HB5179 104TH GENERAL ASSEMBLY

LRB104 17766 JRC 31198 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
HB5179

Introduced 2/10/2026, by Rep. Anne Stava

SYNOPSIS AS INTRODUCED:

New Act

Creates the Protection of Neural Data Act. Requires any nonmedical person or organization using or facilitating neural devices to access individuals' neural data to publicly post all user agreements and privacy terms on their website and clearly disclose to individuals the health and safety risks associated with the device. Prohibits a covered entity from storing, retaining, or transferring an individual's neural data unless the individual consents. Requires that covered entities must delete all neural data in their possession and instruct all third party recipients to do the same within 30 days of an individual's retracting of consent. Authorizes the Attorney General and State's Attorneys to enforce the Act. Makes violation of this Act a Class 1 misdemeanor Creates a civil cause of action for violation and a presumption of at least $10,000 in damages for unauthorized transfer of neural data.

A BILL FOR

AN ACT concerning civil law.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Protection of Neural Data Act.

Section 5. Definitions. As used in this Act:

"Covered entity" means a person that uses or facilitates the use of a neural device to monitor, record, analyze, or manipulate the neural data of an individual. "Covered entity" does not include:

(1) an individual who is licensed in Illinois to provide health care services and who uses or facilitates the use of a neural device to monitor, record, analyze, or manipulate the neural data of an individual for a medical purpose; or

(2) a licensed health care facility.

"Neural data" means information that:

(1) concerns the activity of an individual's central nervous system or peripheral nervous systems, including the brain and spinal cord; and

(2) can be monitored, recorded, analyzed, or manipulated by a neural device.

"Neural device" means a device that:

(1) employs an electronic, optical, magnetic, nanophysical, acoustical, or mechanical system; and

(2) is capable of replacing, restoring, complementing, improving, or otherwise modifying the response of the individual's central nervous system to its internal or external environment.

Section 10. Disclosure requirements.

(a) A covered entity must do the following before using or facilitating the use of a neural device to monitor, record, analyze, or manipulate the neural data of an individual:

(i) plainly disclose on the covered entity's website, if any, all user agreements, privacy agreements, and other terms that the covered entity requires an individual to consent to use the covered entity's neural device; and

(ii) plainly disclose to the individual:

(a) all health and safety risks associated with the use of the neural device;

(b) whether the neural device collects data in addition to whatever data collection is necessary to perform the advertised or otherwise described function of the neural device;

(c) that the covered entity may not store or otherwise retain the individual's neural data after the individual's use of the neural device unless the covered entity acquires the individual's consent to do so under Section 15;

(d) that the covered entity may not transfer possession of the individual's neural data to any third party unless the covered entity acquires the individual's consent to do so under Section 15; and

(e) how the covered entity safeguards the privacy of individuals' neural data.

Section 15. Consent requirements.

(a) A covered entity may not store, retain, or transfer an individual's neural data unless the covered entity acquires the individual's consent to do so.

(b) An individual who consents to allow a covered entity to store, retain, or transfer the individual's neural data may retract such consent at any time by notifying the covered entity electronically, telephonically, or in writing. A retraction is effective upon receipt by the covered entity. A covered entity that receives such a retraction must:

(i) promptly cancel and deactivate the individual's account and block any potential future transfer of the individual's neural data to any third party; and

(ii) within 30 days after receiving the retraction:

(a) delete all neural data of the individual in the covered entity's possession in a manner that renders the neural data unrecoverable; and

(b) contact each third party to which the covered entity has transferred possession of the individual's neural data and instruct the third party to delete the neural data. A third party that receives this instruction from a covered entity must promptly comply with the instruction.

Section 20. Enforcement and remedies. The Attorney General and State's Attorneys are authorized to enforce this Act.

(a) A person that violates this Act commits a class 1 misdemeanor. Notwithstanding subsection (b), if a court finds that a covered entity's violation of this Act is part of a pattern of noncompliance with this Act, the court may require the covered entity to pay a fine of not more than $50,000.

(b) An individual who suffers damages as a result of covered entity's violation of this Act may pursue a civil action to recover damages. The individual is presumed to have suffered damages in an amount not less than $10,000 if the court determines that a covered entity transferred possession of an individual's neural data to a third party in violation of this Act.

Section 25. Rules. The Attorney General may adopt rules as necessary for the implementation of this Act.