Illinois privacy policy governs how businesses, public agencies, technology platforms, employers, and other organizations collect, use, retain, protect, and disclose personal information. Explore Illinois laws and policy developments involving biometric and genetic information, children’s online activity, consumer data, cybersecurity, breach response, surveillance technologies, and other sensitive information.
Illinois does not rely on a single, comprehensive privacy statute. Instead, state law protects different types of information through subject-specific laws governing biometric identifiers, genetic information, personal-information breaches, children’s online activity, health and insurance records, student data, and particular government or commercial uses of information.
Biometric information: The Illinois Biometric Information Privacy Act remains one of the country’s most consequential biometric-privacy laws. It regulates private entities’ collection, use, retention, disclosure, and protection of fingerprints, face or iris scans, voiceprints, and related biometric information. It also permits qualifying individuals to bring civil actions. Public Act 103-0769 amended the law in 2024 to recognize electronic signatures as written releases and generally treat repeated collections or transmissions involving the same person and the same collection method as a single violation rather than separate violations for every scan or transmission.
Children’s online privacy and safety: Illinois enacted the Children’s Online Social Media Safety Act in 2026. Beginning January 1, 2028, the law will establish age-assurance, privacy, and platform-design requirements for covered device manufacturers, application stores, online platforms, and social-media operators. Among other provisions, it addresses age-bracket signals, default protections for minors, addictive feeds, autoplay, overnight notifications, direct messaging, precise geolocation, search indexing, and certain digital transactions. Implementation will require coordination among device manufacturers, platform operators, parents, minors, regulators, and technology providers.
Genetic, health, and other sensitive information: The Illinois Genetic Information Privacy Act restricts the collection, disclosure, and use of genetic information in employment, insurance, and other covered settings. Genetic information, biometric information, medical records, family medical history, reproductive-health information, and consumer-generated health data may be governed by different state and federal laws. Whether a particular protection applies therefore depends on the information collected, the entity possessing it, and the purpose for which it is used.
Data security and breach response: The Illinois Personal Information Protection Act requires covered entities to protect specified personal information and provide notice following qualifying security breaches. Organizations must consider not only technical cybersecurity controls but also data inventories, retention practices, employee access, vendor relationships, incident-response procedures, consumer notification, and reporting to the Illinois Attorney General.
Consumer data rights: Illinois continues to consider comprehensive consumer-data legislation that would establish broader rights involving access, correction, deletion, portability, targeted advertising, profiling, and the sale or sharing of personal data. Senate Bill 340 is one such proposal in the 104th General Assembly. Unless comprehensive legislation is enacted, Illinois privacy rights and organizational obligations remain distributed among narrower state statutes, federal laws, contracts, and industry-specific regulations.
Government data and surveillance: Privacy questions also arise when public agencies or their vendors collect, retain, search, or share license-plate records, geolocation information, facial images, communications, health information, and other personal data. Recent disputes involving interstate access to automated license-plate-reader information illustrate the continuing tension among public safety, individual privacy, government transparency, reproductive-health protections, and immigration policy.
Artificial intelligence and emerging technology: AI systems can amplify existing privacy issues by processing large datasets, inferring sensitive characteristics, generating biometric or behavioral profiles, and reusing information for purposes different from those for which it was originally collected. Privacy compliance, cybersecurity, procurement, transparency, and responsible data governance should therefore be considered throughout an automated system’s development and use—not only after deployment.
The sections below explain these subjects in greater detail and distinguish existing Illinois requirements from proposed legislation, pending implementation, litigation, and broader policy recommendations.
Illinois privacy law is best understood as a collection of overlapping statutes rather than one comprehensive code governing every form of personal information. Which requirements apply depends on the type of information, the organization collecting it, the relationship between the organization and the individual, and how the information is used or disclosed.
Important components of the existing Illinois framework include:
Biometric information: The Biometric Information Privacy Act regulates private entities’ collection, use, retention, disclosure, sale, and protection of biometric identifiers and biometric information.
Genetic information: The Genetic Information Privacy Act restricts genetic testing and the disclosure or use of genetic information in employment, insurance, and other covered settings.
Security breaches: The Personal Information Protection Act establishes security and notification requirements involving specified personal information.
Student information: The Student Online Personal Protection Act regulates how schools, educational-technology operators, and certain third parties handle covered student data.
Children’s online activity: The Children’s Online Social Media Safety Act establishes requirements scheduled to take effect in 2028 for covered platforms, device manufacturers, application stores, and related entities.
Employment information: Illinois laws limit certain employer access to personal online accounts and regulate particular uses of biometric, genetic, and other employee information.
Government and surveillance data: Separate laws govern public records, law-enforcement information, automated license-plate-reader data, communications, and other information collected or maintained by governmental bodies.
These laws may define “personal information,” “biometric information,” “genetic information,” “student data,” and other protected categories differently. Compliance with one statute therefore does not necessarily establish compliance with another.
Illinois organizations may simultaneously be subject to federal privacy requirements. Examples include:
The Health Insurance Portability and Accountability Act for protected health information handled by covered entities and business associates;
The Family Educational Rights and Privacy Act for qualifying educational records;
The Children’s Online Privacy Protection Act for certain online collection of information from children under 13;
The Gramm-Leach-Bliley Act for covered financial institutions;
The Fair Credit Reporting Act for consumer-reporting information; and
Federal Trade Commission authority over unfair or deceptive privacy and data-security practices.
Federal coverage frequently depends on the organization possessing the information rather than the sensitivity of the information alone. For example, health-related information collected by a hospital may be governed by HIPAA, while similar information collected by a consumer application, website, wearable device, or data broker may fall outside HIPAA and instead be governed by other federal or state laws.
A growing number of states have enacted comprehensive consumer-data laws establishing a common set of rights and business responsibilities across many industries. Illinois has repeatedly considered similar legislation but, as of September 2026, has not enacted a generally applicable consumer-data privacy law of that type.
As a result, an Illinois consumer does not automatically receive the same access, correction, deletion, portability, and opt-out rights for every category of personal data or every business that processes it. Rights may instead depend on a specialized Illinois statute, a federal law, another state’s law, a contract or privacy policy, or a company’s voluntary practices.
