Regulon — IL-SB-3263 · IL SB 3263 (AI Provenance Data Act)

2026-02-03 introduced Filed with Secretary by Sen. Mary Edly-Allen

2026-02-03 introduced First Reading

2026-02-03 committee referral Referred to Assignments

2026-02-17 committee referral Assigned to Executive

2026-02-18 To AI and Social Media

2026-03-13 Rule 2-10 Committee Deadline Established As March 27, 2026 Rule 2-10 Committee Deadline Established As March 27, 2026

2026-03-27 Rule 2-10 Committee Deadline Established As April 24, 2026 Rule 2-10 Committee Deadline Established As April 24, 2026

2026-04-10 Added as Co-Sponsor Sen. Rachel Ventura

2026-04-14 Added as Chief Co-Sponsor Sen. Rachel Ventura

2026-04-14 Added as Co-Sponsor Sen. Robert F. Martwick

2026-04-14 Added as Co-Sponsor Sen. Graciela Guzmán

2026-04-14 Added as Co-Sponsor Sen. Karina Villa

2026-04-14 Added as Co-Sponsor Sen. Mark L. Walker

2026-04-15 Added as Co-Sponsor Sen. Adriane Johnson

2026-04-24 Rule 2-10 Committee/3rd Reading Deadline Established As May 15, 2026 Rule 2-10 Committee/3rd Reading Deadline Established As May 15, 2026

2026-04-30 Added as Co-Sponsor Sen. Mike Porfirio

2026-05-15 Rule 2-10 Committee/3rd Reading Deadline Established As May 22, 2026 Rule 2-10 Committee/3rd Reading Deadline Established As May 22, 2026

Summary

Establishes the Artificial Intelligence Provenance Data Act, requiring covered AI tool providers (those with over 1 million monthly users that generate or manipulate audio, video, or image content) to embed machine-readable provenance labels in AI-generated content and to offer a free, publicly accessible provenance label reading tool. Large online platforms (exceeding 2 million monthly users) must detect provenance labels in distributed content, disclose their availability to users, and refrain from stripping them. Capture device manufacturers must embed provenance labels by default in devices first produced for sale in Illinois on or after the effective date. The Act also imposes contractual and revocation obligations on covered providers who license their AI to third parties, and prohibits model hosting platforms from knowingly distributing AI that lacks provenance labeling capability. Enforced exclusively by the Attorney General, with civil penalties up to $5,000 per violation.

Enforcement & Penalties

Enforcement Authority

The Attorney General may bring a civil action to enforce the Act and to collect civil penalties or seek injunctive relief. Third-party licensees that violate the post-revocation use prohibition may be subject to a civil action for injunctive relief. No private right of action is explicitly created; enforcement is agency-initiated by the Attorney General.

Penalties

Civil penalty not to exceed $5,000 per violation for covered AI tool providers, large online platforms, and capture device manufacturers. Third-party licensees that use AI after license revocation may be subject to injunctive relief. The prevailing party in an Attorney General enforcement action may be awarded reasonable attorney's fees and costs.

Who Is Covered

"Covered artificial intelligence tool provider" means a person or entity that creates, codes, or otherwise produces artificial intelligence that: (i) has over 1,000,000 monthly visitors world-wide or users on average over the preceding 12-month period; (ii) is publicly accessible in this State; and (iii) generates, manipulates, or otherwise edits audio, video, or image content.

"Large online platform" means a public-facing social media platform, content sharing platform, messaging platform, advertising network, stand-alone search engine, or web browser that distributes content to users who did not create or collaborate in creating the content and that exceeded 2,000,000 unique monthly users during the preceding 12 months.

"Capture device manufacturer" means a person who produces a capture device for sale in this State. "Capture device manufacturer" does not include a person exclusively engaged in the assembly of a capture device from components produced by others.

What Is Covered

"Capture device" means any device that can record photographic, audio, or video content, including, but not limited to, video and still photography cameras, mobile phones with built-in cameras or microphones, and voice recorders.

"Provenance label" means a disclosure that is embedded in image, video, or audio content in a manner that is machine-readable.

"Provenance label reading tool" means a software program, application, or other mechanism that reads a provenance label and allows a person to determine whether an image, video, or audio content was created or altered by a specific artificial intelligence provided by a covered artificial intelligence tool provider.

Compliance Obligations 9 obligations · click obligation ID to open requirement page

T-02 AI Content Labeling & Provenance · T-02.7 · Developer · Content Generation

Section 10(a)-(e)

Plain Language

Covered AI tool providers must offer a free, publicly accessible provenance label reading tool on their website, mobile app, and via API. The tool must allow any person to upload content or submit a URL to determine whether the content was generated or altered by the provider's AI. The tool must also accept user feedback, which the provider must use to improve the tool. Providers may not collect or retain personal information from users of the reading tool (except voluntary contact info for feedback), may not output personal provenance data, and may not retain submitted content longer than necessary.

