SB2121 creates the Privacy Protections for Location Information Derived from Electronic Devices Act, a new Illinois law governing how businesses and other covered entities may collect, process, disclose, and monetize location data. The bill generally prohibits collection or processing of an individual’s location information unless it is for a specified permissible purpose, such as providing a requested service, completing a transaction, complying with law, or responding to an emergency. Before collecting or processing location data for a permissible purpose, a covered entity must provide a location privacy policy and obtain opt-in consent, with consent expiring after one year, when the purpose is satisfied, or upon revocation. The bill also requires more limited collection and retention, prohibits sale or leasing of location data, restricts disclosure to third parties, and bars governmental entities from monetizing location information.
The bill includes detailed definitions of location information, consent, covered entity, service provider, and related terms, and it requires privacy policies to disclose the type of data collected, retention and deletion practices, service providers, and any targeted advertising uses. It also creates a right of action for individuals, allowing recovery of actual damages including emotional distress damages or $5,000 per violation, whichever is greater, plus punitive damages, injunctive relief, attorney’s fees, and costs. The bill further prohibits retaliation against individuals who exercise their rights, voids contractual waivers of those rights, and limits mandatory arbitration for claims under the Act.
SB2121 would significantly affect businesses that use mobile-device or app-based location data, ad-tech companies, data brokers, and service providers that handle geolocation information. It would also constrain disclosures to government agencies by generally requiring a warrant, a legal mandate, a user request, or a narrow emergency exception. The bill expressly states that accessing or searching for contraception, pregnancy care, including abortion services, does not count as an imminent threat to human life or as a basis for emergency disclosure, and it excludes certain health care and medical research uses from the Act.
The bill’s stated legislative intent emphasizes protecting reproductive health access, LGBTQ lives, religious liberty, and freedom of movement, which suggests a strong privacy and civil-liberties rationale. Because no committee transcripts or votes are provided, there is no recorded debate or roll-call history in the materials, but the structure of the bill indicates a generally privacy-protective approach with strong enforcement mechanisms. The most notable points of contention are likely to be the breadth of the restrictions on data collection and sharing, the private right of action and damages exposure, the warrant requirement for government access, and the explicit treatment of abortion- and pregnancy-related searches as not creating an emergency exception.
The bill would add a new statutory framework in Illinois regulating location data derived from electronic devices, imposing consent, notice, retention, disclosure, and deletion requirements on covered entities and service providers. It would create new civil liabilities and remedies, including statutory damages, emotional distress damages, punitive damages, attorney’s fees, and injunctive relief, while also limiting contractual waivers and mandatory arbitration. The Act would affect privacy practices for businesses, advertisers, app developers, data brokers, and any entity handling geolocation data, while carving out certain health care and research uses and restricting government access and monetization of location information.
Based on the bill text, the overall sentiment appears strongly supportive of privacy rights and consumer control over location data. The findings and exceptions show a particular policy focus on reproductive health, LGBTQ safety, religious liberty, and freedom of movement, indicating that the bill is framed as a civil liberties and personal safety measure rather than a general data-regulation bill. No committee discussion or voting record is available in the provided materials, so there is no evidence of recorded opposition or support beyond the bill’s protective drafting.
The likely areas of contention are the bill’s broad prohibition on location-data collection and processing, the requirement for opt-in consent and detailed privacy policies, and the significant enforcement provisions that allow private lawsuits with statutory and punitive damages. Businesses that rely on location-based advertising, analytics, or data sharing may object to the compliance burden and litigation risk, while privacy advocates are likely to support those same provisions. Another major point of contention is the bill’s treatment of government access to location data, especially the warrant requirement and the explicit exclusion of abortion- and pregnancy-related searches from emergency exceptions, which could draw debate over law enforcement access and reproductive-health privacy.