Organizations operating nationally may nevertheless provide broader privacy rights to Illinois residents because they are subject to comprehensive laws in other states. Providing those rights voluntarily does not mean that Illinois has enacted the same statutory requirements.
Senate Bill 340 in the 104th General Assembly proposed the Illinois Consumer Data Privacy Act. The measure passed the Illinois Senate in May 2026 but did not complete the legislative process before the spring session adjourned. Its provisions therefore should be treated as proposed policy rather than current law.
As advanced in the Senate, the proposal would have created broader consumer rights involving:
Confirmation of whether a covered entity processes a consumer’s personal data;
Access to qualifying personal data;
Correction of inaccuracies;
Deletion of certain information;
Portability of personal data;
Opting out of targeted advertising, the sale of personal data, and specified profiling;
Additional protections for sensitive information; and
Appeals when a consumer request is denied.
The proposal also addressed responsibilities of data controllers and processors, privacy notices, contractual relationships, data-protection assessments, security practices, and Attorney General enforcement. Coverage, exemptions, implementation dates, definitions, enforcement authority, cure opportunities, and the existence or absence of a private right of action are among the issues that can materially change a proposal’s impact.
A comprehensive privacy law involves more than deciding whether consumers should have privacy rights. Policymakers must also determine:
Which businesses and nonprofit organizations are covered;
Whether coverage is based on revenue, number of consumers, volume of data, or other thresholds;
Which government, healthcare, financial, employment, and educational records are exempt;
How “sale,” “targeted advertising,” “profiling,” and “sensitive data” are defined;
Whether consumers must opt in or opt out;
How identity verification and authorized-agent requests operate;
Whether enforcement belongs solely to the Attorney General or also includes individual lawsuits;
Whether organizations receive notice and an opportunity to cure;
How the law applies to small businesses and service providers;
Whether local governments may enact additional requirements; and
How Illinois requirements interact with other states’ laws and federal regulation.
These choices determine both the practical strength of consumer protections and the operational burden placed on covered organizations.
Even without an enacted omnibus Illinois law, organizations benefit from understanding what personal information they possess, why they collect it, where it is stored, how long it is retained, which employees and vendors may access it, and under what circumstances it is shared.
A useful privacy-governance review can include:
Inventorying personal and sensitive information;
Identifying the legal basis and business purpose for collection;
Limiting collection and retention to appropriate purposes;
Reviewing notices, consent procedures, and consumer-request processes;
Evaluating vendors and data-sharing agreements;
Applying security protections appropriate to the information;
Preparing for breach notification and incident response; and
Assessing new technologies before they introduce additional data collection, profiling, or automated decision-making.
This framework helps organizations comply with existing law while preparing for future state or federal requirements.
The Illinois Biometric Information Privacy Act, commonly called BIPA, regulates how private entities collect, use, retain, disclose, sell, and protect biometric identifiers and biometric information. Enacted in 2008, the law reflects the concern that biometric characteristics are biologically connected to an individual and cannot be replaced as readily as a compromised password or account number.
BIPA identifies the following as biometric identifiers:
Retina or iris scans;
Fingerprints;
Voiceprints; and
Scans of hand or face geometry.
“Biometric information” generally means information based on a covered biometric identifier that is used to identify an individual, regardless of how the information is captured, converted, stored, or shared.
Not every photograph, video, audio recording, signature, physical description, or piece of health information is automatically covered. Whether a technology implicates BIPA depends on what the system captures or derives, whether the resulting information falls within the statutory definitions, and how that information is used.
For example, recording a person’s voice is not necessarily the same as generating a voiceprint, and possessing a photograph is not necessarily the same as creating a scan of face geometry. Facial-recognition, voice-authentication, workplace timekeeping, building-access, medication-dispensing, identity-verification, and AI-enabled systems should be evaluated according to their actual technical functions rather than their marketing labels.
Before collecting or obtaining covered biometric information, a private entity generally must:
Inform the individual or the individual’s legally authorized representative in writing that biometric information is being collected or stored;
Explain in writing the specific purpose and length of time for which the information will be collected, stored, and used; and
Obtain a written release.
Public Act 103-0769, enacted in 2024, expressly recognizes an electronic signature as a permissible written release. Electronic consent still should provide the required information, be attributable to the individual, and be retained in a form that can demonstrate what the person authorized.
Consent for one use should not automatically be assumed to authorize unrelated uses, new technologies, additional disclosures, or indefinite retention.
A private entity possessing biometric identifiers or biometric information must develop a written, publicly available policy establishing:
A retention schedule; and
Guidelines for permanently destroying the information.
The policy generally must require destruction when the original purpose for collecting or obtaining the information has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first, subject to applicable legal process.
A written policy alone is insufficient if the organization does not follow it. Organizations should identify where biometric information is stored, which vendors possess it, how deletion is verified, and who is responsible for implementing the retention schedule.
BIPA prohibits a private entity from selling, leasing, trading, or otherwise profiting from a person’s biometric identifier or biometric information.
Disclosure or dissemination is generally restricted unless:
The individual or legally authorized representative consents;
The disclosure completes a financial transaction requested or authorized by the individual;
State or federal law or a municipal ordinance requires the disclosure; or
A valid warrant or subpoena requires it.
Covered information must be stored, transmitted, and protected using the reasonable standard of care within the entity’s industry and in a manner at least as protective as the entity uses for other confidential and sensitive information.
Contracts with payroll companies, security vendors, cloud providers, technology developers, and other service providers should address authorized uses, security, retention, deletion, incident response, and restrictions on further disclosure. Using a third-party system does not by itself eliminate the organization’s BIPA responsibilities.
BIPA permits an “aggrieved” person to bring a civil action. Available relief may include:
Actual damages or statutory damages of $1,000 for a negligent violation;
Actual damages or statutory damages of $5,000 for an intentional or reckless violation;
Reasonable attorneys’ fees and litigation expenses; and
Other relief, including an injunction, that a court considers appropriate.
In Rosenbach v. Six Flags Entertainment Corp., the Illinois Supreme Court held that a person does not need to allege a separate injury beyond violation of a statutory BIPA right to qualify as aggrieved.
