In one paragraph
Illinois's SB 3220 would create the Illinois Consumer Data Privacy Act, giving consumers rights to access, correct, delete and port their personal data and to opt out of targeted advertising, data sales and profiling used for decisions with legal or similarly significant effects. Controllers would have to run data protection impact assessments, including for risky profiling. The Attorney General would enforce it. Filed February 2, 2026; re-referred to Assignments May 22, 2026; it has not passed either house.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
If enacted, businesses that meet the 100,000 or 25,000 consumer thresholds would have to honor consumer data requests and opt-outs and document impact assessments, including for risky profiling.
Key provisions
- Applies to persons doing business in Illinois or targeting Illinois residents that control or process personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50% of gross revenue from selling personal data
- Consumers could confirm and access, correct, delete and obtain a copy of their data, and opt out of targeted advertising, sale of data, or profiling in furtherance of decisions that produce legal or similarly significant effects (Sec. 15)
- Controllers would have to respond to requests within 45 days (one 45-day extension) and offer an appeal decided within 60 days (Sec. 15)
- Controllers would have to conduct and document data protection impact assessments for targeted advertising, data sales, sensitive data, heightened-risk processing and profiling that presents a reasonably foreseeable risk of unfair treatment, disparate impact or other injury; applies to processing activities created or generated on or after June 1, 2028 (Sec. 30)
- Exempts State and local government, financial institutions covered by Gramm-Leach-Bliley, HIPAA covered entities and business associates, nonprofits, higher education institutions and public utilities (Sec. 10)
- Attorney General has exclusive enforcement after 30 days' written notice and opportunity to cure; damages of up to $7,500 per continued violation; no private right of action; penalties go to the Consumer Privacy Fund (Secs. 45, 50)
- Amends the Freedom of Information Act to exempt data protection impact assessments from disclosure
Latest legislative action
May 22, 2026. Rule 3-9(a) / Re-referred to Assignments
Sponsors
| Name | Role |
|---|---|
| Sue Rezin | Primary |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error