WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
This Act may be cited as the Artificial IntelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 Data Privacy Act.
Establishes the short title of the Act as the Artificial Intelligence Data Privacy Act. No operative obligations.
As used in this Act: "Artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act. "Covered informationCovered information"Covered information" means any data: (1) created by or provided to a deployer by a user in the course of using the deployer's artificial intelligence; or (2) gathered by a deployer through the deployment of an artificial intelligence to the user.Section 5" means any data: (1) created by or provided to a deployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5 by a userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5 in the course of using the deployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5's artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5; or (2) gathered by a deployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5 through the deployment of an artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 to the userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5. "DeployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5" means a person or entity who deploys artificial intelligenceDeploys artificial intelligence"Deploys artificial intelligence" means to integrate artificial intelligence into an environment in which the artificial intelligence is accessible to a user through a website, mobile application, dashboard, or other product or service.Section 5 to a userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5. "Deploys artificial intelligenceDeploys artificial intelligence"Deploys artificial intelligence" means to integrate artificial intelligence into an environment in which the artificial intelligence is accessible to a user through a website, mobile application, dashboard, or other product or service.Section 5" means to integrate artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 into an environment in which the artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 is accessible to a userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5 through a website, mobile application, dashboard, or other product or service. "UserUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5" means an individual who resides in this State and uses a deployed artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5.
Defines the key terms used throughout the Act. Deployer is broadly defined as any person or entity who integrates AI into an environment accessible to users via website, mobile application, dashboard, or other product or service — there is no size, revenue, or risk-level threshold. Covered information encompasses both data actively provided by a user and data gathered by the deployer through AI deployment. User is limited to Illinois residents.
(a) 1 Beginning on January 1, 2027, a deployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5 shall comply with either of the following: (1) a deployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5's artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 shall not train on a userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5's covered informationCovered information"Covered information" means any data: (1) created by or provided to a deployer by a user in the course of using the deployer's artificial intelligence; or (2) gathered by a deployer through the deployment of an artificial intelligence to the user.Section 5 and retain the training data indefinitely, unless the deployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5 first: (A) informs the userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5, in writing, that the artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 will retain training data indefinitely; and (B) obtains the userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5's express written consent to allow the artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 to retain the training data indefinitely; or (2) the default setting on the deployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5's artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 prohibits the artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 from training on a userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5's covered informationCovered information"Covered information" means any data: (1) created by or provided to a deployer by a user in the course of using the deployer's artificial intelligence; or (2) gathered by a deployer through the deployment of an artificial intelligence to the user.Section 5 and is only permitted to train on a userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5's covered informationCovered information"Covered information" means any data: (1) created by or provided to a deployer by a user in the course of using the deployer's artificial intelligence; or (2) gathered by a deployer through the deployment of an artificial intelligence to the user.Section 5 if the userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5: (A) is notified that the artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 will retain the training data indefinitely; and (B) affirmatively consents to change the default setting.
(b) 2 A deployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5 may not disclose a userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5's covered informationCovered information"Covered information" means any data: (1) created by or provided to a deployer by a user in the course of using the deployer's artificial intelligence; or (2) gathered by a deployer through the deployment of an artificial intelligence to the user.Section 5 to a third party unless the deployerDeployer"Deployer" means a person or entity who deploys artificial intelligence to a user.Section 5 first obtains express written consent from the userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5 for that disclosure.
This section imposes the Act's two substantive obligations on deployers. Subsection (a) addresses training data retention: a deployer may not train AI on a user's covered information and retain the training data indefinitely unless it satisfies one of two compliance paths — either obtaining written notice and express written consent for indefinite retention, or setting a default that prohibits training on user data and requiring the user to affirmatively opt in. Subsection (b) separately prohibits disclosure of covered information to third parties without express written consent, creating a consent-gated data-sharing restriction independent of the training-data obligation.
3 A userUser"User" means an individual who resides in this State and uses a deployed artificial intelligence.Section 5 who is aggrieved by a violation of this Act may bring a civil action against an offending party. A prevailing plaintiff may recover: (1) against a private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater; (2) against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater; (3) reasonable attorney's fees and costs, including expert witness fees and other litigation expenses; and (4) other relief, including injunctive relief, as the court may deem appropriate.
Creates a private right of action for any user aggrieved by a violation of the Act. The damages structure is tiered by culpability: negligent violations carry liquidated damages of $1,000 or actual damages (whichever is greater), while intentional or reckless violations carry liquidated damages of $5,000 or actual damages (whichever is greater). Prevailing plaintiffs may also recover attorney's fees, expert witness fees, litigation expenses, and injunctive relief.
4 A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General for the enforcement of this Act.
Designates any violation of the Act as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act (815 ILCS 505), extending all remedies, penalties, and enforcement authority available to the Attorney General under that Act to enforcement of this Act.
Any person who violates the Artificial IntelligenceArtificial intelligence"Artificial intelligence" has the meaning set forth in Section 2-101 of the Illinois Human Rights Act.Section 5 Data Privacy Act commits an unlawful practice within the meaning of this Act.
Adds a new section to the Consumer Fraud and Deceptive Business Practices Act confirming that any violation of the Artificial Intelligence Data Privacy Act constitutes an unlawful practice under the Consumer Fraud Act. This is a conforming cross-reference that mirrors Section 20.
This Act takes effect January 1, 2027.
Sets the effective date of the Act as January 1, 2027.