivering targeted
231	231	22 advertisements.
232	232	23 (d) Consent provided under this Section expires (i) after
233	233	24 one year, (ii) when the initial purpose for processing the
234	234	25 information has been satisfied, or (iii) when the individual
235	235	26 revokes consent, whichever occurs first, as long as the
236	236
237	237
238	238
239	239
240	240
241	241	HB3712 - 6 - LRB104 12247 JRC 22354 b
242	242
243	243
244	244	HB3712- 7 -LRB104 12247 JRC 22354 b HB3712 - 7 - LRB104 12247 JRC 22354 b
245	245	HB3712 - 7 - LRB104 12247 JRC 22354 b
246	246	1 consent may be renewed pursuant to the same procedures. Upon
247	247	2 expiration of consent, any location information possessed by a
248	248	3 covered entity must be permanently destroyed.
249	249	4 (e) It shall be unlawful for a covered entity or service
250	250	5 provider that lawfully collects and processes location
251	251	6 information to:
252	252	7 (1) collect more precise location information than
253	253	8 necessary to carry out the permissible purpose;
254	254	9 (2) retain location information longer than necessary
255	255	10 to carry out the permissible purpose;
256	256	11 (3) sell, rent, trade, or lease location information
257	257	12 to third parties;
258	258	13 (4) derive or infer from location information any data
259	259	14 that is not necessary to carry out a permissible purpose;
260	260	15 or
261	261	16 (5) disclose, cause to disclose, or assist with or
262	262	17 facilitate the disclosure of an individual's location
263	263	18 information to third parties, unless such disclosure is
264	264	19 (i) necessary to carry out the permissible purpose for
265	265	20 which the information was collected or (ii) requested by
266	266	21 the individual to whom the location data pertains.
267	267	22 (f) It is unlawful for a covered entity or service
268	268	23 providers to disclose location information to any federal,
269	269	24 State, or local government agency or official unless:
270	270	25 (1) the agency or official serves the covered entity
271	271	26 or service provider with a valid warrant;
272	272
273	273
274	274
275	275
276	276
277	277	HB3712 - 7 - LRB104 12247 JRC 22354 b
278	278
279	279
280	280	HB3712- 8 -LRB104 12247 JRC 22354 b HB3712 - 8 - LRB104 12247 JRC 22354 b
281	281	HB3712 - 8 - LRB104 12247 JRC 22354 b
282	282	1 (2) disclosure is mandated under federal or State law;
283	283	2 (3) the data subject requests such disclosure; or
284	284	3 (4) a natural person is at risk or danger of death or
285	285	4 serious physical injury, as long as:
286	286	5 (A) the request is approved by a high-ranking
287	287	6 agency officer for emergency access to a consumer's
288	288	7 personal information;
289	289	8 (B) the request is based on the agency's good
290	290	9 faith determination that it has a lawful basis to
291	291	10 access the information on a nonemergency basis; and
292	292	11 (C) the agency agrees to petition a court for an
293	293	12 appropriate order within 3 days and to destroy the
294	294	13 information if that order is not granted.
295	295	14 For purposes of this subsection, a consumer accessing,
296	296	15 procuring, or searching for services regarding
297	297	16 contraception, pregnancy care, and perinatal care,
298	298	17 including, but not limited to, abortion services, does not
299	299	18 constitute a natural person being at risk or danger of
300	300	19 death or serious physical injury.
301	301	20 (g) A covered entity shall maintain and make available to
302	302	21 the data subject a location privacy policy, which shall
303	303	22 include, at a minimum, the following:
304	304	23 (1) the permissible purpose for which the covered
305	305	24 entity is collecting, processing, or disclosing any
306	306	25 location information;
307	307	26 (2) the type of location information collected,
308	308
309	309
310	310
311	311
312	312
313	313	HB3712 - 8 - LRB104 12247 JRC 22354 b
314	314
315	315
316	316	HB3712- 9 -LRB104 12247 JRC 22354 b HB3712 - 9 - LRB104 12247 JRC 22354 b
317	317	HB3712 - 9 - LRB104 12247 JRC 22354 b
318	318	1 including the precision of the data;
319	319	2 (3) the identities of service providers with which the
320	320	3 covered entity contracts with respect to location data;
321	321	4 (4) any disclosures of location data necessary to
322	322	5 carry out a permissible purpose and the identities of the
323	323	6 third parties to whom the location information could be
324	324	7 disclosed;
325	325	8 (5) whether the covered entity's practices include the
326	326	9 internal use of location information for purposes of
327	327	10 targeted advertisement;
328	328	11 (6) the data management and data security policies
329	329	12 governing location information; and
330	330	13 (7) the retention schedule and guidelines for
331	331	14 permanently deleting location information.
332	332	15 (h) A covered entity in lawful possession of location
333	333	16 information shall provide notice to individuals to whom that
334	334	17 information pertains of any change to its location privacy
335	335	18 policy at least 20 business days before the change goes into
336	336	19 effect and shall request and obtain consent before collecting
337	337	20 or processing location information in accordance with the new
338	338	21 location privacy policy.
339	339	22 (i) It shall be unlawful for a governmental entity to
340	340	23 monetize location information.
