Legislation is pending in a number of states designed to restrict usage of Radio Frequency Identification (RFID) technology for purposes of identifying and tracking individuals without their knowledge or consent. RFID industry representatives fault the media and entertainment industries for the heightened attention to the technology, reflecting how it is portrayed in news reports, on television, and in films. Popular television shows such as "X-Files" and "Alias," and movies such as "Minority Report," depict how RFID (and related biometric) technologies can be used to track individuals.

The ability of RFID technology to track items or individuals does not by itself make the technology troubling. Instead, it is the ability of RFID-tagged items (or individuals carrying such items) to be identified or tracked in places where persons have a reasonable expectation of privacy that raises concerns. The data wirelessly transmitted by RFID tags in response to interrogation by an RFID reader can include both location and identification information, such as the type of item, price, date of manufacture, manufacturer name, retailer name, and even the date of purchase. The pending state legislation, described below, attempts to protect individuals' reasonable expectations of privacy by placing controls on identifying data that is wirelessly collected via RFID technology.

Following up on California's new state law prohibiting the compelled implantation of a subdermal RFID device, see November 2007 Privacy In Focus®, California State Senator Joseph Simitian, the sponsor of the RFID implantation prohibition statute, has introduced several additional bills aimed at controlling the rapid spread of RFID technology.

California Senate Bill SB 30, currently entitled the Identity Information Protection Act of 2007, requires state-issued RFID-enabled identification documents (IDs) to meet certain protective requirements. Specifically, state-issued IDs must incorporate tamper-resistant features to prevent duplication, forgery, or cloning. IDs that transmit personally identifiable information must incorporate an access control protocol that gives the ID holder control over the transmission of data. Also, the issuer must inform the ID holder in writing that the ID can be read wirelessly and that certain measures can be taken to limit data communications without the ID holder's consent. In addition, the issuer must inform ID holders of the location of readers that the issuing entity uses to read the ID.

California Senate Bill SB 31, concerning Identification Documents, provides that a person who intentionally reads or attempts to read another person's ID using radio waves without the person's knowledge and prior consent shall be punished by imprisonment, a fine, or both. Persons who disclose the means for reading another person's ID are subject to the same penalty.

California Senate Bill SB 28, Department of Motor Vehicles: Personal Information, prohibits the California DMV from issuing prior to 2011 an RFID-based driver's license or identification card that allows for the remote communication of personal information stored on the license or card.

California Senate Bill SB 29, on Pupil Attendance: Electronic Monitoring prohibits a public school from issuing any RFID-based device to a pupil that communicates personal information for the purposes of recording the pupil's attendance or tracking the pupil's location on school grounds.

Following California's lead, bills have been introduced in several other states that would restrict the use of RFID technology in that state.

Michigan House Bill 5091, titled Radio Frequency IdentificationDevices, prohibits inclusion of an RFID or similar device in state-issued identification cards, such as driver's licenses.

New Hampshire House Bill 686, on Tracking Devices, restricts the circumstances under which the state may use electronic tracking devices and prohibits a private citizen from electronically tracking another person without that person's consent. In particular, the bill restricts the state from issuing any identification document that uses an RFID device to locate an individual, except where:

  • The individual is in prison, a mental health facility, or state hospital, or is subject to court-ordered electronic monitoring;
  • The device is in a toll tag;
  • The device is used to access a secured area; or
  • The device was in use prior to January 1, 2007.
  • The bill also prohibits human implantation of RFID chips without the individual's consent. Finally, the bill requires that RFID-tagged products contain labeling to inform consumers of the presence of the tag.

Rhode Island House Bill H 8027 restricts a state agency's use of RFID devices for the purpose of tracking the movement or identity of an employee, student, client, or any individual as a condition of obtaining any benefit or service from the agency.

Such potential restrictions on RFID technology are particularly significant, because RFID chips are now being integrated into common identifying documents such as driver's licenses, passports, and credit cards, and consumer products such as groceries, clothing and electronic equipment.