Illinois, USA

Regulator And AuthorityAmber

The Illinois Attorney General enforces PIPA, BIPA-adjacent consumer-protection matters, and GIPA; the FTC provides a federal backstop under Section 5.

Claims (1):

• The Illinois Attorney General is the primary state enforcement authority for privacy-adjacent statutes including BIPA, PIPA, and GIPA, and coordinates breach-notification enforcement.

Act And InstrumentsAmber

Core instruments are BIPA, PIPA, and GIPA; no omnibus act exists.

Claims (3):

• Illinois has no comprehensive consumer data-protection/privacy statute; data-protection obligations arise from a patchwork of sectoral statutes (BIPA, PIPA breach-notification, GIPA, SOPPA) plus federal FTC Act Section 5 enforcement.
• The Biometric Information Privacy Act (740 ILCS 14), in effect since 2008, is the first comprehensive biometric-privacy statute in the United States and imposes written-consent, retention, and disclosure requirements on private entities handling biometric identifiers of Illinois residents.
• Illinois' Personal Information Protection Act (815 ILCS 530) requires data collectors to notify affected Illinois residents and, since a 2019 amendment (SB 1624, effective 1 January 2020), the Illinois Attorney General for breaches affecting more than 500 residents.

Material ScopeAmber

Material scope is defined statute-by-statute: BIPA covers biometric identifiers/information; PIPA covers breach of 'personal information' as statutorily defined; GIPA covers genetic test data.

Claims (1):

• The Biometric Information Privacy Act (740 ILCS 14), in effect since 2008, is the first comprehensive biometric-privacy statute in the United States and imposes written-consent, retention, and disclosure requirements on private entities handling biometric identifiers of Illinois residents.

Territorial ScopeAmber

BIPA does not expressly state its territorial scope but has been construed to reach any entity, wherever located, that collects biometric data of Illinois residents.

Claims (1):

• BIPA does not expressly define its territorial scope but has been applied to any private entity, established or not in Illinois, that collects or possesses biometric identifiers or information of Illinois residents.

Regulator Registration And FilingRed

No controller registration or filing regime exists in Illinois for general data processing.

Absence provenance: No registration/filing obligation identified for general data controllers in Illinois.. Searched: Illinois data protection controller registration requirement, Illinois Attorney General privacy filing obligation.

Lawful BasesRed

No omnibus lawful-basis enumeration exists; sectoral consent duties substitute.

Claims (1):

• Illinois has no general omnibus lawful-basis framework analogous to GDPR Article 6; lawful processing obligations exist only within sector-specific statutes such as BIPA and GIPA.

Consent ThresholdsAmber

BIPA mandates a written release/consent standard for biometric collection; a 2024 amendment clarified electronic-signature sufficiency.

Claims (2):

• BIPA requires private entities to obtain a written release from the subject, informed of the purpose and length of collection/storage, before collecting or capturing biometric identifiers or biometric information.
• BIPA's 2024 amendment (via Senate Bill 2979, signed by the Governor) added a statutory definition of 'electronic signature' to satisfy the written-release/consent requirement.

Special CategoriesAmber

Biometric identifiers (BIPA) and genetic data (GIPA) are treated as de facto special categories with heightened consent duties.

Claims (2):

• BIPA requires private entities to obtain a written release from the subject, informed of the purpose and length of collection/storage, before collecting or capturing biometric identifiers or biometric information.
• The Genetic Information Privacy Act (410 ILCS 513), as amended by HB 2189 effective 1 January 2020, prohibits direct-to-consumer genetic-testing companies from sharing genetic test information or other personally identifiable information with a health or life insurance company without the consumer's written consent.

Pseudonymisation And AnonymisationRed

No Illinois-specific pseudonymisation/anonymisation safe-harbour was identified.

Absence provenance: No dedicated statutory safe-harbour found; BIPA's 2024 amendment addresses only irreversibly de-identified derivative data within its own definition of biometric information.. Searched: Illinois pseudonymisation anonymisation safe harbor statute, BIPA anonymized biometric data exemption.

Access RightRed

No general access right; SOPPA gives parents visibility into categories/purpose of student data collected by operators.

Claims (1):

• Illinois' Student Online Personal Protection Act (105 ILCS 85), as amended, requires operators to notify parents about the type and purpose of student data collected, giving parents visibility into data held about their children.

Rectification And ErasureAmber

No general erasure right; BIPA mandates destruction of biometric data per a written retention schedule once the collection purpose is satisfied or within 3 years of last interaction.

Claims (1):

• BIPA requires private entities to develop a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collection has been satisfied or within 3 years of the individual's last interaction, whichever occurs first.

Restriction And ObjectionRed

No general restriction or objection right, including no profiling opt-out right outside employment-specific AI notice duties.

Absence provenance: No general restriction/objection right identified.. Searched: Illinois right to restrict processing statute, Illinois profiling opt-out consumer right.

Data PortabilityRed

No data portability right exists in Illinois law.

Absence provenance: No portability right identified.. Searched: Illinois data portability right consumer.

Deadlines And Response WindowsRed

No general statutory response-window for data-subject requests exists; SOPPA imposes breach-notification timelines to schools/parents rather than DSR response deadlines.

Absence provenance: No general DSR response-window statute found.. Searched: Illinois statutory deadline data subject request response.

Accountability And DpiaRed

No DPIA-triggering mechanism exists today; the pending AI Safety Measures Act (SB 315) would introduce pre-deployment risk reporting for frontier AI developers once signed and effective.

Claims (1):

• Illinois has no general DPO-appointment threshold, ROPA-filing duty, or DPIA-triggering mechanism analogous to GDPR Articles 30, 35, or 37-39; these obligations are absent outside of the pending AI Safety Measures Act's pre-deployment reporting, which is not yet in force.

Dpo RequirementsRed

No DPO-appointment threshold exists in Illinois law.

Absence provenance: No DPO statute identified.. Searched: Illinois data protection officer appointment requirement.

Ropa RequirementsRed

No records-of-processing filing duty exists in Illinois law.

Absence provenance: No ROPA statute identified.. Searched: Illinois records of processing activities requirement.

Joint Controller ArrangementsRed

No statutory joint-controller regime exists in Illinois law.

Absence provenance: No joint-controller statute identified.. Searched: Illinois joint controller data processing agreement requirement.

Security MeasuresAmber

PIPA requires reasonable security measures for personal information; BIPA requires biometric data be protected using the reasonable standard of care within the entity's industry.

Claims (2):

• PIPA (815 ILCS 530) requires data collectors that own or license personal information to implement and maintain reasonable security measures to protect the data from unauthorized access, acquisition, destruction, use, modification, or disclosure.
• BIPA requires private entities to store, transmit, and protect biometric identifiers and biometric information using the reasonable standard of care within the entity's industry and in a manner at least as protective as that used for other confidential and sensitive information.

Breach NotificationGreen

PIPA requires notice to affected residents and, for breaches over 500 residents, to the Illinois Attorney General with breach details.

Claims (1):

• Following the 2019 amendment (SB 1624, effective 1 January 2020), data collectors reporting a breach affecting more than 500 Illinois residents must notify the Illinois Attorney General with a description of the breach, the number of residents affected, and remedial steps taken or planned.

Retention And DisposalAmber

BIPA's mandatory retention schedule and destruction duty is Illinois' principal statutory retention/disposal rule (biometric data only); no general retention-limitation statute exists.

Claims (1):

• BIPA requires private entities to develop a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collection has been satisfied or within 3 years of the individual's last interaction, whichever occurs first.

Transfer MechanismsRed

No Illinois-specific transfer mechanism exists.

Claims (1):

• Illinois has no state-level data-transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate; cross-border transfer is unregulated at the state level absent sector-specific federal overlays (e.g., HIPAA, GLBA).

Adequacy ReceivedRed

Not applicable; US states do not receive adequacy decisions individually.

Absence provenance: Not applicable at sub-federal level.. Searched: Illinois adequacy decision received from foreign regulator.

Adequacy GrantedRed

Not applicable; Illinois does not grant adequacy determinations.