341	341	24 Section 20. Prohibition against retaliation. A covered
342	342	25 entity may not take adverse action against an individual
343	343
344	344
345	345
346	346
347	347
348	348	HB3712 - 9 - LRB104 12247 JRC 22354 b
349	349
350	350
351	351	HB3712- 10 -LRB104 12247 JRC 22354 b HB3712 - 10 - LRB104 12247 JRC 22354 b
352	352	HB3712 - 10 - LRB104 12247 JRC 22354 b
353	353	1 because the individual exercised or refused to waive any of
354	354	2 such individual's rights under this Act, unless location data
355	355	3 is essential to the provision of the good, service, or service
356	356	4 feature that the individual requests, and then only to the
357	357	5 extent that this data is essential. This prohibition includes,
358	358	6 but is not limited to:
359	359	7 (1) refusing to provide a good or service to the
360	360	8 individual;
361	361	9 (2) charging different prices or rates for goods or
362	362	10 services, including through the use of discounts or other
363	363	11 benefits or imposing penalties; or
364	364	12 (3) providing a different level or quality of goods or
365	365	13 services to the individual.
366	366	14 Section 25. Enforcement.
367	367	15 (a) A violation of this Act or a rule adopted by the
368	368	16 Department of Innovation and Technology regarding an
369	369	17 individual's location information constitutes an injury to
370	370	18 that individual.
371	371	19 (b) Any individual alleging a violation of this Act by a
372	372	20 covered entity or service provider may bring a civil action in
373	373	21 State court.
374	374	22 (c) An individual protected by this Act may not be
375	375	23 required, as a condition of service or otherwise, to accept
376	376	24 mandatory arbitration of a claim arising under this Act.
377	377	25 (d) In a civil action in which the plaintiff prevails, the
378	378
379	379
380	380
381	381
382	382
383	383	HB3712 - 10 - LRB104 12247 JRC 22354 b
384	384
385	385
386	386	HB3712- 11 -LRB104 12247 JRC 22354 b HB3712 - 11 - LRB104 12247 JRC 22354 b
387	387	HB3712 - 11 - LRB104 12247 JRC 22354 b
388	388	1 court may award:
389	389	2 (1) actual damages, including damages for emotional
390	390	3 distress, or $5,000 per violation, whichever is greater;
391	391	4 (2) punitive damages; and
392	392	5 (3) any other relief, including, but not limited to,
393	393	6 an injunction or declaratory judgment that the court deems
394	394	7 to be appropriate.
395	395	8 (e) For purposes of subsection (e) of Section 15, a
396	396	9 covered entity that, in more than one instance, violates
397	397	10 (1) through (4) of Section 15, from the same person using
398	398	11 the same method of collection or sale in violation of
399	399	12 subsection (e) of Section 15 has committed a single
400	400	13 violation of subsection (e) of Section 15 for which the
401	401	14 aggrieved person is entitled to, at most, one recovery
402	402	15 under this Section.
403	403	16 (f) For purposes of subsection (f) of Section 15, the
404	404	17 court shall consider each instance in which a covered
405	405	18 entity or service provider collects, processes, or
406	406	19 discloses location information in a manner prohibited by
407	407	20 subsection (f) of Section 15 as constituting a separate
408	408	21 violation of this Act or rule adopted under this Act.
409	409	22 (g) Upon motion, a court shall award reasonable
410	410	23 attorney's fees and costs, including expert witness fees
411	411	24 and other litigation expenses, to a plaintiff who is a
412	412	25 prevailing party in any action brought under this Act. In
413	413	26 awarding reasonable attorney's fees, the court shall
414	414
415	415
416	416
417	417
418	418
419	419	HB3712 - 11 - LRB104 12247 JRC 22354 b
420	420
421	421
422	422	HB3712- 12 -LRB104 12247 JRC 22354 b HB3712 - 12 - LRB104 12247 JRC 22354 b
423	423	HB3712 - 12 - LRB104 12247 JRC 22354 b
424	424	1 consider the degree to which the relief obtained relates
425	425	2 to the relief sought.
426	426	3 (h) For the purpose of this Act, "prevailing party"
427	427	4 includes any party:
428	428	5 (1) who obtains some of the requested relief
429	429	6 through a favorable judicial judgment;
430	430	7 (2) who obtains some of the requested relief
431	431	8 through any settlement agreement approved by the
432	432	9 court; or
433	433	10 (3) whose pursuit of a nonfrivolous claim was a
434	434	11 catalyst for a unilateral change in position by the
435	435	12 opposing party relative to the relief sought.
436	436	13 (i) Any provision of a contract or agreement of any kind,
437	437	14 including a covered entity's terms of service or policies,
438	438	15 including, but not limited to, the location privacy policy,
439	439	16 that purports to waive or limit in any way an individual's
440	440	17 rights under this Act, including, but not limited to, any
441	441	18 right to a remedy or means of enforcement, is deemed contrary
442	442	19 to State law and is void and unenforceable.
443	443	20 (j) No private or government action brought under this Act
444	444	21 precludes any other action under this Act.
445	445	22 Section 30. Nonapplicability. This Act does not apply to
446	446	23 location information collected from a patient by a health care
447	447	24 provider or health care facility, or collected, processed,
448	448	25 used, or stored exclusively for medical education or research,
449	449
450	450
451	451
452	452
453	453
454	454	HB3712 - 12 - LRB104 12247 JRC 22354 b
455	455
456	456
457	457	HB3712- 13 -LRB104 12247 JRC 22354 b HB3712 - 13 - LRB104 12247 JRC 22354 b
458	458	HB3712 - 13 - LRB104 12247 JRC 22354 b
459	459
460	460
461	461
462	462
463	463
464	464	HB3712 - 13 - LRB104 12247 JRC 22354 b