Regulon — IL-SB-3735 · IL SB 3735 (Ed-Tech Rights / Biometric Info)

2026-02-05 introduced Filed with Secretary by Sen. Robert F. Martwick

2026-02-05 introduced First Reading

2026-02-05 committee referral Referred to Assignments

2026-02-24 committee referral Assigned to Executive

2026-02-25 To AI and Social Media

2026-03-13 Rule 2-10 Committee Deadline Established As March 27, 2026 Rule 2-10 Committee Deadline Established As March 27, 2026

2026-03-27 Rule 2-10 Committee Deadline Established As April 24, 2026 Rule 2-10 Committee Deadline Established As April 24, 2026

2026-04-14 Added as Chief Co-Sponsor Sen. Karina Villa

2026-04-14 Added as Chief Co-Sponsor Sen. Mary Edly-Allen

2026-04-14 Added as Chief Co-Sponsor Sen. Rachel Ventura

2026-04-24 Rule 2-10 Committee/3rd Reading Deadline Established As May 15, 2026 Rule 2-10 Committee/3rd Reading Deadline Established As May 15, 2026

2026-05-15 Rule 2-10 Committee/3rd Reading Deadline Established As May 22, 2026 Rule 2-10 Committee/3rd Reading Deadline Established As May 22, 2026

Summary

Creates the Student Educational Technologies Rights Act establishing students' and parents' rights to opt out of school-issued electronic devices, electronic textbooks, electronic assignments, and predictive analytics systems without academic penalty, and to request human teacher review of any AI-generated or automated grade. Amends the School Code to prohibit school districts from purchasing or acquiring biometric systems (including facial recognition) for use on students, and requires destruction of existing student biometric information within 30 days with certified documentation to the State Board of Education. Amends the Student Online Personal Protection Act to expand the definition of 'operator' to include AI models, expand 'covered information' to include data gathered through AI and digital replicas, prohibit operators from permitting AI training on covered information except for K-12 school purposes or improving operability, and require written parental/student consent before an operator's AI model may retain student training data indefinitely.

Enforcement & Penalties

Enforcement Authority

No private right of action is created by the bill. The Student Online Personal Protection Act is enforced by the Attorney General under the Consumer Fraud and Deceptive Business Practices Act. The School Code biometric provisions are enforced through the State Board of Education's general oversight authority. No specific cure period is stated.

Penalties

The bill does not specify penalties, damages, or remedies. Enforcement of the Student Online Personal Protection Act amendments is through the Consumer Fraud and Deceptive Business Practices Act, which provides for civil penalties, injunctive relief, and restitution as available under that Act. The School Code provisions do not specify independent penalty mechanisms.

Who Is Covered

"Operator" means, to the extent that an entity is operating in this capacity, the operator of an Internet website, online service, online application, or mobile application, or artificial intelligence model with actual knowledge that the site, service, application, or model is used primarily for K through 12 school purposes and was designed and marketed for K through 12 school purposes.

"School" means (1) any preschool, public kindergarten, elementary or secondary educational institution, vocational school, special educational facility, or any other elementary or secondary educational agency or institution or (2) any person, agency, or institution that maintains school student records from more than one school.

Compliance Obligations 12 obligations · click obligation ID to open requirement page

H-01 Human Oversight of Automated Decisions · H-01.4 · Government · EducationMinors

Student Educational Technologies Rights Act § 15(a)(2)

Plain Language

Students and their parents have the right to request that a human teacher review any grade that was scored automatically or generated by AI. This is a human-review-on-demand right — the student or parent must invoke it, but when invoked, the school must provide a human teacher's review. The bill frames this as a state policy right rather than a procedural mandate with specific timelines, which may create ambiguity about enforcement mechanisms.

Statutory Text

(a) It is the policy of this State that a student and the student's parent have the right to: (2) request a human teacher review any automated scored grade or scored grade generated by artificial intelligence;

D-01 Automated Processing Rights & Data Controls · D-01.3 · Government · EducationMinors

Student Educational Technologies Rights Act § 15(a)(1), (3), (b)

Plain Language

Students and parents have the right to opt out of school-issued electronic devices, electronic textbooks, electronic reading materials, electronic or online assignments, and predictive analytics systems without academic penalty. When the opt-out right is exercised, the school must provide a comparable analog alternative — such as paper assignments, physical textbooks, or printed reading materials. The predictive analytics opt-out is notable because it explicitly prohibits any academic penalty for exercising it. Schools must be prepared to offer non-digital equivalents for all digital educational resources.

Statutory Text

(a) It is the policy of this State that a student and the student's parent have the right to: (1) opt out of school-issued personal electronic devices, electronic textbooks, electronic required reading, or electronic or online assignments; (3) opt out of predictive analytics systems without academic penalty. (b) If a student or a student's parent exercises the right outlined in subsection (a), the school shall provide the student with a comparable analog version of what the educational technology provides. As used in this subsection, "comparable analog version" includes, but is not limited to, providing the assignment on physical paper, a physical copy of the required reading, or the option of a physical paper textbook.

