An Act prohibiting certain covered entities and service providers from collecting and processing location information of individuals without consent; providing for enforcement by Attorney General; establishing a private right of action; and prescribing penalties.

PRINTER'S NO. 1965
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No. 1624
Session of
2025
INTRODUCED BY WAXMAN, GIRAL, GAYDOS, McANDREW, SANCHEZ, MAYES,
McNEILL, HILL-EVANS, KHAN, HANBIDGE, CERRATO, NEILSON, WARREN
AND CEPEDA-FREYTIZ, JUNE 18, 2025
REFERRED TO COMMITTEE ON COMMUNICATIONS AND TECHNOLOGY,
JUNE 20, 2025
AN ACT
Prohibiting certain covered entities and service providers from
collecting and processing location information of individuals
without consent; providing for enforcement by Attorney
General; establishing a private right of action; and
prescribing penalties.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Short title.
This act shall be known and may be cited as the Location
Information Protection Act.
Section 2. Definitions.
The following words and phrases when used in this act shall
have the meanings given them in this section unless the context
clearly indicates otherwise:
"Collect." To obtain, infer, generate, create, receive or
access an individual's location information.
"Consent." Permission that is voluntary, specific, informed
and unambiguous. The term does not include any agreement:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
(1) secured without first providing to the individual a
clear and conspicuous disclosure of all information material
to the provision of the agreement, apart from any privacy
policy, terms of service, terms of use, general release, user
agreement or other similar document; or
(2) obtained through the use of a user interface
designed or manipulated with the substantial effect of
subverting or impairing user autonomy, decision making or
choice.
"Covered entity." An individual, partnership, corporation,
limited liability company, association or other group, however
organized. The term includes an agent of an entity. The term
does not include a State or local government agency, or a court
of the Commonwealth, a clerk of the court or a judge or justice
thereof, or an individual acting in a noncommercial context.
"Device." A mobile telephone or other electronic device
located in this Commonwealth that is or may commonly be carried
by or on an individual and is capable of connecting to a
cellular, bluetooth or other wireless network.
"Disclose." To make location information available to a
third party, including sharing, publishing, releasing,
transferring, disseminating, providing access to or otherwise
communicating the location information orally, in writing,
electronically or by any other means.
"Individual." An individual located in this Commonwealth.
"Location information." As follows:
(1) Information derived from a device, or from an
interaction between devices, with or without the knowledge of
the user and regardless of the technological method used,
that pertains to or directly or indirectly reveals the
20250HB1624PN1965 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
present or past geographical location of an individual or
device with sufficient precision to identify street-level
location information within a range of 1,850 feet or less.
(2) The term includes any of the following:
(i) An internet protocol address capable of
revealing the physical or geographical location of an
individual.
(ii) Global Positioning System coordinates.
(iii) Cell-site location information.
(3) The term does not include information identifiable
or derived solely from the visual content of a legally
obtained image, including the location of the device that
captured the image, or publicly posted words.
"Location privacy policy." A description of the policies,
practices and procedures controlling a covered entity's
collection, processing, management, storage, retention and
deletion of location information.
"Monetize." The selling, renting, trading or leasing of
location information.
"Permissible purpose." Any of the following purposes:
(1) Provision of a product, service or service feature
to the individual to whom the location information pertains
when the individual requested the provision of the product,
service or service feature by subscribing to, creating an
account or otherwise contracting with a covered entity.
(2) Initiation, management, execution or completion of a
financial or commercial transaction to fulfill an order for
specific products or services requested by an individual,
including any associated routine administrative, operational
and account-servicing activity, including billing, shipping,
20250HB1624PN1965 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
delivery, storage and accounting.
(3) Compliance with an obligation under Federal or State
law.
(4) Response to an emergency service agency, an
emergency alert, a 911 communication or other communication
reporting an imminent threat to human life.
"Process." To perform an action or set of actions on or with
location information, including collecting, accessing, using,
storing, retaining, analyzing, creating, generating,
aggregating, altering, correlating, operating on, recording,
modifying, organizing, structuring, disposing of, destroying,
de-identifying or otherwise manipulating location information.
This term does not include disclosing location information.