Absence provenance: Not applicable at sub-federal level.. Searched: Illinois adequacy decision granted to foreign jurisdiction.

Sccs And BcrsRed

No Illinois-specific SCC or BCR framework exists.

Absence provenance: No state-level SCC/BCR regime found.. Searched: Illinois standard contractual clauses data transfer requirement.

Transfer Impact AssessmentRed

No TIA requirement exists under Illinois law.

Absence provenance: No TIA requirement found.. Searched: Illinois transfer impact assessment requirement.

Data LocalisationRed

No general data-localisation mandate exists under Illinois law.

Absence provenance: No localisation mandate found.. Searched: Illinois data localization requirement statute.

Financial Sector OverlayAmber

Financial-sector personal data in Illinois is governed by the federal GLBA overlay; no distinct Illinois banking-privacy statute beyond the general Illinois Banking Act was substantiated in this run.

Claims (1):

• Federal sectoral statutes — HIPAA (health) and GLBA (financial) — apply in Illinois as in all US states in the absence of a distinct Illinois-specific overlay, per FTC-anchored federal baseline enforcement.

Health Sector OverlayAmber

Health data is governed principally by the federal HIPAA overlay; GIPA supplements this for genetic data specifically.

Claims (1):

• Federal sectoral statutes — HIPAA (health) and GLBA (financial) — apply in Illinois as in all US states in the absence of a distinct Illinois-specific overlay, per FTC-anchored federal baseline enforcement.

Telecoms And EprivacyRed

No Illinois-specific telecoms/eprivacy overlay was identified.

Absence provenance: No distinct overlay found.. Searched: Illinois eprivacy telecoms data statute.

Employment DataAmber

HB 3773 amends the Human Rights Act to prohibit AI-driven employment discrimination, including a ZIP-code-as-proxy ban, with employee-notice duties pending IDHR rulemaking.

Claims (2):

• House Bill 3773 amends the Illinois Human Rights Act to prohibit employers from using artificial intelligence that discriminates based on protected characteristics, explicitly banning the use of ZIP codes as a proxy for protected classes in employment decisions, effective 1 January 2026.
• Under HB 3773, employers must notify employees when AI is used for recruitment, hiring, promotion, training selection, discharge, discipline, or tenure decisions; the Illinois Department of Human Rights postponed a June 2026 rulemaking hearing on specific notice-content requirements to coordinate with other state agencies.

Credit And ScoringRed

No Illinois-specific credit-scoring statute distinct from federal FCRA was identified.

Absence provenance: No distinct state credit-scoring overlay found.. Searched: Illinois credit scoring algorithm regulation statute.

EducationGreen

SOPPA imposes education-sector breach-notification and parental-notice duties on operators of student data.

Claims (1):

• Illinois' Student Online Personal Protection Act imposes education-sector-specific breach-notification timelines requiring operators to notify schools within the most expedient time and without unreasonable delay, no later than 30 days after determining a breach occurred.

InsuranceAmber

GIPA restricts insurer use of genetic test data and family medical history for underwriting.

Claims (1):

• The Genetic Information Privacy Act prohibits life and health insurers in Illinois from using genetic test results or family medical history for underwriting purposes, as illustrated by a class action against Northwestern Mutual Life Insurance Company alleging GIPA violations.

Cookies And TrackersRed

No Illinois cookie/tracker consent law exists.

Claims (1):

• Illinois has no state cookie-consent law, dark-pattern prohibition, recognized opt-out signal (e.g., Global Privacy Control) requirement, or clean-room/data-collaboration rule at present.

Dark PatternsRed

No Illinois dark-pattern prohibition exists.

Claims (1):

• Illinois has no state cookie-consent law, dark-pattern prohibition, recognized opt-out signal (e.g., Global Privacy Control) requirement, or clean-room/data-collaboration rule at present.

Opt Out SignalsRed

No Illinois statute recognizes Global Privacy Control or equivalent opt-out signals.

Claims (1):

• Illinois has no state cookie-consent law, dark-pattern prohibition, recognized opt-out signal (e.g., Global Privacy Control) requirement, or clean-room/data-collaboration rule at present.

Clean Rooms And DcrRed

No Illinois clean-room/data-collaboration-room rule exists.