Statutory Text

(a) A covered artificial intelligence tool provider shall make available, at no cost to a person, a provenance label reading tool. The provenance label reading tool shall be made publicly accessible through a conspicuous link on the covered artificial intelligence tool provider's website and any corresponding mobile application. The provenance label reading tool shall allow a person to: (1) upload an image, video, text, or audio content; or (2) provide a uniform resource locator that links to an image, video, text, or audio content. (b) The provenance label reading tool shall support access by an application programming interface that allows a person to programmatically submit content for assessment without accessing the covered artificial intelligence tool provider's website. (c) The provenance label reading tool shall provide a mechanism for a person to submit feedback regarding the tool's efficacy. A covered artificial intelligence tool provider shall consider and use this feedback to improve the provenance label reading tool. (d) A covered artificial intelligence tool provider shall not collect or retain any personal information from a person who uses the provenance label reading tool, except that it may retain contact information voluntarily provided by a person who submits feedback in accordance with subsection (c). The provenance label reading tool shall not output any personal provenance data detected in the content. (e) A covered artificial intelligence tool provider shall not retain any content submitted to the provenance label reading tool for longer than is necessary to comply with this Act.

T-02 AI Content Labeling & Provenance · T-02.2 · Developer · Content Generation

Section 10(f)

Plain Language

Covered AI tool providers must embed a machine-readable provenance label in every image, video, or audio content instance their AI creates. The label must be readable by the provider's own reading tool, must be permanent or extraordinarily difficult to remove (to the extent technically feasible), and must convey system provenance data including the provider's name, the AI system's name and version, the timestamp of creation or alteration, and a unique content identifier. The label may convey this information directly or through a link to a permanent website.

Statutory Text

(f) A covered artificial intelligence tool provider shall include a provenance label in any image, video, or audio content instance created by its artificial intelligence. A provenance label required under this subsection shall: (1) be readable by the provenance label reading tool required by this Section; (2) be, to the extent technically feasible, permanent or extraordinarily difficult to remove; (3) convey, to the extent technically feasible, either directly or through a link to a permanent website, the following system provenance data: (A) the name of the covered artificial intelligence tool provider; (B) the name and version number of the artificial intelligence that created or altered the content; (C) the time and date of the content's creation or alteration; and (D) a unique identifier of the content.

T-02 AI Content Labeling & Provenance · T-02.4 T-02.5 · Deployer · Content GenerationSocial Media

Section 15(a)

Plain Language

Large online platforms must (1) detect standards-compliant provenance labels in content they distribute, (2) clearly and conspicuously disclose to users when provenance data is available, and (3) allow users to inspect all available system provenance data either through the platform's UI or by downloading the content with its metadata. Detection is subject to a technical feasibility qualifier. Only provenance labels compliant with widely adopted standards-body specifications trigger the detection obligation.

Statutory Text

(a) A large online platform shall: (1) to the extent technically feasible, detect whether any provenance label that is compliant with widely adopted specifications adopted by an established standards-setting body is embedded in or attached to content distributed on the large online platform; (2) provide a mechanism to disclose any machine-readable provenance label detected in content distributed on the large online platform, which shall, in a clear and conspicuous manner, indicate to a user that provenance data is available; and (3) allow a user to inspect all available system provenance data in an easily accessible manner, either directly through the platform's user interface or by providing a means for the user to download the content with its attached system provenance data.

T-02 AI Content Labeling & Provenance · T-02.6 · Deployer · Content GenerationSocial Media

Section 15(b)(1)

Plain Language

Large online platforms must not knowingly strip standards-compliant provenance labels or system provenance data from content uploaded to or distributed on the platform, to the extent technically feasible. The prohibition applies only to provenance data that is compliant with widely adopted specifications adopted by an established standards-setting body, and only when the stripping is knowing — inadvertent data loss through standard processing is not a violation.

Statutory Text

(b) A large online platform shall not: (1) to the extent technically feasible, knowingly strip any provenance label or system provenance data that is compliant with widely adopted specifications adopted by an established standards-setting body from content uploaded to or distributed on the large online platform;

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · Content GenerationSocial Media

Section 15(b)(2)

Plain Language

Large online platforms are prohibited from retaining any personal provenance data extracted from content shared on the platform. Personal provenance data includes both personal information and device/system/service identifiers reasonably capable of being associated with a particular user. This is an absolute prohibition — there is no exception for operational necessity or user consent.