In Tims v. Black Horse Carriers, Inc., the Court held that a five-year limitations period applies to BIPA claims.
In Cothron v. White Castle System, Inc., the Illinois Supreme Court held that, under the statutory language then before it, a claim could accrue each time a private entity collected or transmitted biometric information without complying with BIPA. The Court also invited the General Assembly to review the potential consequences of that interpretation.
Public Act 103-0769 subsequently amended BIPA. Under the amended law, when the same private entity collects or discloses the same person’s biometric information more than once using the same method in violation of the applicable provision, the repeated conduct generally constitutes a single violation for which the person may receive no more than one recovery.
The amendment substantially changes potential exposure involving recurring scans, such as employees using fingerprint or hand-geometry systems repeatedly. It does not eliminate the underlying duties to provide notice, obtain a release, maintain and follow a retention policy, restrict disclosures, and protect the information.
Questions concerning which version of the statute applies to particular past conduct may depend on the dates, claims, procedural posture, and controlling judicial decisions.
BIPA contains exclusions and limitations involving specified healthcare information and activities, financial institutions governed by the Gramm-Leach-Bliley Act, government entities, and other categories identified by statute.
In Mosby v. Ingalls Memorial Hospital, the Illinois Supreme Court concluded that BIPA’s healthcare exclusion applied to biometric information collected from healthcare workers when the information was used to access medication and provide healthcare treatment. The decision does not create a categorical exemption for every use of biometrics by a healthcare organization. Coverage depends on the entity, information, technology, and purpose involved.
An organization evaluating biometric technology should ask:
Does the system create or use a statutory biometric identifier or biometric information?
What business or security purpose requires the technology?
Can that purpose be achieved through a less sensitive method?
What written notice and release will be used?
Is the consent process completed before collection begins?
Is a compliant retention-and-destruction policy publicly available and followed?
Which vendors receive or store the information?
Are contracts consistent with BIPA’s use, security, disclosure, and deletion requirements?
How will the organization respond to a security incident?
Do healthcare, financial, government, labor, or other statutory provisions affect the analysis?
Does a later software update introduce facial recognition, voice authentication, AI analysis, or another use not covered by the original notice?
BIPA compliance should be reviewed before deploying a system and whenever its technology, purpose, vendor, or data practices change.
Illinois enacted the Children’s Online Social Media Safety Act through Public Act 104-0664 in July 2026. The law establishes new responsibilities for covered online platforms and for manufacturers, operating-system providers, and application stores involved in communicating a device user’s age bracket.
The Act takes effect January 1, 2028, with principal implementation requirements applying during 2028. Until those requirements take effect, organizations should distinguish the enacted implementation schedule from current operational obligations.
The Act creates a system intended to communicate a user’s age bracket without routinely disclosing the user’s full birth date or identity to every application or website.
Covered manufacturers must provide an accessible method during device or account setup for identifying the primary user’s age or birth date. Covered developers and operators must be able to request a digital signal identifying the user’s applicable age bracket.
The law limits how age-signal information may be used and generally requires that only the minimum information necessary for compliance be transmitted. Digital signals must be protected in transit, and covered entities may not use age-assurance information for unrelated purposes.
The framework attempts to place responsibility across the technology ecosystem rather than requiring every individual platform to collect identification documents directly from every user. Its effectiveness will depend on technical standards, interoperability, device-sharing practices, parental setup, and the accuracy of the underlying age information.
When a covered operator knows—or receives an authoritative signal indicating—that a user is under 18, the operator must apply specified default protections.
Depending on the platform and user, these protections address:
Visibility of a minor’s profile and personal information;
Contact and direct messaging between minors and adults;
Disclosure of precise geolocation information;
Search-engine indexing of a minor’s profile;
Connections between accounts;
Financial transactions and gifted digital currency;
Autoplay and other engagement features;
Notifications associated with addictive feeds; and
The collection or use of information to personalize content.
A parent may override specified defaults for a minor. A covered minor whom the operator determines is older than 16 may also override certain privacy settings. The precise authority to change a setting therefore depends on the user’s age and the particular protection involved.
The Act separately regulates an “addictive feed”—generally, a feed that uses information associated with a user or device, including prior interactions, to recommend, select, or prioritize user-generated media.
A covered operator generally may not provide an addictive feed to a minor unless it obtains verifiable parental consent. The law also restricts notifications concerning addictive feeds during specified overnight hours unless parental consent has been obtained.
Content that a user expressly requests, searches for, subscribes to, or receives through certain direct communications is treated differently from an engagement-driven feed. The law therefore does not prohibit minors from using social media or viewing online content. It principally regulates how covered platforms automatically select, prioritize, and promote that content.
Information collected to obtain parental consent may be used only for that purpose and generally must be deleted promptly after the consent process, except when retention is required by law.
Age-assurance laws present their own privacy questions. A system intended to protect minors can create additional risks if it requires every user to submit identification documents, biometric information, or detailed birth-date information.
Illinois’ signal-based approach attempts to reduce those risks through age brackets, limited data transmission, encryption, restrictions on secondary use, and requirements to delete information collected for parental verification. Implementation will still require evaluation of:
Whether age information is accurate;
How shared and reassigned devices are handled;
Whether the system collects more information than necessary;
How age signals are corrected or challenged;
Whether age or parental-consent data is retained;
How vendors and application stores participate;
Whether compliance tools introduce biometric or identity-theft risks; and
Whether platforms use age information for advertising or other unrelated purposes.
The Illinois Attorney General is responsible for enforcing the Act. Covered entities should not assume that compliance by a device manufacturer, application store, developer, or platform automatically satisfies every other participant’s responsibilities.
Children’s online-safety laws enacted in other states have generated First Amendment, Commerce Clause, preemption, and privacy challenges. Illinois’ law may produce similar litigation concerning age assurance, platform design, protected speech, parental authority, and the burdens imposed on interstate online services.
Unless a court stays or invalidates a provision, covered entities should prepare for the statutory implementation schedule while monitoring litigation, Attorney General guidance, and the development of technical standards.
The federal Children’s Online Privacy Protection Act and its implementing rule regulate certain online collection, use, and disclosure of personal information from children under 13.