Claims (1):

• Illinois has no state cookie-consent law, dark-pattern prohibition, recognized opt-out signal (e.g., Global Privacy Control) requirement, or clean-room/data-collaboration rule at present.

Cross Context AdvertisingAmber

SB 340, if enacted, would introduce limits on sensitive-data use and algorithmic-profiling safeguards relevant to cross-context advertising, effective 1 January 2027; enactment status unconfirmed.

Claims (1):

• Senate Bill 340, which advanced to third reading in the Illinois General Assembly in 2026, would introduce consumer data rights, limits on sensitive-data use, and safeguards against algorithmic profiling, with a stated effective date of 1 January 2027, but had not been confirmed signed into law as of the most recent tracked update.

Direct MarketingRed

No Illinois-specific direct-marketing consent/suppression statute beyond federal TCPA/CAN-SPAM was identified.

Absence provenance: No distinct state-level direct-marketing statute found.. Searched: Illinois direct marketing consent suppression statute.

Profiling RestrictionsAmber

HB 3773's ZIP-code-as-proxy ban in AI-driven employment decisions is Illinois' primary statutory profiling restriction outside biometric/genetic contexts.

Claims (1):

• House Bill 3773's ban on using ZIP code as a proxy for protected characteristics in AI-driven employment decisions functions as Illinois' primary statutory profiling restriction outside biometric and genetic contexts.

Automated Decision Making TransparencyRed

SB 317 would require disclosure when consumers interact with AI chat interfaces in commercial contexts; enactment/signature status unconfirmed.

Claims (1):

• Senate Bill 317, advanced alongside other AI measures in the 2026 Illinois legislative session, would require clear disclosure when consumers interact with AI chat interfaces in commercial contexts.

Ai Risk AssessmentsAmber

SB 315 (Artificial Intelligence Safety Measures Act) would require frontier AI developers to conduct annual third-party audits and pre-deployment risk reporting; passed both chambers May 2026 and awaits gubernatorial signature.

Claims (1):

• Senate Bill 315 (Artificial Intelligence Safety Measures Act), passed by both chambers of the Illinois General Assembly in May 2026 and awaiting the Governor's signature, would require 'frontier developers' and 'large frontier developers' of high-compute foundation models to conduct annual third-party audits, produce pre-deployment risk reports, and implement governance and cybersecurity risk-mitigation measures, with an anticipated effective date of 1 January 2027 once signed.

Biometric RegimeGreen

BIPA is Illinois' comprehensive statutory biometric-data regime with a private right of action and liquidated damages.

Claims (1):

• BIPA constitutes Illinois' comprehensive statutory regime for biometric identifiers, covering consent, retention, disclosure restrictions, and a private right of action with liquidated damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation.

Genetic DataGreen

GIPA governs genetic-data collection, retention, and disclosure, including insurer-consent requirements.

Claims (1):

• GIPA governs genetic data collection, retention, and disclosure in Illinois, including consent requirements for insurer access to genetic test results.

State Surveillance CarveoutsRed

No Illinois-specific state-surveillance carve-out distinct from general federal national-security exemptions was identified.

Absence provenance: No distinct Illinois surveillance carve-out found; federal carve-outs belong to the US-federal JID.. Searched: Illinois state surveillance carve-out national security data exemption.

Age VerificationRed

No Illinois age-verification statute for general online services was identified.

Absence provenance: No age-verification statute found.. Searched: Illinois age verification online services statute.

Parental ConsentRed

Illinois has no state-level parental-consent statute for minors' general data processing; the operative federal instrument (COPPA) is scoped to the US-federal JID.

Claims (1):

• Illinois has no state-level parental-consent statute for minors' general data processing; parental-consent obligations applicable in Illinois arise from the federal Children's Online Privacy Protection Act (COPPA), which is scoped to the US-federal JID rather than Illinois specifically.

Minor Profiling BansAmber

SB 416 would ban AI-based grading in Illinois schools and require district approval for classroom AI use beginning the 2027-2028 school year; enactment status unconfirmed.