"Reasonably understandable." Of a length and complexity such
that an individual with at least an eighth grade reading level
as established in the Pennsylvania Core Standards for English
Language Arts, Grade 8, adopted by the Department of Education
of the Commonwealth, can read and comprehend.
"Service feature." A discrete aspect of a service provided
by a covered entity, including real-time directions, real-time
weather and identity authentication.
"Service provider." An individual, partnership, corporation,
limited liability company, association or other group, however
organized, that collects, processes or transfers location
information for the sole purpose of conducting, and only to the
extent that the individual or entity conducts, business
activities on behalf of, for the benefit of, at the direction of
and under contractual agreement with a covered entity.
"Third party." As follows:
(1) A covered entity or person other than:
20250HB1624PN1965 - 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(i) a covered entity that collected or processed
location information in accordance with this act or its
service providers; or
(ii) the individual to whom location information
pertains.
(2) The term does not include a government entity.
Section 3. Protection of location information.
(a) Prohibited conduct.--It shall be unlawful for a covered
entity to collect or process an individual's location
information unless:
(1) for a permissible purpose; and
(2) prior to collecting or processing the individual's
location information for a permissible purpose, the covered
entity:
(i) provides the individual with a copy of the
reasonably understandable location privacy policy; and
(ii) obtains consent from the individual.
(b) Exception.--Subsection (a) does not apply if the
collection or processing occurs:
(1) in compliance with an obligation under Federal or
State law; or
(2) in response to an emergency service agency, an
emergency alert, a 911 communication or other communication
reporting an imminent threat to human life.
(c) Disclosure required.--
(1) If a covered entity collects location information on
an individual for more than one permissible purpose, the
covered entity shall disclose the purposes in the location
privacy policy in a reasonably understandable format and must
obtain the individual's discrete consent for each purpose.
20250HB1624PN1965 - 5 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(2) This subsection shall not apply if the purpose of
collecting and processing the location information is to:
(i) comply with an obligation under Federal or State
law; or
(ii) respond to an emergency service agency, an
emergency alert, a 911 communication or other
communication reporting an imminent threat to human life.
(d) (Reserved).
(e) Expiration of consent and effect.--
(1) Consent provided under this section shall expire
upon the earliest of the following events:
(i) One year after the date the consent was
provided.
(ii) The date when the initial purpose for
processing the information has been satisfied.
(iii) The date when the individual revokes consent,
provided that consent may be renewed according to the
same procedure as when the consent was first provided.
(2) Upon expiration of consent, the covered entity shall
destroy any of the individual's location information
possessed by the covered entity.
(f) Other prohibited conduct.--It shall be unlawful for a
covered entity or service provider that lawfully collects and
processes location information for a permissible purpose to
engage in any of the following conduct:
(1) Collect more precise location information than
necessary to carry out the permissible purpose.
(2) Retain location information longer than necessary to
carry out the permissible purpose.
(3) Sell, rent, trade or lease the location information.
20250HB1624PN1965 - 6 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(4) Derive or infer from location information any data
that is not necessary to carry out the permissible purpose.
(5) Disclose, cause to disclose or assist with or
facilitate the disclosure of an individual's location
information to third parties, unless the disclosure is:
(i) necessary to carry out the permissible purpose;
or
(ii) consented to by the individual to whom the
location data pertains.
(g) Disclosure to government agencies and officials.--It
shall be unlawful for a covered entity or service provider to
disclose location information to a Federal, State or local
government agency or official unless:
(1) the agency or official serves the covered entity or
service provider with a valid warrant;
(2) an individual is at risk of danger of death or
serious physical injury, as long as:
(i) The request is approved by a high-ranking agency
officer for emergency access to location information.
(ii) The request is based on the agency's good faith
determination that it has a lawful basis to access the
information on a nonemergency basis.
(iii) The agency agrees to petition a court for an
appropriate order within three days and to destroy the
information if that order is not granted.
This paragraph does not apply to an individual accessing,
procuring or searching for services regarding contraception,
pregnancy care and perinatal care, including, but not limited
to, abortion services;
(3) the disclosure is mandated under Federal or State
20250HB1624PN1965 - 7 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
law; or
(4) the individual to whom the location information
pertains consented to the disclosure.
