In one paragraph
Illinois's SB 3890 would create the Illinois Data Privacy Protection Act, giving consumers rights to access, correct, delete and port their data, to opt out of targeted advertising, sales and profiling used for decisions with legal or similarly significant effects, and to question the result of such profiling. It would also create a data broker registry and deletion mechanism. Filed February 6, 2026; re-referred to Assignments May 22, 2026; it has not passed either house.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
If enacted, businesses meeting the consumer-count thresholds would have to honor consumer data and profiling rights and run privacy assessments; data brokers would have to register with the Attorney General.
Key provisions
- Applies to entities doing business in Illinois or targeting Illinois residents that control or process data of 100,000 or more consumers (excluding data processed solely to complete a payment transaction), or derive over 25% of gross revenue from selling personal data and process data of 25,000 or more consumers (Sec. 12)
- Consumers could opt out of profiling in furtherance of decisions with legal or similarly significant effects, and could question the result, be told the reason, review the data used and have inaccurate data corrected and the decision reevaluated (Sec. 14)
- Controllers would have to respond within 45 days, offer an appeal, honor opt-out preference signals for targeted advertising and sales, and give a privacy notice that discloses profiling (Secs. 14, 16)
- Controllers would have to document and conduct data privacy and protection assessments for targeted advertising, sales, sensitive data, heightened-risk processing and profiling with a reasonably foreseeable risk of unfair treatment, disparate impact or other injury (Sec. 18)
- Data brokers would have to register annually with the Attorney General by January 31 (civil penalty of $200 per day for failing to register), and the Attorney General must establish a consumer deletion mechanism by January 1, 2027 (815 ILCS 530/55, 65)
- Attorney General enforcement with injunctions and civil penalties of up to $7,500 per violation; a 30-day warning-letter cure period applies until January 1, 2028; no private right of action (Sec. 20)
- Local governments, including home rule units, could not regulate consumer data privacy (Sec. 95)
Latest legislative action
May 22, 2026. Rule 3-9(a) / Re-referred to Assignments
Sponsors
| Name | Role | District |
|---|---|---|
| Rachel Ventura D | Sponsor | SD-043 |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error