S-02 Prohibited Conduct & Output Restrictions · S-02.2 · Government · BiometricsEducationMinors

105 ILCS 5/10-20.40(b), (b-5)

Plain Language

School districts are categorically prohibited from purchasing, acquiring, or using biometric systems — including facial recognition software — on students. The prohibition extends beyond direct acquisition to cover third-party agreements: school districts may not contract with any third party to obtain, retain, possess, access, or use biometric systems or biometric information derived from such systems on behalf of the district. This is a comprehensive ban on student biometric surveillance in schools, closing the loophole of outsourcing biometric collection to vendors.

Statutory Text

(b) A school district is prohibited from purchasing or otherwise acquiring biometric systems, including facial recognition software, to use on students. (b-5) A school district may not do any of the following with respect to students: (1) Obtain, retain, possess, access, request, or use biometric systems or biometric information derived from biometric systems. (2) Enter into an agreement with a third party for the purpose of obtaining, retaining, possessing, accessing, or using, by or on behalf of the school district, biometric systems, including facial recognition software or biometric information derived from biometric systems.

Other · Government · BiometricsEducationMinors

105 ILCS 5/10-20.40(b-10), (b-15), (b-20), (d)

Plain Language

Within 30 days of the Act's effective date, school districts possessing student biometric information must destroy it and provide certified documentation of destruction to the State Board of Education. If a district has contracted with a third party to collect or store student biometric information, the district must require that third party to destroy the data and confirm destruction in writing. During the 30-day wind-down period, districts may not sell, lease, or disclose the biometric information except with custodial consent or court order. The Local Records Act approval requirement is waived for destruction within this 30-day window.

Statutory Text

(b-10) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, if a school district is in possession of student biometric information, then the school district shall destroy the biometric information and provide certified documentation of destruction to the State Board of Education. (b-15) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, any school district that has contracted with a third party to obtain, collect, or store student biometric information shall require the third party to destroy the biometric information in its possession and confirm in writing the completion of this destruction to the school district. (b-20) During the 30-day period in which a school district may still have student biometric information in its possession under subsection (b-10), the school district is prohibited from selling, leasing, or otherwise disclosing the biometric information to another person or entity unless: (1) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or (2) the disclosure is required by court order. (d) Student biometric information may be destroyed without notification to or the approval of a local records commission under the Local Records Act if destroyed within 30 days after the effective date of this amendatory Act of the 104th General Assembly.

S-02 Prohibited Conduct & Output Restrictions · S-02.2 · Government · BiometricsEducationMinors

105 ILCS 5/34-18.34(b), (b-5)

Plain Language

This is the parallel provision for the Chicago Public Schools district (Section 34 of the School Code). It imposes the same categorical prohibition on purchasing, acquiring, or using biometric systems on students, and the same ban on third-party agreements for biometric system access. The obligations and scope are identical to those in Section 10-20.40 but apply specifically to the Chicago school district.

Statutory Text

(b) The school district is prohibited from purchasing or otherwise acquiring biometric systems, including facial recognition software, to use on students. (b-5) The school district may not do any of the following with respect to students: (1) Obtain, retain, possess, access, request, or use biometric systems or biometric information derived from biometric systems. (2) Enter into an agreement with a third party for the purpose of obtaining, retaining, possessing, accessing, or using, by or on behalf of the school district, biometric systems, including facial recognition software or biometric information derived from biometric systems.

Other · Government · BiometricsEducationMinors

105 ILCS 5/34-18.34(b-10), (b-15), (b-20), (d)

Plain Language

This is the parallel biometric data destruction provision for the Chicago Public Schools district. Within 30 days of the Act's effective date, if the district possesses student biometric information it must destroy it and provide certified documentation to the State Board of Education. Third-party contractors must also destroy the data and confirm in writing. During the 30-day wind-down, no disclosure is permitted except with custodial consent or court order.

Statutory Text

(b-10) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, if the school district is in possession of student biometric information, then the school district shall destroy the biometric information and provide certified documentation of destruction to the State Board of Education. (b-15) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, if the school district has contracted with a third party to obtain, collect, or store student biometric information, then the school district shall require the third party to destroy the biometric information in its possession and confirm in writing the completion of this destruction to the school district. (b-20) During the 30-day period in which the school district may still have student biometric information in its possession under subsection (b-10), the school district is prohibited from selling, leasing, or otherwise disclosing the biometric information to another person or entity unless: (1) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or (2) the disclosure is required by court order. (d) Student biometric information may be destroyed without notification to or the approval of a local records commission under the Local Records Act if destroyed within 30 days after the effective date of this amendatory Act of the 104th General Assembly.

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · EducationMinors

105 ILCS 85/10(3), (3.5)

Plain Language

Ed-tech operators may not sell or rent student information or data — including covered information — or any other person's information collected for K-12 school purposes. A narrow exception exists for corporate acquisitions if the successor complies with the Act. Separately, operators may not permit AI to train on covered information unless the training is for K-12 school purposes or to improve operability and functionality of the operator's service. This creates a strict purpose-limitation regime: student data collected in the K-12 context is locked to educational purposes, and AI training on that data is similarly restricted. The definition of 'covered information' now expressly includes data gathered through AI and digital replicas.

