Prohibition on contractors collecting or selling location data of individuals at intelligence community locations

(a) Prohibition A contractor or subcontractor of an element of the intelligence community, as a condition on contracting with an element of the intelligence community, may not, while a contract or subcontract for an element of the intelligence community is effective— (1) collect, retain, or knowingly or recklessly facilitate the collection or retention of location data from phones, wearable fitness trackers, and other cellular-enabled or cellular-connected devices located in any covered location, regardless of whether service for such device is provided under contract with an element of the intelligence community, except as necessary for the provision of the service as specifically contracted; or (2) sell, monetize, or knowingly or recklessly facilitate the sale of, location data described in paragraph (1) to any individual or entity that is not an element of the intelligence community. (b) Covered locations For purposes of subsection (a), a covered location is any location described in section 202.222(a)(1) of title 28, Code of Federal Regulations, or successor regulations. (c) Certification Not later than 60 days after the date of the enactment of this Act, each head of an element of the intelligence community shall require each contractor and subcontractor of the element to submit to the head a certification as to whether the contractor or subcontractor is in compliance with subsection (a). (d) Treatment of certifications The veracity of a certification under subsection (c) shall be treated as material for purposes of section 3729 of title 31, United States Code.