Technology

Creates the Artificial Intelligence Safety Act. Provides that a developer of a frontier artificial intelligence model shall not be held liable for critical harms caused by the frontier model if the developer did not intentionally or recklessly cause the critical harms and the developer publishes a safety and security protocol and transparency report on its website. Provides that a developer shall be deemed to have complied with these requirements if the developer: (1) agrees to be bound by safety and security requirements adopted by the European Union; or (2) enters into an agreement with an agency of the federal government that satisfies specified requirements. Sets forth requirements for safety and security protocols and transparency reports. Provides that the Act shall no longer apply if the federal government enacts a law or adopts regulations that establish overlapping requirements for developers of frontier models.

Creates the Artificial Intelligence Design Requirements Act. Sets forth provisions concerning product liability actions brought against a developer of an artificial intelligence system for defective design, failure to contain adequate instructions or warnings, and failure to conform to an express warranty. Provides that a deployer of an artificial intelligence system shall be deemed to be liable as a developer for harm caused by a product if: (1) the deployer makes material and substantial change to the product or (2) the deployer intentionally misuses the product contrary to the express warranty and that use was the proximate cause of harm to the plaintiff. Sets forth provisions concerning applicability and enforcement.

Creates the Children's Social Media Safety Act. Provides that, no later than January 1, 2028, an operating system provider shall: (1) provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both; (2) provide an operator who has requested a signal with respect to a particular user a signal that identifies the user's age by category; and (3) send only the minimum amount of information necessary to comply with the provision. Provides that an operator shall not offer a platform in the State without conducting age verification as required under the Act to determine whether a user is a minor. Provides that, for all users that the operator has actual knowledge to be a minor, the operator shall use specified default settings for the minor. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

Creates the Chatbot Provider Liability Act. Provides that for purposes of the Act, chatbots are deemed products for the purpose of strict liability as other product liability actions. Provides that a chatbot provider has a duty to ensure that the use of its chatbot does not cause injury to a user and is liable for any injury it caused a user through the use of its chatbot regardless of whether the chatbot provider exercised all reasonable care in the design and distribution of the chatbot; or did not directly distribute the chatbot to the user or otherwise enter into a contractual relationship with the user. Provides that a user who is harmed by the actions of a chatbot provider under this Act may file a civil action in State or federal court seeking actual damages as allowed under Illinois law, injunctive relief, and reimbursement of reasonable attorney's fees and costs.

Creates the Illinois Data Privacy Protection Act. Applies to legal entities that conduct business in Illinois or produce products or services that are targeted to Illinois residents and that satisfy one or more of the following thresholds: during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or derives over 25% of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more. Requires a controller, alone or jointly with others, to consider the purposes and means of the processing of personal data in protecting the security of consumers while processing personal data and in notifying consumers of a breach of the security of the system. Authorizes rights to consumers under the Act to include, but not be limited to, the right to access their personal data, obtain a list of third parties to whom their data has been disclosed, request corrections to inaccurate data, and question the profiling of their information. Authorizes the Attorney General to enforce the Act. Amends the Personal Information Protection Act. Provides that, annually, on or before January 31, a data broker operating in the State must register with the Attorney General. Provides that the Attorney General shall create a page on its Internet website in which the registration information is accessible to the public that allows consumers to delete their personal information across all registered data brokers. Provides for civil penalties. Amends the State Finance Act to create the Data Privacy Protection Fund. Makes definitions. Makes other changes. Limits the concurrent exercise of home rule powers. Contains a severability provision.

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that a consumer may opt out of the processing of personal data for the purpose of targeted advertising by submitting a request using the methods specified in a data processing controller's privacy notice. Sets forth the requirements of a controller's privacy notice. Provides that, if a controller processes personal data for purposes of targeted advertising or sells personal data to third parties for targeted advertising, the controller shall disclose the processing or sale in a privacy notice and provide access to a clear and conspicuous method outside the privacy notice for a consumer to opt out of the processing or sale. Makes other changes. Effective January 1, 2028.

Amends the Equipment of Vehicles Chapter of the Illinois Vehicle Code to create the Autonomous Vehicles Article. Establishes requirements for the operation of autonomous vehicles on public roads for testing purposes by a driver who possesses the proper class of license for the type of vehicle being operated. Allows the Secretary of State Vehicle Services Department to adopt various rules regarding the operation and manufacture of autonomous vehicles. Includes requirements for manufacturers of autonomous vehicles. Requires a notice of autonomous vehicle noncompliance for violations of the Code or local traffic ordinances. Sets forth prohibitions for dealers and manufacturers.

Creates the Chatbot Response Liability Act. Provides that a proprietor of a chatbot that is used as an alternative to a human representative or that provides any substantive response, information, advice, or action may not disclaim liability if the chatbot provides materially misleading, incorrect, contradictory, or harmful information that results in financial loss or other demonstrable harm or that results in bodily harm to the covered user or any third party. Provides that a proprietor of a chatbot shall provide clear, conspicuous, and explicit notice to covered users that the covered users are interacting with an artificial intelligence chatbot program rather than a human. Sets forth requirements for proprietors of companion chatbots, including parental consent for the use of companion chatbots by minors. Requires the Attorney General to adopt rules to determine commercially reasonable and technically feasible methods for proprietors of companion chatbots to comply with the Act. Effective one year after becoming law.

Amends the Criminal Code of 2012. Provides that a person also commits harassment through electronic communications when he or she uses electronic communication to transmit to any person a deepfake with intent to harass. Defines "deepfake".

Amends the Personal Information Protection Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its Internet website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund to offset all reasonable costs of enforcing the registration requirements and establishing and maintaining the Internet website. Amends the State Finance Act to create the Data Broker Registry Fund.