2025 -- H 6062

========

LC000982

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2025

____________

A N   A C T

RELATING TO COMMERCIAL LAW--GENERAL REGULATORY PROVISIONS --

PRIVACY PROTECTIONS FOR LOCATION INFORMATION DERIVED FROM

ELECTRONIC DEVICES

     Introduced By: Representatives Tanzi, Donovan, Speakman, McGaw, Ajello, Knight,
Stewart, Kislak, Felix, and Cruz

     Date Introduced: March 12, 2025

     Referred To: House Innovation, Internet, & Technology

     It is enacted by the General Assembly as follows:

     SECTION 1. Title 6 of the General Laws entitled "COMMERCIAL LAW — GENERAL

REGULATORY PROVISIONS" is hereby amended by adding thereto the following chapter:

CHAPTER 61

PRIVACY PROTECTIONS FOR LOCATION INFORMATION DERIVED FROM

ELECTRONIC DEVICES

     6-61-1. Title.

     This chapter shall be known and may be cited as the "Privacy Protections for Location

Information Derived from Electronic Devices".

     6-61-2. Definitions.

     As used in this chapter:

     (1) "Application" means a software program that runs on the operating system of a device.

     (2) "Collect" means to obtain, infer, generate, create, receive, or access an individual's

location information.

     (3) "Consent" means to freely given, specific, informed, unambiguous, opt-in consent. This

term does not include either of the following:

     (i) Agreement secured without first providing to the individual a clear and conspicuous

disclosure of all information material to the provision of consent, apart from any privacy policy,

terms of service, terms of use, general release, user agreement, or other similar document; or

     (ii) Agreement obtained through the use of a user interface designed or manipulated with

the substantial effect of subverting or impairing user autonomy, decision making, or choice.

     (4) "Covered entity" means any individual, partnership, corporation, limited liability

company, association, or other group, however organized. A covered entity does not include a state

or local government agency, or any court of Rhode Island, a clerk of the court, or a judge or justice

thereof. A covered entity does not include an individual acting in a non-commercial context. A

covered entity includes all agents of the entity.

     (5) "Device" means a mobile telephone or any other electronic device that is or may

commonly be carried by or on an individual and is capable of connecting to a cellular, Bluetooth,

or other wireless network.

     (6) “Director” means the director of the department of business regulation established

pursuant to § 42-14-1.

     (7) "Disclose" means to make location information available to a third party including, but

not limited to, by sharing, publishing, releasing, transferring, disseminating, providing access to,

or otherwise communicating such location information orally, in writing, electronically, or by any

other means.

     (8) "Individual" means a person located in the State of Rhode Island.

     (9) "Location information" means information derived from a device or from interactions

between devices, with or without the knowledge of the user and regardless of the technological

method used, that pertains to or directly or indirectly reveals the present or past geographical

location of an individual or device within the State of Rhode Island with sufficient precision to

identify street-level location information within a range of one thousand eight hundred fifty feet

(1,850') or less. Location information includes, but is not limited to:

     (i) An Internet protocol (IP) address capable of revealing the physical or geographical

location of an individual;

     (ii) Global positioning system (GPS) coordinates; and

     (iii) Cell-site location information. This term does not include location information

identifiable or derived solely from the visual content of a legally obtained image, including the

location of the device that captured such image, or publicly posted words.

     (10) "Location privacy policy" means a description of the policies, practices, and

procedures controlling a covered entity's collection, processing, management, storage, retention,

and deletion of location information.

     (11) ''Mobile telephone'' means a handheld or portable cellular, analog, wireless, satellite

or digital telephone, including a telephone with two (2)-way radio functionality, capable of sending

LC000982 - Page 2 of 9

or receiving telephone communications and with which a user initiates, terminates or engages in a

call using at least one hand. For the purposes of this chapter, ''mobile telephone'' shall not include

amateur radios operated by those licensed by the Federal Communications Commission to operate

such radios, or citizen band radios.

     (12) "Monetize" means to collect, process, or disclose an individual's location information

for profit or in exchange for monetary or other consideration. This term includes, but is not limited

to, selling, renting, trading, or leasing location information.

     (13) "Person" means any natural person.

     (14) "Permissible purpose" means one of the following purposes:

     (i) Provision of a product, service, or service feature to the individual to whom the location

information pertains when that individual requested the provision of such product, service, or

service feature by subscribing to, creating an account, or otherwise contracting with a covered

entity;

     (ii) Initiation, management, execution, or completion of a financial or commercial

transaction or fulfill an order for specific products or services requested by an individual, including

any associated routine administrative, operational, and account-servicing activity such as billing,

shipping, delivery, storage, and accounting;

     (iii) Compliance with an obligation under federal or state law; or

     (iv) Response to an emergency service agency, an emergency alert, a 911 communication,

or any other communication reporting an imminent threat to human life.

