HB 1624 — An Act prohibiting certain covered entities and service providers from collecting and processing location information of individuals without consent; providing for enforcement by Attorney General; establishing a private right of action; and prescribing penalties.

PRINTER'S NO.     1965

                     THE GENERAL ASSEMBLY OF PENNSYLVANIA



                         HOUSE BILL
                         No. 1624
                                               Session of
                                                 2025

     INTRODUCED BY WAXMAN, GIRAL, GAYDOS, McANDREW, SANCHEZ, MAYES,
        McNEILL, HILL-EVANS, KHAN, HANBIDGE, CERRATO, NEILSON, WARREN
        AND CEPEDA-FREYTIZ, JUNE 18, 2025

     REFERRED TO COMMITTEE ON COMMUNICATIONS AND TECHNOLOGY,
        JUNE 20, 2025


                                    AN ACT
 1   Prohibiting certain covered entities and service providers from
 2      collecting and processing location information of individuals
 3      without consent; providing for enforcement by Attorney
 4      General; establishing a private right of action; and
 5      prescribing penalties.
 6      The General Assembly of the Commonwealth of Pennsylvania
 7   hereby enacts as follows:
 8   Section 1.   Short title.
 9      This act shall be known and may be cited as the Location
10   Information Protection Act.
11   Section 2.   Definitions.
12      The following words and phrases when used in this act shall
13   have the meanings given them in this section unless the context
14   clearly indicates otherwise:
15      "Collect."    To obtain, infer, generate, create, receive or
16   access an individual's location information.
17      "Consent."    Permission that is voluntary, specific, informed
18   and unambiguous. The term does not include any agreement:
 1          (1)     secured without first providing to the individual a
 2      clear and conspicuous disclosure of all information material
 3      to the provision of the agreement, apart from any privacy
 4      policy, terms of service, terms of use, general release, user
 5      agreement or other similar document; or
 6          (2)     obtained through the use of a user interface
 7      designed or manipulated with the substantial effect of
 8      subverting or impairing user autonomy, decision making or
 9      choice.
10      "Covered entity."    An individual, partnership, corporation,
11   limited liability company, association or other group, however
12   organized. The term includes an agent of an entity. The term
13   does not include a State or local government agency, or a court
14   of the Commonwealth, a clerk of the court or a judge or justice
15   thereof, or an individual acting in a noncommercial context.
16      "Device."    A mobile telephone or other electronic device
17   located in this Commonwealth that is or may commonly be carried
18   by or on an individual and is capable of connecting to a
19   cellular, bluetooth or other wireless network.
20      "Disclose."    To make location information available to a
21   third party, including sharing, publishing, releasing,
22   transferring, disseminating, providing access to or otherwise
23   communicating the location information orally, in writing,
24   electronically or by any other means.
25      "Individual."    An individual located in this Commonwealth.
26      "Location information."    As follows:
27          (1)     Information derived from a device, or from an
28      interaction between devices, with or without the knowledge of
29      the user and regardless of the technological method used,
30      that pertains to or directly or indirectly reveals the

20250HB1624PN1965                    - 2 -
 1      present or past geographical location of an individual or
 2      device with sufficient precision to identify street-level
 3      location information within a range of 1,850 feet or less.
 4          (2)   The term includes any of the following:
 5                (i)    An internet protocol address capable of
 6          revealing the physical or geographical location of an
 7          individual.
 8                (ii)    Global Positioning System coordinates.
 9                (iii)    Cell-site location information.
10          (3)   The term does not include information identifiable
11      or derived solely from the visual content of a legally
12      obtained image, including the location of the device that
13      captured the image, or publicly posted words.
14      "Location privacy policy."      A description of the policies,
15   practices and procedures controlling a covered entity's
16   collection, processing, management, storage, retention and
17   deletion of location information.
18      "Monetize."      The selling, renting, trading or leasing of
19   location information.
20      "Permissible purpose."      Any of the following purposes:
21          (1)   Provision of a product, service or service feature
22      to the individual to whom the location information pertains
23      when the individual requested the provision of the product,
24      service or service feature by subscribing to, creating an
25      account or otherwise contracting with a covered entity.
26          (2)   Initiation, management, execution or completion of a
27      financial or commercial transaction to fulfill an order for
28      specific products or services requested by an individual,
29      including any associated routine administrative, operational
30      and account-servicing activity, including billing, shipping,