(h) Location privacy policy.--A covered entity shall
maintain and provide to an individual to whom location
information applies a location privacy policy. The location
privacy policy shall be posted on the covered entity's publicly
accessible Internet website. The location privacy policy shall
include the following:
(1) The permissible purpose for which the covered entity
is collecting, processing or disclosing any location
information.
(2) The type of location information collected,
including the time and geographic precision of the location
information collected.
(3) The identities of service providers with which the
covered entity contracts with respect to location
information.
(4) Any disclosures of location information necessary to
carry out a permissible purpose and the identities of the
third parties to whom the location information could be
disclosed.
(5) The data management and data security policies
governing location information.
(6) The retention schedule and guidelines for
permanently deleting location information.
(i) Notice of changes.--A covered entity in lawful
possession of location information shall provide notice to
individuals to whom the information pertains of any change to
the covered entity's location privacy policy at least 20
20250HB1624PN1965 - 8 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
business days before the change goes into effect in a reasonably
understandable format, and shall request and obtain consent from
the individual before collecting or processing the individual's
location information in accordance with the change to the
location privacy policy.
(j) Monetization by government entities prohibited.--It
shall be unlawful for a government entity to monetize location
information.
Section 4. Prohibition against retaliation.
A covered entity may not take adverse action against an
individual because the individual exercised or refused to waive
any of the individual's rights under this act, unless location
information is essential to the provision of the good, service,
or service feature that the individual requests, and then only
to the extent that the data is essential. The prohibition in
this section includes:
(1) Refusing to provide a good or service to the
individual.
(2) Charging different prices or rates for goods or
services, including through the use of discounts or other
benefits or imposing penalties.
(3) Providing a different level or quality of goods or
services to the individual.
Section 5. Enforcement.
A violation of this act or a regulation promulgated under
this act regarding an individual's location information
constitutes an injury to the individual and shall be deemed an
unfair or deceptive act or practice under the act of December
17, 1968 (P.L.1224, No.387), known as the Unfair Trade Practices
and Consumer Protection Law.
20250HB1624PN1965 - 9 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Section 6. Civil penalties.
(a) Action by Attorney General.--The Attorney General may
bring an action under the act of December 17, 1968 (P.L.1224,
No.387), known as the Unfair Trade Practices and Consumer
Protection Law, against a covered entity or service provider to
remedy violations of this act and for other appropriate relief.
(b) Private right of action.--
(1) An individual who alleges a violation of this act
committed by a covered entity or service provider may bring a
civil action in a court of competent jurisdiction, provided
that the action must be brought in the county in which the
individual resides or was located at the time of the
violation.
(2) An individual who brings an action under paragraph
(1) shall not be required, as a condition of service or
otherwise, to file an administrative complaint with the
Attorney General or to accept mandatory arbitration of a
claim arising under this act.
(c) Relief.--In a civil action brought under this section in
which the plaintiff prevails, the court may award:
(1) Actual damages, including damages for emotional
distress, or $100, whichever is greater for a violation.
(2) Punitive damages.
(3) Any other relief, including an injunction or
declaratory judgment, that the court deems appropriate. The
court shall consider each instance in which the covered
entity or service provider collects, processes or discloses
location information in a manner prohibited by this act or a
regulation promulgated under this act as constituting a
separate violation of this act or regulation promulgated
20250HB1624PN1965 - 10 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
under this act.
(d) Attorney fees and costs.--The court shall award
reasonable attorney fees and costs to a prevailing plaintiff in
an action brought under subsection (b).
(e) Construction.--No enforcement action, whether brought by
a government entity or a private individual under this act shall
preclude or limit the ability of any other person from bringing
an action under this act.
Section 7. Waiver of rights prohibited.
A provision of a contract or agreement, including a covered
entity's terms of service or policies, including the covered
entity's location privacy policy, that purports to waive or
limit an individual's rights under this act to a right to a
remedy or means of enforcement shall be deemed contrary to State
law and shall be void and unenforceable.
Section 8. Implementation.
The Attorney General may promulgate rules and regulations for
the implementation, administration and enforcement of this act.
Section 9. Applicability.
Location information collected, processed or stored prior to
the effective date of this section shall be subject to section
3(f)(3) and (5) and (g).
Section 10. Effective date.
This act shall take effect in 60 days.
20250HB1624PN1965 - 11 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24