COPPA and the Illinois Act differ in important respects:
COPPA principally addresses personal information collected from children under 13;
The Illinois law establishes protections for covered users under 18;
COPPA focuses on notice, parental consent, access, security, retention, and deletion;
The Illinois law additionally addresses age signals, platform defaults, addictive feeds, geolocation, messaging, notifications, and other design features; and
Compliance with one law does not necessarily establish compliance with the other.
Platforms, schools, application developers, service providers, and other organizations may also be subject to student-privacy, consumer-protection, biometric, health-information, or data-breach laws depending on their services and data practices.
The Illinois Age-Appropriate Design Code proposals introduced through Senate Bill 1126 in 2023 and Senate Bill 3334 in 2024 did not become law. Those proposals would have required broader data-protection impact assessments, high-privacy defaults, age estimation, restrictions on profiling, and consideration of children’s best interests for online services likely to be accessed by children.
Public Act 104-0664 uses a different statutory structure centered on device-level age signals, covered social platforms, specified default protections, and addictive-feed restrictions. The earlier bills remain relevant to the history of Illinois children’s-privacy policy but should not be described as current requirements.
Organizations potentially affected by the new law should consider:
Whether their devices, application stores, websites, services, or applications fall within a statutory definition;
Whether minors can create accounts or use the service;
How age-bracket signals will be requested, transmitted, received, and secured;
Which settings must change when the user is a minor;
How parental consent and older-minor overrides will be documented;
Whether recommendation systems constitute addictive feeds;
How direct messaging, geolocation, profile indexing, autoplay, notifications, and digital transactions operate;
What information is collected during age or parental verification;
How that information will be minimized and deleted; and
Whether contracts assign responsibilities consistently with the Act.
Because implementation depends on both legal definitions and technical design, compliance planning will likely require coordination among legal, privacy, cybersecurity, product-development, procurement, and vendor-management personnel.
Genetic and health-related information does not fall under one uniform privacy rule. The protections that apply depend on what the information reveals, how it was obtained, who possesses it, and how it is used. A hospital record, direct-to-consumer genetic profile, family medical history, fertility-app entry, and employer wellness questionnaire may therefore be governed by different—and sometimes overlapping—laws.
The Illinois Genetic Information Privacy Act (GIPA) generally treats genetic testing and information derived from genetic testing as confidential and privileged. The law addresses genetic testing by healthcare providers as well as direct-to-consumer testing services.
Subject to statutory exceptions, GIPA regulates who may receive identifiable genetic-test results and ordinarily requires a legally effective written authorization for disclosure. The law also contains rules for healthcare treatment and operations, research, public-health activities, health-information exchanges, insurers, employers, and government agencies.
Not every medical measurement or laboratory result is necessarily a “genetic test.” Coverage depends on statutory definitions and the information involved. Organizations should therefore determine whether they possess:
Genetic-test results or biological samples;
Information about an individual’s genetic services;
Genetic information concerning family members;
Family medical history that may qualify as genetic information;
An ordinary diagnosis or medical history that does not independently qualify as genetic information; or
Data from which genetic traits or health risks can be inferred.
These distinctions matter because GIPA permits a private lawsuit and authorizes liquidated or actual damages, attorney fees, litigation expenses, injunctive relief, and other appropriate remedies. Current law provides liquidated damages of $2,500 for a negligent violation and $15,000 for an intentional or reckless violation, or actual damages if greater.
Illinois employers, employment agencies, labor organizations, and licensing agencies generally may not request, require, purchase, or use genetic testing or genetic information as a condition of employment, membership, or licensure. Limited exceptions apply, including carefully regulated wellness programs, occupational genetic monitoring, certain forensic laboratories, and employee-requested testing associated with a workers’ compensation claim.
Family medical history requires particular care. Federal law treats family medical history as genetic information because it can indicate an individual’s inherited risk, even when the individual has not undergone genetic testing. Questions commonly asked during leave administration, accommodation discussions, health screenings, or wellness programs can therefore create genetic-information issues if they are drafted or handled too broadly.
The federal Genetic Information Nondiscrimination Act also prohibits genetic discrimination in employment and health coverage. It generally does not regulate life, disability, or long-term-care insurance in the same manner, however, and Illinois law may impose separate requirements. The particular insurance product and intended use of the information must be examined.
The federal HIPAA Privacy and Security Rules protect identifiable health information maintained or transmitted by covered health plans, healthcare clearinghouses, qualifying healthcare providers, and their business associates. HIPAA establishes disclosure limits, individual rights, and administrative, physical, and technical safeguards.
HIPAA is not a general privacy law covering all information that relates to health. Information entered into a consumer wellness application, collected by a wearable device, disclosed to a social-media platform, or provided directly to a business may fall outside HIPAA when the recipient is not a covered entity or business associate.
Non-HIPAA health information may still be regulated by the Federal Trade Commission Act, the FTC Health Breach Notification Rule, Illinois’ Personal Information Protection Act, contractual commitments, professional licensing laws, and laws governing particular records. The FTC’s rule expressly reaches certain health applications, connected devices, and similar products that maintain individually identifiable health information.
Sensitive health information may receive additional protection based on its subject matter or the organization holding it. Examples include:
Reproductive and sexual-health information;
Mental-health and developmental-disability records;
Substance-use-disorder treatment records;
HIV-related information;
Fertility, pregnancy, and menstrual-cycle information;
Prescription and pharmacy records; and
Disability and accommodation information.
Illinois healthcare, confidentiality, and reproductive-health laws may restrict disclosure or cooperation with proceedings concerning care lawfully provided in Illinois. Federal protections also apply in some settings, although the federal reproductive-health provisions added to HIPAA in 2024 were substantially vacated by a federal court in 2025. Organizations should confirm the law currently in effect rather than relying on summaries written before that decision.
Substance-use-disorder records maintained by federally assisted programs receive specialized protection under 42 C.F.R. Part 2. Updated federal rules align some Part 2 requirements more closely with HIPAA, but the records should not simply be treated as ordinary medical information.
Health-sensitive information can be created without a formal medical record. Searches, purchases, location histories, appointment reminders, communications, fertility tracking, wearable-device readings, and online behavior may collectively reveal a medical condition or the receipt of healthcare.
Artificial-intelligence and analytics systems can also infer pregnancy, disease risk, disability, mental-health status, or genetic characteristics from data that appears less sensitive when viewed separately. Whether an inference satisfies a particular statutory definition may vary, but its disclosure or use can still create privacy, discrimination, security, and reputational risks.
Organizations should evaluate sensitive information according to what it reveals and how it may be used—not merely the label assigned to the database containing it.
Organizations handling genetic or health-related information should consider:
Creating an inventory identifying the source, purpose, location, and legal classification of sensitive data;
Separating genetic information from ordinary personnel and business records;
Limiting collection to information reasonably necessary for a defined purpose;
Using specific authorization language rather than relying on broad, indefinite consent;
Restricting internal access and vendor access according to role and need;
Reviewing wellness, benefits, leave, accommodation, and employment forms for unnecessary family medical-history questions;
Confirming whether a health application or connected product is subject to HIPAA, the FTC Health Breach Notification Rule, or another regime;
Establishing retention and secure-deletion standards for samples as well as electronic records;
Evaluating secondary uses, targeted advertising, analytics, and AI-generated health inferences; and
Coordinating privacy compliance with cybersecurity and incident-response planning.
Because multiple statutes may apply to the same information, compliance should begin with the data, the holder, and the proposed use—not with the assumption that HIPAA or any single Illinois law supplies the complete answer.
A cybersecurity incident and a legally reportable data breach are related but not identical. Malware, ransomware, unauthorized system access, lost equipment, misdirected communications, compromised credentials, and vendor incidents all require investigation, but notification obligations generally depend on the information involved, the affected individuals, the organization’s role, and the laws governing the data.
Illinois organizations should prepare to address security, operational, legal, insurance, contractual, and communications issues at the same time.
The Illinois Personal Information Protection Act (PIPA) applies broadly to businesses, nonprofit organizations, educational institutions, government bodies, and other entities that handle nonpublic personal information.
For breach-notification purposes, protected personal information includes an individual’s name combined with specified unencrypted or compromised data, such as:
Social Security, driver’s-license, or state-identification numbers;
Financial-account or payment-card information;
Medical or health-insurance information; or
Biometric data used to authenticate an individual.
A username or email address combined with a password or security answer permitting access to an online account is also covered, even without the individual’s name.
PIPA defines a breach as the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of protected personal information. A good-faith acquisition by an employee or agent for a legitimate purpose is excluded when the information is not misused or further disclosed without authorization.
An organization that owns or licenses affected information must notify Illinois residents in the most expedient time possible and without unreasonable delay, while allowing time to determine the breach’s scope and restore reasonable system integrity. Notice may be delayed when law enforcement provides a written determination that notification would interfere with a criminal investigation.
The required content depends partly on the information involved. Notices concerning financial, medical, insurance, biometric, or government-identification information must direct affected individuals to resources concerning fraud alerts and security freezes. A credential breach notice may instead direct individuals to change passwords, security questions, and credentials used for other accounts.
If a single breach requires notice to more than 500 Illinois residents, the organization must also notify the Illinois Attorney General no later than it provides notice to consumers. The Attorney General notice must describe the incident, state the number of Illinois residents affected at that time, and identify responsive steps taken or planned.
An organization that stores information for another entity must notify the information’s owner or licensee immediately following discovery when personal information was—or is reasonably believed to have been—acquired by an unauthorized person. Contracts should allocate investigation, cooperation, notice, cost, and decision-making responsibilities before an incident occurs.
Illinois state agencies have additional reporting requirements. Among other provisions:
A state agency generally must notify affected residents without unreasonable delay;
A breach involving more than 250 Illinois residents requires notice to the Attorney General, generally within 45 days after discovery or when consumer notice is provided, whichever occurs sooner;
State agencies directly responsible to the Governor must report certain breaches involving more than 250 Illinois residents to the Department of Innovation and Technology’s Chief Information Security Officer and the Attorney General within 72 hours after discovery; and
State agencies must make specified reports to the General Assembly.
These requirements are distinct from the duties applying to private organizations and local governments.
PIPA requires data collectors to implement and maintain reasonable safeguards against unauthorized access, acquisition, destruction, use, modification, or disclosure. Contracts involving disclosure of Illinois residents’ personal information must also require the recipient to maintain reasonable security measures.
The law does not prescribe one security program for every organization. Appropriate safeguards depend on factors such as the organization’s size, resources, systems, data sensitivity, foreseeable threats, and operational needs. Common safeguards include:
Multi-factor authentication and strong access controls;
Encryption of sensitive information in transit and at rest;
Prompt software updates and vulnerability management;
Protected, tested, and recoverable backups;
Network segmentation and system logging;
Phishing-resistant identity and email protections;
Employee training and reporting procedures;
Data-retention and secure-disposal schedules;
Vendor security review and contractual incident-notification requirements; and
Periodic testing of incident-response and business-continuity plans.
Encryption can materially reduce risk, but it is not a complete defense. An investigation should determine whether encryption keys, credentials, sessions, backups, or readable copies were also compromised.
Illinois PIPA is only one part of the analysis. Depending on the organization and information involved, an incident may also trigger:
The HIPAA Breach Notification Rule for covered healthcare entities and business associates;
The FTC Health Breach Notification Rule for certain health applications, connected devices, and personal-health-record services outside HIPAA;
Gramm-Leach-Bliley Act requirements for regulated financial institutions;
Federal education-record protections and state student-data laws;
Securities-law reporting requirements for public companies;
Criminal-justice, tax, insurance, professional-licensing, or critical-infrastructure requirements;
Contractual notice duties owed to clients, insurers, payment-card networks, grantors, or government agencies; and
The breach-notification laws of other states when affected individuals reside outside Illinois.
HIPAA-covered entities and business associates that comply with applicable federal privacy and security standards are generally deemed compliant with PIPA, but an entity notifying the U.S. Department of Health and Human Services of a breach must also notify the Illinois Attorney General within five business days after notifying HHS.
Because notification deadlines and thresholds vary, organizations should identify affected jurisdictions and legal regimes early rather than assuming that compliance with one law resolves every obligation.