Claims (1):

• SB 416, advanced in the 2026 Illinois legislative session, bans AI-based grading in Illinois schools and requires school-district approval for classroom AI use beginning the 2027-2028 school year.

Education SettingsGreen

SOPPA requires parental notification of student-data collection purposes and mandates breach notification to parents within 30 days (60 days where a third-party operator is responsible).

Claims (1):

• SOPPA requires parental notification of student-data collection purposes and mandates breach notification to parents within 30 days, or 60 days where a third-party operator is responsible for the breach.

Dependent AdultsRed

No Illinois-specific dependent-adult data-protection statute was identified in this run.

Absence provenance: No dependent-adults-specific data statute found.. Searched: Illinois dependent adult elderly data protection statute.

Regulator Powers And PenaltiesAmber

The Illinois Attorney General enforces PIPA and consumer-protection statutes; BIPA is primarily privately enforced. The 2024 BIPA amendment (SB 2979) recalibrated per-violation exposure.

Claims (1):

• In response to Cothron, the Illinois General Assembly passed SB 2979, signed by the Governor in 2024, amending BIPA so that repeated collection or disclosure of the same biometric identifier from the same person via the same method of collection constitutes a single violation, limiting an aggrieved person to one recovery for such repeated conduct.

Enforcement Activity IndexAmber

BIPA litigation activity (Cothron, Tims, and large class settlements such as the Facebook $650M settlement referenced in secondary sources) constitutes the dominant enforcement signal in Illinois data protection.

Claims (1):

• The Illinois Supreme Court's Cothron v. White Castle decision held that separate BIPA claims accrue for every biometric scan taken from an individual, and Tims v. Black Horse Carriers established a 5-year statute of limitations for BIPA claims, together substantially increasing class-action damages exposure, with White Castle's potential liability estimated at up to $17 billion under the per-scan standard.

Regulator Funding And CapacityRed

No specific data on Illinois Attorney General privacy-enforcement headcount or budget was identified in this run.

Absence provenance: No funding/capacity data found.. Searched: Illinois Attorney General privacy enforcement budget headcount.

Collective Redress And Class ActionsAmber

BIPA class actions are extensive and high-value given liquidated damages and per-scan accrual (pre-2024-amendment conduct); the 2024 amendment limits future repeated-violation exposure to a single recovery.

Claims (2):

• The Illinois Supreme Court's Cothron v. White Castle decision held that separate BIPA claims accrue for every biometric scan taken from an individual, and Tims v. Black Horse Carriers established a 5-year statute of limitations for BIPA claims, together substantially increasing class-action damages exposure, with White Castle's potential liability estimated at up to $17 billion under the per-scan standard.
• In response to Cothron, the Illinois General Assembly passed SB 2979, signed by the Governor in 2024, amending BIPA so that repeated collection or disclosure of the same biometric identifier from the same person via the same method of collection constitutes a single violation, limiting an aggrieved person to one recovery for such repeated conduct.

Private Right Of ActionGreen

BIPA provides a direct private right of action with liquidated and actual damages, injunctive relief, and attorneys' fees.

Claims (1):

• BIPA's private right of action allows any aggrieved person to sue for liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus actual damages, injunctive relief, and attorneys' fees.

Recent Developments 180DAmber

Recent (2026) developments include multistate AG litigation over SNAP/Medicaid/voter data demands, HB 5295 on reproductive-health data, and the pending SB 315 AI Safety Measures Act awaiting gubernatorial signature.

Claims (3):

• In 2026, the Illinois Attorney General joined multistate coalitions in litigation and advocacy actions concerning sensitive personal data, including lawsuits blocking USDA collection of SNAP recipients' data, opposition to a federal demand for Minnesota data, an amicus brief against a federal demand for voter-registration data, and efforts to block HHS from sharing Medicaid data with ICE.
• The Illinois General Assembly passed HB 5295 in 2026 to strengthen protections for abortion-related and reproductive-health data.
• Senate Bill 315 (Artificial Intelligence Safety Measures Act) cleared both chambers of the Illinois General Assembly on 27 May 2026 and awaits the Governor's signature, with Governor Pritzker having publicly indicated he will sign it.