Technology (Consumer Data Protection)

Creates the Online Safety Act. Provides that, no later than January 1, 2027, an owner of a social media platform shall: (1) incorporate an online safety center into the social media platform that provides consumers with specified educational resources; and (2) establish a cyberbullying policy for the social media platform. Provides for restrictions on personal data processors that offers any online service, product, or feature to minors. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

Creates the Artificial Intelligence Provenance Data Act. Provides that a covered artificial intelligence tool provider shall make available, at no cost to a person, a provenance label reading tool. Provides that a covered artificial intelligence tool provider shall include a provenance label in any image, video, or audio content instance created by its artificial intelligence. Sets forth requirements for large online platforms, capture device manufacturers, and third-party licensees and hosting platforms concerning provenance labels. Sets forth provisions concerning civil penalties. Effective January 1, 2027.

Creates the Illinois Consumer Data Privacy Act. Establishes certain consumer rights relating to personal data, including the rights to confirm whether data is being processed, to correct any inaccuracies in the consumer's personal data, to delete personal data provided by the consumer, to obtain a copy of the consumer's personal data that was previously provided, and to opt out of targeted advertising, the sale of data, or profiling of the consumer. Defines terms. Applies to persons who conduct business in Illinois or produce products or services that are targeted to Illinois residents and that during a calendar year control or process personal data of at least 100,000 consumers or 25,0000 consumers and derive over 50% of gross revenue from the sale of personal data. Creates requirements for persons or entities that control and process consumer data. Exempts certain persons or entities from the provisions of the Act. Provides that the Attorney General has exclusive authority to enforce the consumer data privacy rights. Creates the Consumer Privacy Fund to be administered by the Office of the Attorney General. Amends the Freedom of Information Act. Exempts from disclosure data protection impact assessments created under the Illinois Consumer Data Privacy Act. Makes a conforming change in the State Finance Act.

Creates the Data Broker Registration and Accessible Deletion Mechanism Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund. Provides that, no later than January 1, 2028, the Attorney General shall establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker. Amends the State Finance Act and the Consumer Fraud and Deceptive Business Practices Act to make conforming changes.

Creates the Social Media Data Clean Slate Act. A social media platform shall provide a clear and conspicuous button that enables a user to delete the user's account that satisfies specified requirements. Provides that the social media platform shall, when the button is clicked, provide a user with the steps necessary to complete an account deletion request, which shall include deletion of the user's personal information. Sets forth additional provisions concerning the account and personal information deletion process. Provides that any waiver of the rights provided under the Act shall be void and unenforceable. Provides that the Attorney General shall adopt rules necessary to implement and enforce the Act. Effective January 1, 2027.

Creates the Consumer Data Privacy Act. Establishes certain consumer rights relating to personal data, including the rights to confirm whether data is being processed, to correct any inaccuracies in the consumer's personal data, to delete personal data provided by the consumer, to obtain a copy of the consumer's personal data that was previously provided, and to opt out of targeted advertising, the sale of data, or profiling of the consumer. Defines terms. Applies to persons who conduct business in Illinois or produce products or services that are targeted to Illinois residents and that during the a calendar year control or process person data of at least 100,000 consumers or 25,0000 consumers and derives over 50% of gross revenue from the sale of personal data. Makes requirements for persons or entities that control and process consumer data and also exempts certain persons or entities from the statutory provisions of the Act. Provides that the Attorney General has exclusive authority to enforce the consumer data privacy rights. Creates the Consumer Privacy Fund to be administered by the Office of the Attorney General. Amends the Freedom of Information Act. Exempts from disclosure data protection impact assessments done under the Illinois Consumer Data Privacy Act. Makes a conforming change in the State Finance Act.

Amends the Biometric Information Privacy Act. Changes the definition of "biometric identifier". Defines "biometric lock", "biometric time clock", "person", and "security purpose". Waives certain requirements for collecting, capturing, or otherwise obtaining a person's or a customer's biometric identifier or biometric information under certain circumstances relating to security purposes. Provides that nothing in the Act may be construed to apply to information captured by a biometric time clock or biometric lock that converts a person's biometric identifier or biometric information to a mathematical representation. Provides that any person aggrieved by a violation of the Act may commence an action in State court or federal court within one year from its occurrence. Requires the aggrieved person to provide the private entity 30 days' written notice identifying the specific provisions of the Act that have been violated. Provides the private entity 30 days to cure the noticed violation. Exempts a private entity if its employees are covered by a collective bargaining agreement that provides for different policies regarding the retention, collection, disclosure, and destruction of biometric information. Effective immediately.

Creates the Provenance Data Requirements Act. Provides that a generative artificial intelligence tool provider shall apply provenance data, either directly or through the use of third-party technology, to wholly-generated synthetic content generated by the provider's generative artificial intelligence tool. Sets forth additional requirements on generative artificial intelligence tool providers, large online platforms, and manufacturers of capture devices. Defines terms.

Creates the Children's Social Media Safety Act. Provides that, no later than January 1, 2028, an operating system provider shall: (1) provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both; (2) provide an operator who has requested a signal with respect to a particular user a signal that identifies the user's age by category; and (3) send only the minimum amount of information necessary to comply with the provision. Provides that an operator shall not offer a platform in the State without conducting age verification as required under the Act to determine whether a user is a minor. Provides that, for all users that the operator has actual knowledge to be a minor, the operator shall use specified default settings for the minor. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

Creates the Illinois Data Privacy Protection Act. Applies to legal entities that conduct business in Illinois or produce products or services that are targeted to Illinois residents and that satisfy one or more of the following thresholds: during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or derives over 25% of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more. Requires a controller, alone or jointly with others, to consider the purposes and means of the processing of personal data in protecting the security of consumers while processing personal data and in notifying consumers of a breach of the security of the system. Authorizes rights to consumers under the Act to include, but not be limited to, the right to access their personal data, obtain a list of third parties to whom their data has been disclosed, request corrections to inaccurate data, and question the profiling of their information. Authorizes the Attorney General to enforce the Act. Amends the Personal Information Protection Act. Provides that, annually, on or before January 31, a data broker operating in the State must register with the Attorney General. Provides that the Attorney General shall create a page on its Internet website in which the registration information is accessible to the public that allows consumers to delete their personal information across all registered data brokers. Provides for civil penalties. Amends the State Finance Act to create the Data Privacy Protection Fund. Makes definitions. Makes other changes. Limits the concurrent exercise of home rule powers. Contains a severability provision.