Illinois Privacy Law

Current Status

Illinois occupies a unique position in the U.S. privacy landscape. It already has one of the most powerful and actively enforced privacy laws in the country — the Biometric Information Privacy Act (BIPA) — which has been in force since 2008 and has generated billions of dollars in class action settlements against Facebook, Google, TikTok, Amazon, and hundreds of other companies. BIPA requires explicit written consent before collecting fingerprints, face scans, retina scans, or voice prints, and crucially provides a private right of action. However, BIPA only covers biometric data. For all other personal data — browsing history, purchase records, location data, health information outside of biometrics — Illinois residents have no comprehensive state privacy protections beyond what federal law provides. A proposed comprehensive Illinois privacy bill (HB 3648 / SB 2239) has been introduced to extend protections to all personal data. The bill has received committee hearings but has not advanced to a floor vote. Unlike many other states, Illinois faces the challenge of designing a comprehensive law that complements (rather than contradicts) BIPA's existing provisions and its established litigation framework.

Legislative Timeline

What the Bill Proposes

Illinois' proposed comprehensive privacy bill would extend data privacy protections to all categories of personal data — not just biometrics. It would provide standard consumer rights (access, correction, deletion, portability, opt-out of sale and targeted advertising) and require opt-in consent for sensitive data. The bill is intended to work alongside BIPA rather than replace it — BIPA's biometric-specific protections and private right of action would remain intact, while the new law would fill the gaps for all other personal data. One of the key debates is whether the comprehensive law should also include a private right of action (as BIPA does) or rely solely on AG enforcement (as most other state privacy laws do).

Proposed Consumer Rights

If enacted as currently drafted, Illinois residents would receive the following privacy rights:

Key Provisions of the Proposed Bill

• BIPA Remains Intact: The comprehensive bill is designed to supplement, not replace, BIPA. Illinois would have both a biometric-specific law (BIPA) and a general personal data law — the most comprehensive dual-framework of any state.
• Private Right of Action Debate: Whether to include BIPA-style private lawsuit rights in the comprehensive law is the central legislative dispute. Inclusion would make Illinois' framework the strongest in the country; exclusion would make it more consistent with other state laws.
• All Sensitive Data Categories: Racial origin, health, sexual orientation, religion, geolocation, immigration status, and financial data would require opt-in consent — broader than most state definitions.
• Data Minimization: Some versions of the bill include data minimization requirements limiting collection to what is reasonably necessary — going beyond the opt-out model used in most states.
• Coverage Threshold: 100,000 Illinois consumers or 25,000 consumers where data sales exceed 25% of gross revenue — standard threshold aligned with Virginia and Colorado.

Why It Hasn't Passed Yet

Illinois faces a distinctive challenge: the BIPA precedent cuts both ways. Privacy advocates point to BIPA as proof that strong laws with private rights of action work — it has generated enormous enforcement through litigation without costing taxpayers anything for government enforcement. Business groups point to BIPA as proof of why private rights of action are dangerous — the scale of litigation has been enormous, and they argue extending the model to all personal data would expose virtually every business in Illinois to ruinous class action exposure. This debate is more heated in Illinois than anywhere else precisely because Illinois has lived it. Finding compromise language that builds on BIPA's success without repeating what businesses view as its excesses is genuinely difficult, and no legislative session has yet produced a bill that satisfies both camps.

How Illinois Compares to States With Laws

Feature	Illinois (Proposed)	Virginia (Active)	California (Active)
Comprehensive privacy rights	Proposed	✅ Yes	✅ Yes
Right to delete	Proposed	✅ Yes	✅ Yes
Opt out of sale of data	Proposed	✅ Yes	✅ Yes
Sensitive data protections	Proposed	✅ Yes	✅ Yes
Enforcement agency	TBD	VA Attorney General	CA Privacy Protection Agency
Private right of action	TBD	No	Yes (breach only)
Currently enforceable	❌ No	✅ Yes	✅ Yes

What You Can Do Right Now

Even though Illinois does not yet have a comprehensive privacy law, you are not without options:

• Contact your state legislators — Tell your state senator and representative you support strong data privacy legislation. Personal constituent messages are more impactful than form letters.
• