Illinois bill would require large businesses to assess services children use

Covered businesses would assess online services children are likely to use and set strong privacy defaults. This covers qualifying for-profit entities operating in Illinois that collect consumer data and determine how it is processed. The rules cover businesses that determine how consumer data is handled and meet at least one revenue or data-volume threshold. Some health information and information collected for clinical trials are excluded. For services already offered before January 1, 2027, the assessment is due by that date. A service not offered to the public on or after January 1, 2027, is excluded.

Businesses would limit how they collect and use children’s data and track children. These limits apply to businesses offering an online service, product, or feature reasonably likely to be accessed by children. Profiling by default is allowed only with safeguards and when needed for the requested service, or when the business can show a compelling reason it serves children’s best interests. Precise location data may be collected only when strictly necessary for the requested service, only as long as needed, and with an obvious notice. A parent, guardian, or other consumer may monitor or track a child only if the child receives an obvious signal.

The Attorney General could enforce the rules through court actions and civil penalties. Only the Attorney General may bring a civil action to enforce the Act; the text does not create a private right to sue. The Attorney General may seek up to $2,500 per affected child for each negligent violation or $7,500 for each intentional violation. A business in substantial compliance that met specified assessment requirements gets notice and 90 days to fix a violation; a timely cure can prevent a penalty for that violation. Penalty money would go to an enforcement fund and could be used as directed by the Attorney General only if lawmakers appropriate it.