Statutory Text

(b) A large online platform shall not: (2) retain any personal provenance data from content shared on the large online platform.

T-02 AI Content Labeling & Provenance · T-02.2 · Manufacturer · Recording Device

Section 20

Plain Language

For capture devices first produced for sale in Illinois on or after January 1, 2027, manufacturers must embed provenance labels by default in captured content, to the extent technically feasible and compliant with established standards-body specifications. The label must convey manufacturer name, device name and version, and creation timestamp. Manufacturers must also give users the option to include or opt out of provenance labels, inform users of label settings on first use of a recording function, and ensure provenance capabilities are available to both the default capture app and third-party apps using the device's capture functions. The exclusion for persons exclusively engaged in assembly from others' components means contract assemblers are not covered.

Statutory Text

With respect to any capture device that a capture device manufacturer first produces for sale in this State on or after the effective date of this Act, the capture device manufacturer, to the extent technically feasible and compliant with widely adopted specifications adopted by an established standards-setting body, shall: (1) provide a user with the option to include a provenance label in content captured by the capture device that conveys the following system provenance data: (A) the name of the capture device manufacturer; (B) the name and version number of the capture device that created the content; and (C) the time and date of the content's creation; (2) embed the provenance label described in paragraph (1) in content captured by the device by default; (3) clearly inform a user of the existence of settings relating to the provenance label upon the user's first use of a recording function on the capture device; (4) provide in the capture device's settings a clear and accessible mechanism for a user to opt out of the inclusion of a provenance label in the user's captured content; and (5) ensure the capabilities required by this Section are available for the capture device's default capture application and are made available to third-party applications that use the device's capture functionalities.

T-02 AI Content Labeling & Provenance · T-02.2 · Developer · Content Generation

Section 25(a)-(c)

Plain Language

When a covered AI tool provider licenses its AI to a third party, the provider must contractually require the licensee to maintain the system's provenance labeling capability. If the provider learns that a licensee has removed provenance labeling capability, the provider must revoke the license within 96 hours. A licensee whose license is revoked must immediately cease use. This creates a chain-of-custody enforcement mechanism ensuring provenance labeling obligations survive downstream licensing arrangements. The 96-hour revocation clock starts upon actual knowledge, not constructive notice.

Statutory Text

(a) If a covered artificial intelligence tool provider licenses its artificial intelligence to a third party, the covered artificial intelligence tool provider shall require by contract that the licensee maintain the system's capability to include a provenance label as required by subsection (f) of Section 10. (b) If a covered artificial intelligence tool provider has actual knowledge that a third-party licensee has modified an artificial intelligence to remove its capability to include a provenance label, the covered artificial intelligence tool provider shall revoke the third party's license to use the artificial intelligence within 96 hours after obtaining the knowledge. (c) A third-party licensee whose license to use artificial intelligence is revoked under this Section shall not use the artificial intelligence after the revocation.

T-02 AI Content Labeling & Provenance · T-02.2 · Distributor · Content GenerationModel Hosting

Section 25(d)

Plain Language

Model hosting platforms — websites or applications that make AI source code or model weights available for download — must not knowingly distribute AI systems that lack provenance labeling capability as required by Section 10(f). This creates a gatekeeper obligation for hosting platforms to verify that AI models they distribute can embed provenance labels in generated content. The knowledge standard is 'knowingly,' so platforms are not strictly liable for unknowing distribution but must act on actual knowledge.

Statutory Text

(d) The operator of a website or application that makes available for download the source code or model weights of artificial intelligence shall not knowingly make available artificial intelligence that does not place disclosures into content as required by subsection (f) of Section 10.

Other · Content Generation

Section 30(a)-(c)

Plain Language

This provision establishes the enforcement framework for the Act. It does not create a new compliance obligation — it specifies that violations are subject to civil penalties up to $5,000 per violation for covered AI tool providers, large online platforms, and capture device manufacturers; that third-party licensees that continue using AI after license revocation are subject to injunctive relief; and that the Attorney General has authority to bring civil actions for penalties and injunctive relief with prevailing party attorney's fees.

Statutory Text

(a) A covered artificial intelligence tool provider, large online platform, or capture device manufacturer that violates this Act is liable for a civil penalty in an amount not to exceed $5,000 per violation. (b) A third-party licensee that violates subsection (c) of Section 25 may be subject to a civil action for injunctive relief. (c) The Attorney General may bring a civil action to enforce this Act and to collect civil penalties or seek injunctive relief. In any such action, the prevailing party may be awarded reasonable attorney's fees and costs.