SB3603 104TH GENERAL ASSEMBLY

LRB104 19802 SPS 33252 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB3603

Introduced 2/5/2026, by Sen. Steve Stadelman

SYNOPSIS AS INTRODUCED:

815 ILCS 505/2MMMM new

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that a consumer may opt out of the processing of personal data for the purpose of targeted advertising by submitting a request using the methods specified in a data processing controller's privacy notice. Sets forth the requirements of a controller's privacy notice. Provides that, if a controller processes personal data for purposes of targeted advertising or sells personal data to third parties for targeted advertising, the controller shall disclose the processing or sale in a privacy notice and provide access to a clear and conspicuous method outside the privacy notice for a consumer to opt out of the processing or sale. Makes other changes. Effective January 1, 2028.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMM as follows:

(815 ILCS 505/2MMMM new)

Sec. 2MMMM. Data processing.

(a) Definitions. As used in this Section:

"Controller" means the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

"Deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such an individual.

"Identified or identifiable individual" means a natural person who can be readily identified, directly or indirectly, based on personal data.

"Personal data" means any information that is linked or reasonably linkable to an identified or identifiable individual. "Personal data" does not include deidentified data or publicly available information.

"Process" means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, including, but not limited to, the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.

"Processor" means a natural or legal person who processes personal data on behalf of a controller.

"Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests. "Targeted advertising" does not include:

(1) advertising based on activities within a controller's own websites or online applications;

(2) advertising based on the context of a consumer's current search query or visit to a website or online application;

(3) advertising directed to a consumer in response to the consumer's request for information or feedback; or

(4) processing personal data solely for measuring or reporting advertising performance, reach, or frequency.

(b) A consumer may opt out of the processing of personal data for the purpose of targeted advertising by submitting a request using the methods specified in the controller's privacy notice. A consumer may submit a request to a controller under this subsection at any time.

(c) A controller that processes personal data for purposes of targeted advertising shall provide a clear and conspicuous method for a consumer to opt out of the processing of personal data for the purpose of targeted advertising. A controller shall establish one or more secure and reliable means for consumers to submit a request to opt out of the processing of personal data for the purpose of targeted advertising, taking into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of the requests, and the ability of the controller to verify the identity of the consumer making the request.

(d) A consumer may authorize another person, acting on the consumer's behalf, to opt out of the processing of the consumer's personal data for purposes of targeted advertising. A consumer may designate an authorized agent through a technology, including, but not limited to, an Internet link or a browser setting, browser extension, or global device setting, indicating the consumer's intent to opt out of the processing.

A controller shall comply with an opt-out request received from a person authorized by the consumer to act on the consumer's behalf if the controller is able to authenticate, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf.

(e) If a controller is processing personal data for purposes of targeted advertising of a known child, the parent or legal guardian may opt the child out of the processing of personal data for the purpose of targeted advertising. If a controller is processing the personal data for purposes of targeted advertising of a consumer subject to a guardianship, conservatorship, or other protective arrangement, the guardian or the conservator of the consumer may opt the consumer out of the processing of personal data for the purpose of targeted advertising.

(f) A controller shall allow consumers to exercise the right to opt out of the processing of personal data for purposes of targeted advertising through a user-selected, universal opt-out mechanism, including by an opt-out preference signal sent, with the consumer's consent, by a platform, technology, or mechanism to the controller indicating the consumer's intent to opt out of the processing.

(g) If a controller processes personal data for purposes of targeted advertising or sells personal data to third parties for targeted advertising, the controller shall disclose the processing or sale in a privacy notice and provide access to a clear and conspicuous method outside the privacy notice for a consumer to opt out of the sale or processing. This method may include, but is not limited to, an Internet hyperlink clearly labeled "Your Opt-Out Rights" or "Your Privacy Rights" that directly effectuates the opt-out request or takes consumers to a web page where the consumer can make the opt-out request.

The privacy notice shall be posted online through a conspicuous hyperlink using the word "privacy" on the controller's website home page or on a mobile application's store page or download page. A controller that maintains an application on a mobile or other device shall also include a hyperlink to the privacy notice in the application's settings menu or in a similarly conspicuous and accessible location. A controller that does not operate a website shall make the privacy notice conspicuously available to consumers through a medium regularly used by the controller to interact with consumers.

(h) This Section applies to legal entities that conduct business in this State or produce products or services that are targeted to residents of this State, and that:

(1) during a calendar year, control or process personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or

(2) derive over 25% of gross revenue from the sale of personal data and process or control personal data of 25,000 consumers or more.

(i) A violation of this Section constitutes an unlawful practice within the meaning of this Act.

Section 99. Effective date. This Act takes effect January 1, 2028.