     (15) "Process" means to perform any action or set of actions on or with location information

including, but not limited to, collecting, accessing, using, storing, retaining, analyzing, creating,

generating, aggregating, altering, correlating, operating on, recording, modifying, organizing,

structuring, disposing of, destroying, de-identifying, or otherwise manipulating location

information. This term does not include disclosing location information.

     (16) "Reasonably understandable" means of length and complexity such that an individual

with an eighth-grade reading level, as established by the department of elementary and secondary

education, can read and comprehend.

     (17) "Service feature" means a discrete aspect of a service provided by a covered entity

including, but not limited to, real-time directions, real-time weather, and identity authentication.

     (18) "Service provider" means an individual, partnership, corporation, limited liability

company, association, or other group, however organized, that collects, processes, or transfers

location information for the sole purpose of, and only to the extent that such service provider is,

conducting business activities on behalf of, for the benefit of, at the direction of, and under

LC000982 - Page 3 of 9

contractual agreement with a covered entity.

     (19) "Third party" means any covered entity or person other than:

     (i) A covered entity that collected or processed location information in accordance with

this chapter or its service providers; or

     (ii) The individual to whom the location information pertains. This term does not include

government entities.

     6-61-3. Protection of location information.

     (a) No covered entity shall collect or process an individual's location information except

for a permissible purpose. Prior to collecting or processing an individual's location information for

one of those permissible purposes, a covered entity shall provide the individual with a copy of the

location privacy policy and obtain consent from that individual; provided, however, that this shall

not be required when the collection and processing is done in:

     (1) Compliance with an obligation under federal or state law; or

     (2) In response to an emergency service agency, an emergency alert, a 911 communication,

or any other communication reporting an imminent threat to human life.

     (b) If a covered entity collects location information for the provision of multiple

permissible purposes, it should be mentioned in the location privacy policy and individuals shall

provide informed consent for each purpose; provided, however, that this shall not be required for

the purpose of collecting and processing location information to comply with an obligation under

federal or state law or to respond to an emergency service agency, an emergency alert, a 911

communication, or any other communication reporting an imminent threat to human life.

     (c) A covered entity that directly delivers targeted advertisements as part of its product or

services shall provide individuals with a clear, conspicuous, and simple means to opt out of the

processing of their location information for purposes of selecting and delivering targeted

advertisements.

     (d) Consent provided under this section shall expire:

     (1) After one year;

     (2) When the initial purpose for processing the information has been satisfied; or

     (3) When the individual revokes consent, whichever occurs first; provided that, consent

may be renewed pursuant to the same procedures. Upon expiration of consent, any location

information possessed by a covered entity must be permanently destroyed.

     (e) No covered entity or service provider that lawfully collects and processes location

information shall:

     (1) Collect more precise location information than necessary to carry out the permissible

LC000982 - Page 4 of 9

purpose;

     (2) Retain location information longer than necessary to carry out the permissible purpose;

     (3) Sell, rent, trade, or lease location information to third parties;

     (4) Derive or infer from location information any data that is not necessary to carry out a

permissible purpose; or

     (5) Disclose, cause to disclose, or assist with or facilitate the disclosure of an individual's

location information to third parties, unless such disclosure is:

     (i) Necessary to carry out the permissible purpose for which the information was collected;

or

     (ii) Requested by the individual to whom the location data pertains.

     (f) No covered entity or service providers shall disclose location information to any federal,

state, or local government agency or official unless:

     (1) The agency or official serves the covered entity or service provider with a valid warrant

or establishes the existence of exigent circumstances that make it impracticable to obtain a warrant;

     (2) Disclosure is mandated under federal or state law; or

     (3) The data subject requests such disclosure.

     (g) A covered entity shall maintain and make available to the data subject a location privacy

policy, which shall include, at a minimum, the following:

     (1) The permissible purpose for which the covered entity is collecting, processing, or

disclosing any location information;

     (2) The type of location information collected, including the precision of the data;

     (3) The identities of service providers with which the covered entity contracts with respect

to location data;

     (4) Any disclosures of location data necessary to carry out a permissible purpose and the

identities of the third parties to whom the location information could be disclosed;

     (5) Whether the covered entity's practices include the internal use of location information

for purposes of targeted advertisement;

     (6) The data management and data security policies governing location information;

     (7) The retention schedule and guidelines for permanently deleting location information.

     (h) A covered entity in lawful possession of location information shall provide notice to

individuals to whom that information pertains of any change to its location privacy policy at least

twenty (20) business days before the change goes into effect, and shall request and obtain consent

before collecting or processing location information in accordance with the new location privacy

policy.