Statutory Text

(3) Sell or rent a student's information or data, including covered information or any other person's information collected by the operator for K through 12 school purposes. This subdivision (3) does not apply to the purchase, merger, or other type of acquisition of an operator by another entity if the operator or successor entity complies with this Act regarding previously acquired student information. (3.5) Permit artificial intelligence to train on covered information unless for K through 12 school purposes or in furtherance of improving operability and functionality of the operator's service.

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · EducationMinors

105 ILCS 85/10(4)(A)

Plain Language

Operators may disclose covered information only for enumerated permitted purposes, including furtherance of K-12 school purposes. The new language clarifies that 'improving operability' — which is an exception allowing further disclosure — does not extend to disclosing covered information to third parties for AI training that is not for K-12 school purposes. This closes a potential loophole where operators could share student data with third-party AI companies under the guise of improving the platform's operability. Recipients of disclosed covered information are further prohibited from re-disclosing it except for operability improvements.

Statutory Text

(4) Except as otherwise provided in Section 20 of this Act, disclose covered information, unless the disclosure is made for the following purposes: (A) In furtherance of the K through 12 school purposes of the site, service, application, or model if the recipient of the covered information disclosed under this clause (A) does not further disclose the information, unless done to allow or improve operability and functionality of the operator's site, service, or application. Improving operability does not include disclosing covered information to any third party to train artificial intelligence that is not for K through 12 school purposes.

D-01 Automated Processing Rights & Data Controls · D-01.8 · Deployer · EducationMinors

105 ILCS 85/15(2)

Plain Language

Before an operator's AI model may train on a student's covered information and retain that training data indefinitely, the operator must: (1) provide written notice to the student or parent that the AI model will retain training data indefinitely, and (2) obtain written consent from the student or parent. Without both written notice and written consent, the AI model may not train on covered information with indefinite retention. This imposes an opt-in consent regime specifically for the combination of AI training and indefinite data retention — not for AI training alone (which is separately restricted to K-12 purposes under Section 10(3.5)).

Statutory Text

An operator's artificial intelligence model shall not train on a student's covered information and retain the training data indefinitely, unless it first: (A) informs the student or his or her parent in writing that the operator's artificial intelligence model will retain training data indefinitely; and (B) receives a written consent from the student or his or her parent.

Other · EducationMinors

105 ILCS 85/25(1), (3)

Plain Language

The existing safe harbors in Section 25 allow operators to use de-identified covered information to improve educational products or share it for educational development. The new language clarifies that these safe harbors do not extend to an operator's AI model training on a student's covered information with indefinite training data retention — unless the operator has satisfied the notice-and-consent requirements of Section 15(2). This prevents operators from relying on the de-identification exceptions to retain student training data indefinitely without consent.

Statutory Text

(1) Using covered information to improve educational products if that information is not associated with an identified student within the operator's site, service, or application or other sites, services, or applications owned by the operator. This paragraph does not include an operator's artificial intelligence model training on a student's covered information and retaining the training data indefinitely unless the operator satisfies the requirement of paragraph (2) of Section 15. (3) Sharing covered information that is not associated with an identified student for the development and improvement of educational sites, services, or applications. This paragraph does not include an operator's artificial intelligence model training on a student's covered information and retaining the training data indefinitely unless the operator satisfies the requirement of paragraph (2) of Section 15.

MN-01 Minor User AI Safety Protections · MN-01.7 · Deployer · EducationMinors

105 ILCS 85/10(1)

Plain Language

Operators may not engage in targeted advertising on their own platforms or on any other platform using information acquired through K-12 school purposes. This includes covered information and persistent unique identifiers. The prohibition covers both on-platform and cross-platform targeting. Contextual advertising — based solely on the student's current visit without retaining behavioral data over time — is excluded from the definition of targeted advertising and remains permitted. The new language adds 'or model' throughout to cover AI models alongside sites, services, and applications.

Statutory Text

(1) Engage in targeted advertising on the operator's site, service, application, or model or target advertising on any other site, service, application, or model if the targeting of the advertising is based on any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of that operator's site, service, application, or model for K through 12 school purposes.

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · EducationMinors

105 ILCS 85/10(2)

Plain Language

Operators may not use information gathered through K-12 platforms — including AI models — to build profiles about students except for K-12 school purposes. This is a purpose-limitation restriction on student profiling. Account information that remains under the student's, parent's, or school's control is excluded from the profiling prohibition. The new language extends this existing prohibition to AI models operated for K-12 school purposes.

Statutory Text

(2) Use information, including persistent unique identifiers, created or gathered by the operator's site, service, application, or model to amass a profile about a student, except in furtherance of K through 12 school purposes. "Amass a profile" does not include the collection and retention of account information that remains under the control of the student, the student's parent, or the school.