HB5230 104TH GENERAL ASSEMBLY

LRB104 17776 SPS 31208 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
HB5230

Introduced 2/10/2026, by Rep. Jaime M. Andrade, Jr.

SYNOPSIS AS INTRODUCED:

New Act
815 ILCS 505/2MMMM new

Creates the Social Media Data Clean Slate Act. A social media platform shall provide a clear and conspicuous button that enables a user to delete the user's account that satisfies specified requirements. Provides that the social media platform shall, when the button is clicked, provide a user with the steps necessary to complete an account deletion request, which shall include deletion of the user's personal information. Sets forth additional provisions concerning the account and personal information deletion process. Provides that any waiver of the rights provided under the Act shall be void and unenforceable. Provides that the Attorney General shall adopt rules necessary to implement and enforce the Act. Effective January 1, 2027.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Social Media Data Clean Slate Act.

Section 5. Findings; declarations. The General Assembly finds and declares:

(a) Research demonstrates that adolescent individuals are at greater risk of developing addictive disorders.

(b) Excessive use of digital and social media has a documented connection to increases in suicide-related outcomes in teenagers and children, such as suicidal ideation, plans, and attempts.

(c) According to the University of Chicago, "First, account deletion options vary considerably across platforms and the language used to describe these options is not always clear. Most platforms offer account deletion on desktop browsers but not all allow account deletion from mobile apps or browsers. Second, we found evidence of several dark patterns present in the account deletion interfaces and platform policies. Third, most participants had tried to delete at least one social media account, yet over one-third of deletion attempts were never completed."

(d) Adolescents seeking to terminate an account that has become a source of addiction should be able to terminate their account without obstruction.

(e) Personal data generated by applications is valuable not only to the companies that launch them, but also to the users who are actively having their data mined and sold to third parties. This generated data belongs to the user, and when the user wants their account and data deleted, it should be done quickly and conveniently.

(f) For these reasons, the General Assembly declares it necessary in order to preserve the peace, welfare, and lives of its residents to ensure a minimum level of customer service when users wish to delete their accounts.

Section 10. Definitions. As used in this Act:

"Clear and conspicuous" has the meaning set forth in Section 5 of the Automatic Contract Renewal Act.

"Dark pattern" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.

"Personal information" has the meaning set forth in Section 5 of the Personal Information Protection Act.

"Social media platform" means a public or semi-public Internet-based service or application that has users in this State and that meets the following criteria:

(1) a substantial function of the service or application is to connect users in order to allow users to interact socially with each other within the service or application;

(2) the service or application allows users to do all of the following:

(A) construct a public or semi-public profile for purposes of signing into and using the service or application;

(B) populate a list of other users with whom an individual shares a social connection within the system; and

(C) create or post content viewable by other users, including, but not limited to, on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users; and

(3) the service or application generated more than $100,000,000 in the preceding year in gross revenues.

For the purpose of this definition, a service or application that provides email or direct messaging services shall not be considered a "social media platform" on the basis of that function alone.

Section 15. User's right to delete accounts.

(a) A social media platform shall provide a clear and conspicuous button that enables a user to delete the user's account that:

(1) is clearly and conspicuously placed as an immediately visible option in the social media platform's settings menu with the words "Delete Account"; and

(2) is located in a settings menu that is accessible in the application, on a browser, or on any other format that a user can use to access the social media platform.

(b) If a user clicks on the button required under subsection (a), the social media platform shall, when the button is clicked, provide a user with the steps necessary to complete an account deletion request, which shall include deletion of the user's personal information. If the social media platform seeks verification of the request to delete the account, that verification shall be done in a cost-effective and easy-to-use manner when the request is submitted through preestablished 2-factor authentication, email, text message, telephone call, or message.

(c) A social media platform shall not obstruct or interfere with a user's ability to delete the user's account, including, but not limited to, by using dark patterns.

(d) A social media platform that receives a verifiable user request from a user to delete the user's personal information under subsection (a) shall delete the user's personal information from its records, notify any service providers or contractors to delete the user's personal information from their records, and notify all third parties to whom the social media platform has sold or shared the personal information to delete the user's personal information unless this proves impossible or involves disproportionate effort.

The social media platform may maintain a confidential record of deletion requests solely for the purpose of preventing the personal information of a user who has submitted a deletion request from being sold, for compliance with laws, or for other purposes, to the extent permissible under this Act.

A service provider or contractor shall cooperate with the social media platform in responding to a verifiable user request, and at the direction of the social media platform, shall delete, or enable the social media platform to delete and shall notify any of its own service providers or contractors to delete personal information about the user collected, used, processed, or retained by the service provider or the contractor. The service provider or contractor shall notify any service providers, contractors, or third parties who may have accessed personal information from or through the service provider or contractor, unless the information was accessed at the direction of the social media platform, to delete the user's personal information unless this proves impossible or involves disproportionate effort. A service provider or contractor shall not be required to comply with a deletion request submitted by the user directly to the service provider or contractor to the extent that the service provider or contractor has collected, used, processed, or retained the user's personal information in its role as a service provider or contractor to the social media platform.

A business, or a service provider or contractor acting in accordance with its contract with the social media platform, another service provider, or another contractor, shall not be required to comply with a user's request to delete the user's personal information if it is reasonably necessary for the social media platform, service provider, or contractor to maintain the user's personal information in order to:

(1) complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by the user, or reasonably anticipated by the user within the context of a social media platform's ongoing business relationship with the user, or otherwise perform a contract between the social media platform and the user;

(2) help to ensure security and integrity to the extent the use of the user's personal information is reasonably necessary and proportionate for those purposes;

(3) debug to identify and repair errors that impair existing intended functionality;

(4) exercise free speech, ensure the right of another user to exercise that user's right of free speech, or exercise another right provided for by law;

(5) comply with the Protecting Household Privacy Act;

(6) engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the social media platform's deletion of the information is likely to render impossible or seriously impair the ability to complete the research, if the user has provided informed consent;

(7) enable solely internal uses that are reasonably aligned with the expectations of the user based on the user's relationship with the social media platform and compatible with the context in which the user provided the information; or

(8) comply with a legal obligation.

(e) A user login to an account for which a request under subsection (b) has been submitted shall not, by itself, revoke that request.

(f) Any waiver of the rights provided under this Act shall be void and unenforceable as contrary to public policy.

Section 20. Enforcement. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General for the enforcement of this Act.

Section 25. Relationship with other laws. Nothing in this Act, including the enforcement authority granted to the Attorney General, preempts or otherwise affects any other right, claim, remedy, presumption, or defense available at law or in equity.

Section 30. Rulemaking. The Attorney General shall adopt rules necessary to implement and enforce this Act.

Section 35. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMM as follows:

(815 ILCS 505/2MMMM new)

Sec. 2MMMM. Violations of the Social Media Data Clean Slate Act. A person who violates the Social Media Data Clean Slate Act commits an unlawful practice within the meaning of this Act.

Section 97. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Section 99. Effective date. This Act takes effect January 1, 2027.