LC000982 - Page 5 of 9

     (i) No government entity shall monetize location information.

     6-61-4. Transparency.

     (a) A covered entity shall, on an annual basis, report to the director aggregate information

pertaining to any warrants seeking location information collected and processed by that covered

entity that were received during the preceding calendar year by the entity and, if known, by any

service providers and third parties. The report shall disaggregate orders by requesting agency,

statutory offense under investigation, and source of authority.

     (b) Covered entities that are required to regularly disclose location information as a matter

of law shall, on an annual basis, report to the director aggregate information related to such

disclosures.

     (c) The director shall develop standardized reporting forms to comply with this section and

make the reports available to the general public online.

     6-61-5. Prohibition against retaliation.

     A covered entity shall not take adverse action against an individual because the individual

exercised or refused to waive any of such individual's rights under this chapter, unless location data

is essential to the provision of the good, service, or service feature that the individual requests, and

then only to the extent that such data is essential. This prohibition includes, but is not limited to:

     (1) Refusing to provide a good or service to the individual;

     (2) Charging different prices or rates for goods or services, including through the use of

discounts or other benefits or imposing penalties; or

     (3) Providing a different level or quality of goods or services to the individual.

     6-61-6. Enforcement.

     (a) A violation of this chapter or a regulation promulgated under this chapter regarding an

individual's location information constitutes an injury to that individual.

     (b) Any individual alleging a violation of this chapter by a covered entity or service

provider may bring a civil action in the superior court or any court of competent jurisdiction;

provided that, venue in the superior court shall be proper in the county in which the plaintiff resides

or was located at the time of any violation.

     (c) An individual protected by this chapter shall not be required, as a condition of service

or otherwise, to file an administrative complaint with the director or to accept mandatory arbitration

of a claim arising under this chapter.

     (d) In a civil action in which the plaintiff prevails, the court may award:

     (1) Actual damages, including damages for emotional distress, or five thousand dollars

($5,000) per violation, whichever is greater;

LC000982 - Page 6 of 9

     (2) Punitive damages; and

     (3) Any other relief including, but not limited to, an injunction or declaratory judgment,

that the court deems to be appropriate.

     (e) The court shall consider each instance in which a covered entity or service provider

collects, processes, or discloses location information in a manner prohibited by this chapter or a

regulation promulgated under this chapter as constituting a separate violation of this chapter or

regulation promulgated under this chapter. In addition to any relief awarded, the court shall award

reasonable attorneys' fees and costs to any prevailing plaintiff.

     (f) Any provision of a contract or agreement of any kind, including a covered entity's terms

of service or policies including, but not limited to, the location privacy policy, that purports to

waive or limit in any way an individual's rights under this chapter including, but not limited to, any

right to a remedy or means of enforcement, shall be deemed contrary to state law and shall be void

and unenforceable.

     (g) No private or government action brought pursuant to this chapter shall preclude any

other action under this chapter.

     6-61-7. Non-applicability.

     This chapter shall not apply to location information collected from a patient by a healthcare

provider or healthcare facility, or collected, processed, used, or stored exclusively for medical

education or research, public health or epidemiological purposes, healthcare treatment, health

insurance, payment, or operations, if the information is protected from disclosure under the federal

Health Insurance Portability and Accountability Act of 1996 (Pub. L. No. 104-191), as amended,

or other applicable federal and state laws and regulations.

     6-61-8. Regulations.

     (a) The department of the business regulator shall:

     (1) Promulgate rules and regulations for the implementation, administration, and

enforcement of this chapter;

     (2) Gather facts and information applicable to the attorney general's obligation to enforce

this chapter and ensure its compliance;

     (3) Conduct investigations for possible violations of this chapter;

     (4) Refer cases for criminal prosecution to the appropriate federal, state, or local

authorities; and

     (5) Maintain an official Internet website outlining the provisions of this chapter.

     6-61-9. Location information collected before effective date.

     Within six (6) months after the effective date of this chapter, covered entities shall obtain

LC000982 - Page 7 of 9

consent in accordance with the provisions of § 6-61-3 for any location information collected,

processed, and stored before such effective date, and shall permanently destroy any location

information for which they have not obtained consent.

     SECTION 2. This act shall take effect upon passage.

========

LC000982

========

LC000982 - Page 8 of 9

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO COMMERCIAL LAW--GENERAL REGULATORY PROVISIONS --

PRIVACY PROTECTIONS FOR LOCATION INFORMATION DERIVED FROM

ELECTRONIC DEVICES

***

     This act would establish a new chapter for privacy protections for location information

derived from electronic devices. The department of the business regulation would be responsible

for promulgating rules and regulations to implement, administer, and enforce this chapter.

     This act would take effect upon passage.

========

LC000982

========

LC000982 - Page 9 of 9