Disclaimer: This page provides general informational summaries only and does not constitute legal advice. AI-generated content may contain errors. Always consult a qualified attorney for guidance specific to your situation.
Read full disclaimer →
AI Summary
The Illinois Age-Appropriate Design Code Act mandates businesses to assess data protection for online services likely accessed by children by July 1, 2026, and biennially review assessments.
Business Impact
If you provide online services for children in Illinois, you must complete a data protection impact assessment by July 1, 2026, or face penalties.
What do these statuses mean? ▼
Introduced
— Filed in the legislature; not yet heard in committee
In Committee
— Assigned to and being reviewed by a legislative committee
Passed
— Approved by one or both chambers; awaiting further action
Signed / Enacted
— Signed into law by the governor; may or may not be in effect yet
Dead / Vetoed
— Vetoed, failed to pass, or session expired without action
Unknown
— Status data not yet available or awaiting classification
Affected Industries
What This Means
The Illinois Age-Appropriate Design Code Act aims to enhance data protection for children using online services. It requires businesses to conduct and review data protection impact assessments, estimate the age of child users, and implement specific privacy measures. This legislation will affect any business offering online products or services likely accessed by children, emphasizing the importance of safeguarding children's data.
Key Provisions
- Businesses must complete a data protection impact assessment for online services accessed by children by July 1, 2026.
- Businesses are required to biennially review all data protection impact assessments.
- Businesses must provide a list of all completed data protection impact assessments to the Attorney General within 3 business days upon request.
- Businesses must make data protection impact assessments available to the Attorney General within 5 business days upon request.
- Businesses must estimate the age of child users or apply privacy protections to all consumers.
- The Act prohibits using children's personal information in a way that is materially detrimental to their health or well-being.
- Civil penalties for violations can reach $7,500 per affected child for intentional breaches.
- The Children's Data Protection Working Group will recommend best practices for the Act's implementation.
Latest Legislative Action
Senate Committee Amendment No. 2 Rule 3-9(a) / Re-referred to Assignments
Bill Sponsors
| Name | Role | District |
|---|---|---|
| Mary Edly-Allen D | Sponsor | SD-031 |
| Susan Rezin R | Sponsor | SD-038 |
Amendments (2)
Senate Amendment 001
Pending
2025-03-13
Senate Amendment 002
Pending
2025-03-19
Compliance Checklist
Complete a data protection impact assessment for online services likely accessed by children.
Who: Businesses providing online services to children.
Deadline: July 1, 2026
Penalty: Up to $7,500 per affected child for intentional violations.
Who: Businesses providing online services to children.
Deadline: July 1, 2026
Penalty: Up to $7,500 per affected child for intentional violations.
Document risks and create a mitigation plan based on the assessment.
Who: Businesses providing online services to children.
Deadline: Before the online service is accessed by children.
Penalty: Injunction and civil penalties for non-compliance.
Who: Businesses providing online services to children.
Deadline: Before the online service is accessed by children.
Penalty: Injunction and civil penalties for non-compliance.
Related & Companion Bills
Full Legal Analysis
The Illinois Age-Appropriate Design Code Act requires businesses that provide online services, products, or features likely accessed by children to complete a data protection impact assessment by July 1, 2026. This assessment must evaluate risks associated with data management practices and document any potential harm to children. Businesses are required to biennially review all data protection impact assessments. Additionally, businesses must estimate the age of child users or apply privacy protections to all consumers. They must provide a list of all completed data protection impact assessments to the Attorney General within 3 business days upon request and make the assessments available within 5 business days upon request. The Act prohibits using children's personal information in ways materially detrimental to their health or well-being. Non-compliance can result in civil penalties of up to $7,500 per affected child for intentional violations. The bill establishes a Children's Data Protection Working Group to recommend best practices for implementation, reflecting a growing trend in state-level data privacy legislation focused on protecting minors.
Official Source
Official Bill Text
View SB51 on official legislature website →
Affected Industries
More Illinois AI Legislation
View All IL Laws →More Illinois AI Laws
Browse all published AI bills and regulations for Illinois.