A written response plan should identify who has authority to activate the plan and how technical, legal, operational, insurance, law-enforcement, and communications decisions will be coordinated.
A practical response generally includes:
Contain and preserve. Secure affected accounts and systems without destroying logs or other evidence needed to understand the incident.
Activate the response team. Involve internal leadership, information-security personnel, legal counsel, insurers, forensic specialists, communications staff, and affected vendors as appropriate.
Determine what occurred. Establish the incident timeline, systems involved, method of access, persistence of the threat, and whether data was merely exposed or was actually acquired.
Identify the affected information and individuals. Determine which records were involved, whether they were encrypted or readable, who owned the information, and where affected individuals reside.
Map legal and contractual duties. Evaluate Illinois law, other states’ laws, federal and sector-specific rules, contracts, insurance conditions, and law-enforcement considerations.
Provide accurate notifications. Coordinate notices to individuals, regulators, business partners, insurers, and others while avoiding speculation or inconsistent descriptions.
Restore operations safely. Validate systems, credentials, backups, and security controls before returning to ordinary operations.
Document and improve. Preserve the investigation and decision record, complete any required follow-up reports, address identified weaknesses, and update the response plan.
Ransomware is not solely a system-availability problem. Modern attacks may include data theft, extortion, credential compromise, or disclosure threats. An organization should not conclude that notification is unnecessary merely because systems were restored or a ransom was not paid.
Business email compromise can expose sensitive attachments, cloud files, account credentials, payment instructions, or personal information even when malware is not detected. Organizations should examine mailbox rules, login histories, forwarding settings, connected applications, and actions taken through the compromised account.
Artificial intelligence can make phishing, impersonation, voice cloning, document forgery, and social engineering more convincing. Response planning should therefore include independent verification procedures for payment changes, credential-reset requests, sensitive-data transfers, and urgent communications purportedly coming from organizational leaders.
Incident response is most effective when developed before an emergency. Organizations should know what sensitive information they possess, where it is stored, which vendors can access it, who must be contacted, and which systems are essential to continued operations.
A tabletop exercise can reveal unclear responsibilities, outdated contact information, missing contract provisions, insufficient backups, and communications problems before an actual breach occurs. Cybersecurity preparation should therefore be treated as a continuing governance responsibility—not simply an information-technology function.
Government agencies collect information to administer programs, provide services, maintain public records, investigate crimes, manage transportation systems, and protect public safety. At the same time, mobile devices, automated cameras, drones, connected vehicles, commercial applications, and data brokers can produce detailed records of an individual’s movements and associations.
The applicable privacy rules depend on who collected the information, how it was obtained, why it is being used, and whether it is held by a government agency, law-enforcement agency, contractor, communications provider, or commercial business.
The Illinois Freedom of Information Act generally establishes a presumption that records maintained by public bodies are open to inspection. That presumption supports government transparency, but it does not mean that every piece of personal information held by government must be released.
FOIA and other Illinois laws protect or exempt categories of information that may include:
Information whose disclosure would constitute a clearly unwarranted invasion of personal privacy;
Certain law-enforcement and investigatory records;
Records that could endanger individuals or compromise security;
Medical, mental-health, educational, tax, and other confidential records;
Records protected by another state or federal statute; and
Information generated through automated license-plate-reader systems.
The personal-privacy exemption requires balancing the individual’s privacy interest against the public interest in disclosure. Information bearing on a public employee’s performance of public duties generally receives different treatment from intimate personal information unrelated to government operations.
Records held by a private contractor may still qualify as public records when the contractor is performing a governmental function and the records directly relate to that function. Public bodies should therefore address record ownership, retention, security, public-records responsibilities, and permitted secondary uses in their technology and data-service contracts.
FOIA governs public access to government records; it is not itself authority for agencies to collect, combine, or disclose information for unrelated purposes.
Location information can reveal far more than a person’s position at one moment. A detailed history may identify visits to homes, workplaces, medical providers, religious institutions, political events, schools, support groups, or other sensitive locations.
The Illinois Freedom From Location Surveillance Act generally requires law enforcement to obtain a court order supported by probable cause before obtaining current or future location information from an electronic device. The Act contains defined exceptions, including certain emergencies, consent, stolen devices, and limited circumstances involving a device possessed by a crime victim or witness.
Federal constitutional law also affects government access to digital location information. The U.S. Supreme Court’s decision in Carpenter v. United States recognized a protected privacy interest in extensive historical cell-site location records and generally required a warrant for government acquisition of those records. Questions involving real-time tracking, short-duration records, geofence demands, commercial databases, and newer technologies continue to develop through legislation and litigation.
A warrant or court order is not interchangeable with an administrative subpoena, vendor request, emergency disclosure, or voluntary data purchase. Agencies and providers must identify the specific legal authority supporting each request.
Automated license-plate readers, or ALPRs, capture plate numbers and associated information such as the date, time, location, vehicle image, and direction of travel. A single observation may appear limited, but searchable records collected across multiple jurisdictions can reconstruct patterns of movement.
Section 2-130 of the Illinois Vehicle Code restricts the use and sharing of ALPR information. Illinois ALPR users may not use the systems to investigate or enforce laws that:
Interfere with a person seeking, providing, receiving, assisting with, or traveling for lawful healthcare, including reproductive healthcare; or
Permit detention or investigation based on a person’s immigration status.
Before sharing ALPR information with an out-of-state law-enforcement agency, the Illinois agency must obtain a written declaration affirming that the information will not be used for a prohibited purpose. The statute also directs that ALPR information be maintained confidentially to the fullest extent permitted by law.
Reports that Illinois ALPR data had been accessed for out-of-state reproductive-health and immigration investigations prompted state review, vendor restrictions, and additional attention to auditing and access controls. Those events demonstrated that a statutory prohibition is only as effective as the technical controls, user permissions, search logs, vendor agreements, and oversight systems implementing it.
Public bodies considering ALPR technology should address:
The public-safety purpose supporting deployment;
Camera locations and whether collection is proportionate to that purpose;
Who may conduct a search and under what circumstances;
Retention periods and deletion practices;
Access by other agencies, federal authorities, and private vendors;
Written authorization and verification for external requests;
Audit logs and periodic reviews for misuse;
Procedures for correcting inaccurate information; and
Public reporting that explains the system without compromising investigations.
