SB3180 104TH GENERAL ASSEMBLY

LRB104 19685 SPS 33134 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB3180

Introduced 2/2/2026, by Sen. Rachel Ventura

SYNOPSIS AS INTRODUCED:

New Act
815 ILCS 505/2MMMM new

Creates the Artificial Intelligence Data Privacy Act. Prohibits a deployer from training an artificial intelligence on a user's data and retaining the training data indefinitely unless specified conditions are satisfied. Sets forth provisions concerning a private right of action. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Artificial Intelligence Data Privacy Act.

Section 5. Definitions. As used in this Act:

"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.

"Covered information" means any data:

(1) created by or provided to a deployer by a user in the course of using the deployer's artificial intelligence; or

(2) gathered by a deployer through the deployment of an artificial intelligence to the user.

"Deployer" means a person or entity who deploys artificial intelligence to a user.

"Deploys artificial intelligence" means to integrate artificial intelligence into an environment in which the artificial intelligence is accessible to a user through a website, mobile application, dashboard, or other product or service.

"User" means an individual who resides in this State and uses a deployed artificial intelligence.

Section 10. Deployer requirements.

(a) Beginning on January 1, 2027, a deployer shall comply with either of the following:

(1) a deployer's artificial intelligence shall not train on a user's covered information and retain the training data indefinitely, unless the deployer first:

(A) informs the user, in writing, that the artificial intelligence will retain training data indefinitely; and

(B) obtains the user's express written consent to allow the artificial intelligence to retain the training data indefinitely; or

(2) the default setting on the deployer's artificial intelligence prohibits the artificial intelligence from training on a user's covered information and is only permitted to train on a user's covered information if the user:

(A) is notified that the artificial intelligence will retain the training data indefinitely; and

(B) affirmatively consents to change the default setting.

(b) A deployer may not disclose a user's covered information to a third party unless the deployer first obtains express written consent from the user for that disclosure.

Section 15. Private right of action. A user who is aggrieved by a violation of this Act may bring a civil action against an offending party. A prevailing plaintiff may recover:

(1) against a private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater;

(2) against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater;

(3) reasonable attorney's fees and costs, including expert witness fees and other litigation expenses; and

(4) other relief, including injunctive relief, as the court may deem appropriate.

Section 20. Enforcement by the Attorney General. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General for the enforcement of this Act.

Section 90. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMM as follows:

(815 ILCS 505/2MMMM new)

Sec. 2MMMM. Violations of the Artificial Intelligence Data Privacy Act. Any person who violates the Artificial Intelligence Data Privacy Act commits an unlawful practice within the meaning of this Act.

Section 99. Effective date. This Act takes effect January 1, 2027.