20250HB1624PN1965                     - 3 -
 1      delivery, storage and accounting.
 2             (3)   Compliance with an obligation under Federal or State
 3      law.
 4             (4)   Response to an emergency service agency, an
 5      emergency alert, a 911 communication or other communication
 6      reporting an imminent threat to human life.
 7      "Process."     To perform an action or set of actions on or with
 8   location information, including collecting, accessing, using,
 9   storing, retaining, analyzing, creating, generating,
10   aggregating, altering, correlating, operating on, recording,
11   modifying, organizing, structuring, disposing of, destroying,
12   de-identifying or otherwise manipulating location information.
13   This term does not include disclosing location information.
14      "Reasonably understandable."      Of a length and complexity such
15   that an individual with at least an eighth grade reading level
16   as established in the Pennsylvania Core Standards for English
17   Language Arts, Grade 8, adopted by the Department of Education
18   of the Commonwealth, can read and comprehend.
19      "Service feature."     A discrete aspect of a service provided
20   by a covered entity, including real-time directions, real-time
21   weather and identity authentication.
22      "Service provider."     An individual, partnership, corporation,
23   limited liability company, association or other group, however
24   organized, that collects, processes or transfers location
25   information for the sole purpose of conducting, and only to the
26   extent that the individual or entity conducts, business
27   activities on behalf of, for the benefit of, at the direction of
28   and under contractual agreement with a covered entity.
29      "Third party."     As follows:
30             (1)   A covered entity or person other than:

20250HB1624PN1965                     - 4 -
 1                  (i)    a covered entity that collected or processed
 2            location information in accordance with this act or its
 3            service providers; or
 4                  (ii)    the individual to whom location information
 5            pertains.
 6            (2)   The term does not include a government entity.
 7   Section 3.     Protection of location information.
 8      (a)   Prohibited conduct.--It shall be unlawful for a covered
 9   entity to collect or process an individual's location
10   information unless:
11            (1)   for a permissible purpose; and
12            (2)   prior to collecting or processing the individual's
13      location information for a permissible purpose, the covered
14      entity:
15                  (i)    provides the individual with a copy of the
16            reasonably understandable location privacy policy; and
17                  (ii)    obtains consent from the individual.
18      (b)   Exception.--Subsection (a) does not apply if the
19   collection or processing occurs:
20            (1)   in compliance with an obligation under Federal or
21      State law; or
22            (2)   in response to an emergency service agency, an
23      emergency alert, a 911 communication or other communication
24      reporting an imminent threat to human life.
25      (c)   Disclosure required.--
26            (1)   If a covered entity collects location information on
27      an individual for more than one permissible purpose, the
28      covered entity shall disclose the purposes in the location
29      privacy policy in a reasonably understandable format and must
30      obtain the individual's discrete consent for each purpose.

20250HB1624PN1965                       - 5 -
 1            (2)   This subsection shall not apply if the purpose of
 2      collecting and processing the location information is to:
 3                  (i)    comply with an obligation under Federal or State
 4            law; or
 5                  (ii)    respond to an emergency service agency, an
 6            emergency alert, a 911 communication or other
 7            communication reporting an imminent threat to human life.
 8      (d)   (Reserved).
 9      (e)   Expiration of consent and effect.--
10            (1)   Consent provided under this section shall expire
11      upon the earliest of the following events:
12                  (i)    One year after the date the consent was
13            provided.
14                  (ii)    The date when the initial purpose for
15            processing the information has been satisfied.
16                  (iii)    The date when the individual revokes consent,
17            provided that consent may be renewed according to the
18            same procedure as when the consent was first provided.
19            (2)   Upon expiration of consent, the covered entity shall
20      destroy any of the individual's location information
21      possessed by the covered entity.
22      (f)   Other prohibited conduct.--It shall be unlawful for a
23   covered entity or service provider that lawfully collects and
24   processes location information for a permissible purpose to
25   engage in any of the following conduct:
26            (1)   Collect more precise location information than
27      necessary to carry out the permissible purpose.
28            (2)   Retain location information longer than necessary to
29      carry out the permissible purpose.
30            (3)   Sell, rent, trade or lease the location information.

20250HB1624PN1965                       - 6 -
 1            (4)   Derive or infer from location information any data
 2      that is not necessary to carry out the permissible purpose.
 3            (5)   Disclose, cause to disclose or assist with or
 4      facilitate the disclosure of an individual's location
 5      information to third parties, unless the disclosure is:
 6                  (i)    necessary to carry out the permissible purpose;
 7            or
 8                  (ii)    consented to by the individual to whom the
 9            location data pertains.
10      (g)   Disclosure to government agencies and officials.--It
11   shall be unlawful for a covered entity or service provider to
12   disclose location information to a Federal, State or local
13   government agency or official unless:
14            (1)   the agency or official serves the covered entity or
15      service provider with a valid warrant;
16            (2)   an individual is at risk of danger of death or
17      serious physical injury, as long as:
18                  (i)    The request is approved by a high-ranking agency
19            officer for emergency access to location information.
20                  (ii)    The request is based on the agency's good faith
21            determination that it has a lawful basis to access the
22            information on a nonemergency basis.
23                  (iii)    The agency agrees to petition a court for an
24            appropriate order within three days and to destroy the
25            information if that order is not granted.
26      This paragraph does not apply to an individual accessing,
27      procuring or searching for services regarding contraception,
28      pregnancy care and perinatal care, including, but not limited
29      to, abortion services;
30            (3)   the disclosure is mandated under Federal or State