Illinois State Police maintains a transparency page describing its statewide ALPR program, access, retention, permitted uses, and related safeguards. Local systems and privately operated networks may use different policies, so compliance should be evaluated at the agency and vendor level.
The Illinois Freedom from Drone Surveillance Act generally prohibits law-enforcement agencies from using drones to gather information, subject to statutory exceptions. Those exceptions include uses authorized by a search warrant as well as specified emergency, disaster, missing-person, crime-scene, infrastructure, training, and public-event circumstances.
The Act imposes requirements concerning retention, reporting, destruction, and permissible uses of collected information. Particular restrictions apply to facial-recognition technology and weapons. The Illinois Criminal Justice Information Authority publishes annual reports using information submitted by law-enforcement agencies regarding covered drone deployments.
Drone policy should distinguish between:
Law-enforcement surveillance;
Emergency response and search-and-rescue operations;
Infrastructure inspection and mapping;
Fire, emergency-management, or disaster uses;
Routine photography of public property; and
Private or commercial drone operations.
The legal authority, privacy impact, retention rules, and permissible secondary uses can differ substantially among these activities.
Commercial services can collect precise or inferred location information through mobile applications, advertising identifiers, connected vehicles, wireless networks, wearable devices, payment activity, photographs, and other digital interactions. That information may be used for navigation, fraud prevention, advertising, analytics, workforce management, or service delivery.
Government acquisition of commercially collected data raises a separate question from government collection through its own surveillance equipment. Purchasing information from a broker or requesting it from a technology company does not necessarily eliminate constitutional, statutory, procurement, or policy limitations that would apply if the government collected comparable information directly.
Organizations acquiring location data should consider:
Whether precise location is actually necessary;
Whether users received meaningful notice and choice;
Whether the information reveals sensitive destinations or activities;
Whether data will be sold, shared, or made available to government;
Whether location histories can be linked back to identifiable individuals;
Whether de-identified data can realistically be re-identified;
How long the information is retained;
Whether vendors may use it for their own purposes; and
Whether access is logged, reviewed, and limited to authorized personnel.
Illinois has specialized restrictions relevant to particular government and law-enforcement uses, but it does not yet rely on one comprehensive privacy statute governing every commercial collection and sale of adult location information. Federal consumer-protection authority, sector-specific laws, contractual representations, and laws of other states may therefore remain important.
Surveillance policy should address more than whether a technology is technically capable of assisting an agency. Before adoption or expansion, public bodies should consider:
The specific problem the technology is intended to address;
The legal authority for collection and use;
Whether a less intrusive method could achieve the same purpose;
The categories of people and locations likely to be monitored;
Data quality and the risk of false matches or incorrect inferences;
Retention, sharing, and deletion requirements;
Vendor access and use of data to improve commercial products;
Independent audits and consequences for misuse;
Public notice, procurement transparency, and governing-body oversight; and
Whether aggregate reporting can demonstrate effectiveness without exposing personal information.
Location and surveillance systems often operate across agency and jurisdictional boundaries. Effective oversight therefore requires attention to the full data lifecycle—from initial collection through searches, vendor processing, interagency sharing, retention, and final deletion.
Illinois Vehicle Code — Automated License-Plate-Reader Restrictions
Illinois State Police — Automated License Plate Reader Transparency
Illinois Secretary of State — Action Addressing Unlawful ALPR Use
Illinois Criminal Justice Information Authority — Freedom from Drone Surveillance Act Reports
Federal Trade Commission — Location Data and Sensitive Information
The following official sources provide access to current Illinois statutes, agency guidance, reporting systems, and federal privacy and cybersecurity resources. Requirements vary according to the information, organization, technology, and proposed use involved.
Illinois Personal Information Protection Act — Security, data-disposal, and breach-notification requirements for organizations handling Illinois residents’ personal information.
Illinois Biometric Information Privacy Act — Rules governing private entities’ collection, use, disclosure, retention, and destruction of biometric identifiers and biometric information.
Illinois Genetic Information Privacy Act — Confidentiality, consent, employment, insurance, genetic-testing, and biomarker-information requirements.
Illinois Student Online Personal Protection Act — Responsibilities of schools, the State Board of Education, and educational-technology operators concerning student data.
Illinois Digital Age Assurance Act — Public Act 104-0665 — Age-assurance and related protections governing covered online services used by minors.
Illinois Freedom of Information Act — Public access to government records and exemptions protecting personal, confidential, law-enforcement, and security-related information.
Artificial Intelligence Safety & Governance
Illinois General Assembly — Artificial Intelligence Safety Measures Act, Senate Bill 315 — Legislation establishing safety, transparency, incident-reporting, compliance, independent-audit, and whistleblower-protection requirements for covered developers of the largest advanced AI systems.
Governor’s Office — Artificial Intelligence Safety Measures Act Signing — Official summary of the law, its covered safety and accountability measures, and its January 1, 2027 effective date.
State of Illinois — Executive Order 2026-07 — Executive order creating the Illinois Artificial Intelligence Cabinet to advise the state concerning AI safety, incident preparedness, protection of public assets and infrastructure, procurement, accountability, and possible additional regulation.
Governor’s Office — Establishment of the Illinois Artificial Intelligence Cabinet — Official explanation of the Cabinet’s membership, responsibilities, and initial policy subjects.
Illinois Capitol Group — Advanced Technology & Innovation Policy — Additional analysis of Illinois AI governance, employment requirements, public-sector use, frontier-model safety, data-center policy, and emerging-technology development.
Illinois Freedom From Location Surveillance Act — Court-order requirements and exceptions governing law-enforcement access to electronic-device location information.
Illinois Freedom from Drone Surveillance Act — Restrictions, exceptions, retention rules, reporting requirements, and agency-policy obligations for law-enforcement drone use.
Illinois Vehicle Code: Automated License-Plate-Reader Restrictions — Restrictions on the use and sharing of ALPR information, including information connected to lawful healthcare and immigration enforcement.
Illinois State Police — Automated License Plate Reader Transparency — Information about the State Police ALPR program, access, permitted uses, retention, and safeguards.
