Technology

Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.

Creates the Adult Content Age Verification Act. Defines terms. Provides that a commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the Internet from a website that contains a substantial portion of material harmful to minors shall be subject to civil penalties if the entity fails to perform reasonable age verification methods to verify the age of individuals attempting to access the material. Provides that the Attorney General may investigate alleged violations and initiate a civil action for an injunction and to assess civil penalties. Provides that the civil penalties shall be deposited into the Cyber Exploitation of Children Fund, which shall be expended for the investigation of cybercrimes involving the exploitation of children and for no other purpose. Amends the State Finance Act to make a conforming change.

Amends the Illinois Procurement Code. Provides that any contract that provides for the storage of any State data shall include a requirement that the State data must be processed, stored, and disposed of within the territory of the United States. Provides that, for any contract that provides for the storage of State data, the Chief Procurement Officer shall allocate to any qualified bidder an earned credit of: (1) 2% of the contract base bid for ensuring that all State data that is included in the contract is stored within the State of Illinois; and (2) an additional 4% of the contract base bid for ensuring that all such State data is stored within an opportunity zone. Contains provisions concerning data centers.

Amends the Digital Voice and Likeness Protection Act. Provides that a provision in an agreement between an individual and any other person for the performance of personal or professional services is unenforceable only as it relates to a new performance, fixed on or after January 1, 2026, by a digital replica of an individual if specified conditions are satisfied. Provides that the failure to include a reasonably specific description of the intended uses of a digital replica shall not render a provision in an agreement unenforceable when the uses of the digital replica are consistent with the terms of the contract for the performance of personal or professional services and the fundamental character of the photography or sound track as recorded or performed. Provides that the requirements do not affect any other provision of a contract. Makes other changes. Effective January 1, 2026.

Creates the Unmanned Aerial Systems Security Act. Provides that a government agency may use a drone only if the manufacturer of the drone meets the minimum security requirements specified in the Act. Prohibits a government agency from purchasing, acquiring, or otherwise using a drone or any related services or equipment produced by (i) a manufacturer domiciled in a country of concern or (ii) a manufacturer the government agency reasonably believes to be owned or controlled, in whole or in part, by a country of concern or by a company domiciled in a country of concern. Classifies 3 different tiers of drones, and specifies restrictions for each tier level. Requires, subject to appropriation, a government agency using a drone on January 1, 2026 that does not meet the minimum requirements for that drone's usage tier to receive a reimbursement from the Unmanned Aerial Systems Security Reimbursement Fund up to the cost of acquiring a drone that meets the minimum requirements for that drone's usage tier if specified requirements are met. Requires the Department of Transportation to identify the geographic coordinates of sensitive installations within Illinois for the purpose of prohibiting drone usage over sensitive locations. Requires a provider of flight mapping software or other program for operating a drone to geofence Illinois' sensitive locations to prevent the flight of a drone over Illinois' sensitive locations. Provides that it is a Class A misdemeanor for (i) a provider of flight mapping software to allow a user to fly a drone over a sensitive location unless the user is a law enforcement agency or officer; or (ii) a user of a drone not using flight mapping software to fly a drone over a sensitive location without permission from the governmental agency in charge of the sensitive location. Limits the concurrent exercise of home rule powers. Contains a severability clause. Amends the State Finance Act to create the Unmanned Aerial Systems Security Reimbursement Fund. Effective January 1, 2026.

Amends the Use Tax Act, the Service Use Tax Act, the Service Occupation Tax Act, and the Retailers' Occupation Tax Act. Creates an exemption for equipment and materials placed in service on or after January 1, 2026 that are incorporated into or used in the business of providing broadband services. Effective immediately.

Amends the Biometric Information Privacy Act. Defines "biometric identifier" to include neural data. Defines "neural data" as information that is generated by the measurement of activity of an individual's central or peripheral nervous system, and that is not inferred from non-neural information.

Creates the Illinois Data Privacy and Protection Act. Provides that a covered entity (any entity or any person, other than an individual acting in a non-commercial context, that alone or jointly with others determines the purposes and means of collecting, processing, or transferring covered data) may not collect, process, or transfer covered data unless the collection, processing, or transfer is limited to what is reasonably necessary and proportionate. Provides that a covered entity and a service provider shall establish, implement, and maintain reasonable policies, practices, and procedures concerning the collection, processing, and transferring of covered data. Contains provisions concerning retaliation; transparency; individual data rights; consent; data protection for children and minors; civil rights; data security; small business protections; executive responsibility; service providers and third parties; enforcement; severability; and rulemaking. Effective 180 days after becoming law.

Creates the Utility Data Access Act. Requires the Illinois Commerce Commission to enact the following procedures: (1) a utility shall retain all consumption data for a period of not less than 2 years; (2) a qualified utility shall retain monthly consumption data used for billing for a period of not less than 15 years; (3) a utility shall honor an account holder's request to transmit the account holder's covered usage data held by the utility to any entity designated by the account holder; (4) a qualified data recipient with respect to a qualified building or qualified property may request that a qualified utility provide aggregated usage data for the qualified building or qualified property; (5) a utility shall deliver requested data on a schedule set by the Commission; and (6) the account holder request process and utility delivery of requested data shall be convenient and secure. Establishes requirements for: the Commission's participation in a stakeholder process; the form and timeline in which covered usage data is provided to the data recipient; entry of data into the benchmarking tool; and the provision of covered usage data to recipients upon account holder authorization. Provides that, except in cases where the utility has not followed processes established by the Act or the utility is grossly negligent, the utility shall be held harmless for third-party misuse of data shared under the Act and no cause of action may be initiated against the utility for such subsequent misuse. Provides that prior to filing for cost recovery, a qualified utility must first demonstrate good faith efforts to secure federal, State, or other relevant funding options. Sets forth provisions regarding funding for the Commission to carry out its responsibilities under the Act and the Commission selecting and engaging outside consultants with experience in benchmarking and utility data access. States findings. Defines terms.

SB 252 amends the Illinois Income Tax Act to make the state's research and development tax credit permanent. This bill removes any expiration date for the credit, ensuring its continuous availability. It directly affects businesses in Illinois that conduct research and development activities and claim this specific income tax credit.