20250HB1624PN1965                       - 7 -
 1      law; or
 2            (4)   the individual to whom the location information
 3      pertains consented to the disclosure.
 4      (h)   Location privacy policy.--A covered entity shall
 5   maintain and provide to an individual to whom location
 6   information applies a location privacy policy. The location
 7   privacy policy shall be posted on the covered entity's publicly
 8   accessible Internet website. The location privacy policy shall
 9   include the following:
10            (1)   The permissible purpose for which the covered entity
11      is collecting, processing or disclosing any location
12      information.
13            (2)   The type of location information collected,
14      including the time and geographic precision of the location
15      information collected.
16            (3)   The identities of service providers with which the
17      covered entity contracts with respect to location
18      information.
19            (4)   Any disclosures of location information necessary to
20      carry out a permissible purpose and the identities of the
21      third parties to whom the location information could be
22      disclosed.
23            (5)   The data management and data security policies
24      governing location information.
25            (6)   The retention schedule and guidelines for
26      permanently deleting location information.
27      (i)   Notice of changes.--A covered entity in lawful
28   possession of location information shall provide notice to
29   individuals to whom the information pertains of any change to
30   the covered entity's location privacy policy at least 20

20250HB1624PN1965                    - 8 -
 1   business days before the change goes into effect in a reasonably
 2   understandable format, and shall request and obtain consent from
 3   the individual before collecting or processing the individual's
 4   location information in accordance with the change to the
 5   location privacy policy.
 6      (j)   Monetization by government entities prohibited.--It
 7   shall be unlawful for a government entity to monetize location
 8   information.
 9   Section 4.     Prohibition against retaliation.
10      A covered entity may not take adverse action against an
11   individual because the individual exercised or refused to waive
12   any of the individual's rights under this act, unless location
13   information is essential to the provision of the good, service,
14   or service feature that the individual requests, and then only
15   to the extent that the data is essential. The prohibition in
16   this section includes:
17            (1)   Refusing to provide a good or service to the
18      individual.
19            (2)   Charging different prices or rates for goods or
20      services, including through the use of discounts or other
21      benefits or imposing penalties.
22            (3)   Providing a different level or quality of goods or
23      services to the individual.
24   Section 5.     Enforcement.
25      A violation of this act or a regulation promulgated under
26   this act regarding an individual's location information
27   constitutes an injury to the individual and shall be deemed an
28   unfair or deceptive act or practice under the act of December
29   17, 1968 (P.L.1224, No.387), known as the Unfair Trade Practices
30   and Consumer Protection Law.

20250HB1624PN1965                    - 9 -
 1   Section 6.     Civil penalties.
 2      (a)   Action by Attorney General.--The Attorney General may
 3   bring an action under the act of December 17, 1968 (P.L.1224,
 4   No.387), known as the Unfair Trade Practices and Consumer
 5   Protection Law, against a covered entity or service provider to
 6   remedy violations of this act and for other appropriate relief.
 7      (b)   Private right of action.--
 8            (1)   An individual who alleges a violation of this act
 9      committed by a covered entity or service provider may bring a
10      civil action in a court of competent jurisdiction, provided
11      that the action must be brought in the county in which the
12      individual resides or was located at the time of the
13      violation.
14            (2)   An individual who brings an action under paragraph
15      (1) shall not be required, as a condition of service or
16      otherwise, to file an administrative complaint with the
17      Attorney General or to accept mandatory arbitration of a
18      claim arising under this act.
19      (c)   Relief.--In a civil action brought under this section in
20   which the plaintiff prevails, the court may award:
21            (1)   Actual damages, including damages for emotional
22      distress, or $100, whichever is greater for a violation.
23            (2)   Punitive damages.
24            (3)   Any other relief, including an injunction or
25      declaratory judgment, that the court deems appropriate. The
26      court shall consider each instance in which the covered
27      entity or service provider collects, processes or discloses
28      location information in a manner prohibited by this act or a
29      regulation promulgated under this act as constituting a
30      separate violation of this act or regulation promulgated

20250HB1624PN1965                       - 10 -
 1      under this act.
 2      (d)   Attorney fees and costs.--The court shall award
 3   reasonable attorney fees and costs to a prevailing plaintiff in
 4   an action brought under subsection (b).
 5      (e)   Construction.--No enforcement action, whether brought by
 6   a government entity or a private individual under this act shall
 7   preclude or limit the ability of any other person from bringing
 8   an action under this act.
 9   Section 7.    Waiver of rights prohibited.
10      A provision of a contract or agreement, including a covered
11   entity's terms of service or policies, including the covered
12   entity's location privacy policy, that purports to waive or
13   limit an individual's rights under this act to a right to a
14   remedy or means of enforcement shall be deemed contrary to State
15   law and shall be void and unenforceable.
16   Section 8.    Implementation.
17      The Attorney General may promulgate rules and regulations for
18   the implementation, administration and enforcement of this act.
19   Section 9.    Applicability.
20      Location information collected, processed or stored prior to
21   the effective date of this section shall be subject to section
22   3(f)(3) and (5) and (g).
23   Section 10.    Effective date.
24      This act shall take effect in 60 days.




20250HB1624PN1965                     - 11 -