Illinois Criminal Justice Information Authority — Drone Reporting — Annual reports, agency reporting information, and resources concerning the Freedom from Drone Surveillance Act.
Illinois Attorney General — Identity Theft and Data-Breach Resources — Consumer guidance, identity-theft assistance, security-freeze information, and access to reported Illinois breach notices.
Illinois Attorney General — Data-Breach Reporting for Organizations — Reporting instructions and information for businesses and state agencies responding to incidents affecting Illinois residents.
Illinois Attorney General — Public Access Counselor — FOIA and Open Meetings Act guidance, training materials, binding opinions, and dispute-resolution resources.
Illinois Department of Innovation & Technology — Cybersecurity — State cybersecurity information, initiatives, and resources.
Federal Trade Commission — Privacy and Security — Business guidance concerning privacy representations, information security, connected products, health applications, and data practices.
Federal Trade Commission — Children’s Privacy — COPPA guidance for online services collecting personal information from children.
Federal Trade Commission — Health Breach Notification Rule — Requirements applying to certain health applications, connected devices, personal-health-record vendors, and related entities outside HIPAA.
U.S. Department of Health and Human Services — HIPAA Privacy Rule — Federal standards for protected health information maintained by covered entities and business associates.
U.S. Department of Health and Human Services — HIPAA Breach Notification Rule — Federal healthcare breach-assessment and notification requirements.
U.S. Equal Employment Opportunity Commission — Genetic Information Discrimination — Guidance concerning genetic information, family medical history, employment decisions, and federal GINA protections.
Cybersecurity and Infrastructure Security Agency — Federal alerts, advisories, vulnerability information, ransomware guidance, and cybersecurity tools.
CISA — Cyber Guidance for Small Businesses — Scalable cybersecurity practices and planning resources for smaller organizations.
National Institute of Standards and Technology — Cybersecurity Framework — A voluntary framework for identifying, protecting, detecting, responding to, and recovering from cybersecurity risks.
Federal Trade Commission — Data Breach Response Guide — Practical steps for containing an incident, preserving evidence, notifying appropriate parties, and reducing further harm.
FBI Internet Crime Complaint Center — Reporting portal and public information concerning ransomware, business email compromise, online fraud, and other cyber-enabled crimes.
These resources provide useful starting points but do not replace an organization-specific review of applicable statutes, regulations, contracts, insurance requirements, and agency guidance.
The materials below document earlier Illinois privacy proposals, litigation, and policy debates. They are retained as historical background and should not be read as a statement of current legal requirements. Readers should consult the current-policy sections above and the Illinois Data Privacy & Cybersecurity Resources directory for present law and guidance.
Before Illinois enacted its current digital age-assurance framework, legislators considered versions of an Illinois Age-Appropriate Design Code Act.
Senate Bill 1126, Senate Amendment No. 1 was proposed in 2023. The legislation would have required businesses offering online services likely to be accessed by children to conduct data-protection impact assessments, use protective default settings, limit unnecessary collection and profiling, provide age-appropriate notices, and avoid design features intended to weaken privacy choices.
A related proposal was introduced in 2024 as Senate Bill 3334. Neither proposal should be confused with the subsequently enacted Illinois Digital Age Assurance Act. They remain useful for understanding the earlier legislative debate concerning children’s privacy, age estimation, online design, profiling, and “dark patterns.”
During the same period, the Illinois Attorney General joined multistate litigation alleging that Meta’s platform design, data practices, and engagement features harmed young users. The litigation represented an enforcement-based approach occurring alongside the legislative proposals.
Historical materials:
Illinois Senate Bill 1126, Senate Amendment No. 1 — 2023 proposal
Illinois Attorney General — 2023 Lawsuit Against Meta Concerning Harm to Children
Illinois’ Biometric Information Privacy Act generated extensive litigation over when claims accrue, how long plaintiffs have to file suit, how repeated scans affect potential liability, and when statutory exemptions apply.
Three 2023 Illinois Supreme Court decisions were especially important:
Tims v. Black Horse Carriers, Inc. applied a five-year limitations period to BIPA claims.
Cothron v. White Castle System, Inc. concluded that a claim could accrue each time biometric information was collected or transmitted in violation of the statute.
Mosby v. Ingalls Memorial Hospital addressed BIPA’s healthcare-related exclusion in the context of fingerprint access to medication and medical-supply systems.
These decisions intensified debate among privacy advocates, employers, technology users, healthcare organizations, and business groups. The General Assembly responded through Senate Bill 2979, enacted as Public Act 103-0769 in August 2024. The amendment recognized electronic signatures for written releases and limited recovery for repeated collection or disclosure involving the same person and method.
The current BIPA section explains the law as amended. The materials below preserve the litigation and legislative debate that led to that amendment.
Historical materials:
Illinois Supreme Court — Tims v. Black Horse Carriers Case Materials
Capitol News Illinois — Court Rulings and the 2024 BIPA Reform Debate
The page previously reviewed an early wave of litigation under the Illinois Genetic Information Privacy Act involving direct-to-consumer genetic services, employment inquiries, family medical history, and insurance underwriting. Those disputes helped expose an important distinction: genetic-test information, family medical history, an individual’s existing medical condition, and ordinary health information are not necessarily treated identically.
The former article also discussed House Bill 4142, a 2023–2024 proposal addressing the use of genetic-testing information in connection with life insurance. The proposal did not establish the current framework and should be retained only as legislative history.
Later litigation and statutory developments, including Illinois’ addition of biomarker protections, make the broader current section titled Genetic, Health & Other Sensitive Data a better guide to present compliance.
Historical materials:
Archived materials can help explain how Illinois’ present privacy framework developed, but proposed bills may never have become law, judicial rulings may have been superseded or limited, and older compliance guidance may no longer reflect statutory amendments.
For current requirements, consult the substantive sections above, the current statutory text, and updated agency guidance.
Need help understanding a privacy proposal, evaluating compliance responsibilities, responding to a data-security incident, or developing an advocacy strategy? Illinois Capitol Group provides legal counsel, government relations, legislative monitoring, and policy guidance concerning Illinois data privacy, cybersecurity, and emerging technology issues.