Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

IL HB5221: CONSUMER DATA PRIVACY ACT

In Committee Illinois · 2025–2026 session

Last verified Oct 24, 2026 · official bill text

HB5221 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Illinois's HB 5221 (104th General Assembly) would create the Consumer Data Privacy Act, with rules for agreements between personal data processors and controllers, controller responsibilities, small business requirements, data protection assessments and civil penalties. Consumers could opt out of processing for targeted advertising, sale of personal data, or profiling in furtherance of automated decisions with legal effects. It would take effect January 1, 2027. Re-referred to Rules March 27, 2026.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Not law. If enacted, businesses handling Illinois consumers' personal data would need opt-out rights for profiling in automated decisions and data protection assessments, and could face civil penalties.

Key provisions

  1. Would create the Consumer Data Privacy Act (new Act) and amend 5 ILCS 140/7.5 for a conforming Freedom of Information Act change
  2. Consumers would have a right to opt out of processing of personal data for targeted advertising, sale of personal data, or profiling in furtherance of automated decisions that produce legal effects
  3. Sets provisions on processor-controller agreements, controller responsibilities, requirements for small businesses, and data privacy and protection assessments
  4. Provides for civil penalties and preempts home rule
  5. Would take effect January 1, 2027
  6. Assigned to Cybersecurity, Data Analytics, & IT Committee March 4, 2026; Rule 19(a) re-referral to Rules Committee March 27, 2026

Latest legislative action

Mar 27, 2026. Rule 19(a) / Re-referred to Rules Committee

Sponsors

NameRoleDistrict
D Sponsor HD-023

Topics and industries

Related topics

AI PrivacyAutomated Decision-Making

Affected industries

TechnologyConsumer Protection

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error

Related AI laws in Illinois

All Illinois bills →
SB51 AGE-APPROPRIATE DESIGN CODE SB0052 PRIVACY RIGHTS ACT SB3241 AGE-APPROPRIATE DESIGN CODE SB0050 AGE-APPROPRIATE DESIGN CODE SB3548 CONSUMER DATA PRIVACY ACT SB2398 SPORTS WAGERING-AI RESTRICTION

Same topic in other states

Connecticut SB1295 An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Vermont S0071 An act relating to consumer data privacy and online surveillance Maryland HB603 Consumer Protection - Online Products and Services - Data of Children (Maryland New York A08158 Enacts the New York privacy act to require companies to disclose their methods o Rhode Island H7222 Video Lottery Games, Table Games And Sports Wagering--the Rhode Island Consumer California SB468 High-risk artificial intelligence systems: duty to protect personal information.