Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

IL SB0052: PRIVACY RIGHTS ACT

In Committee Illinois

Last verified Oct 17, 2026 · official bill text

SB0052 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Illinois' SB 52 is a general consumer privacy bill. As introduced, the Privacy Rights Act would give consumers rights over their personal information and create a Privacy Protection Agency. Its AI-related parts are narrow: it defines profiling as automated processing of personal information, and directs the Attorney General to adopt rules on access and opt-out rights for automated decision-making technology and on risk assessments. Introduced January 13, 2025; re-referred to Assignments April 11, 2025 and still pending.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None unless enacted: the bill is pending. If enacted, covered businesses would owe consumers privacy rights, and any automated decision-making rules would come later from the Attorney General.

Key provisions

  1. Would apply to businesses with over $25,000,000 in annual gross revenue, or that buy, sell, or share the personal information of 100,000 or more consumers or households, or that derive 50% or more of revenue from selling or sharing it
  2. Would give consumers rights to delete and correct personal information, to know what is sold or shared and to whom, to opt out of sale or sharing, and to limit use of sensitive personal information
  3. Sec. 10-75: Attorney General to adopt rules by July 1, 2026, including rules on access and opt-out rights for automated decision-making technology and profiling, with meaningful information on the logic involved and the likely outcome
  4. Sec. 10-75: the required rules also include rules requiring businesses whose processing presents significant risk to consumers' privacy or security to do annual cybersecurity audits and regularly submit risk assessments
  5. Art. 15 would create a Privacy Protection Agency with a 5-member board; Agency administrative fines (Sec. 10-65) or Attorney General civil penalties (Sec. 10-95) up to $2,500 per violation, or $7,500 per intentional violation or violation involving minors' data
  6. Status: introduced January 13, 2025; Senate Committee Amendment 1 was filed but not adopted; re-referred to Assignments April 11, 2025

Latest legislative action

Apr 11, 2025. Rule 3-9(a) / Re-referred to Assignments

Sponsors (showing 5 of 31)

NameRole
Primary
D Primary
Primary
Primary
Primary

Topics and industries

Affected industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error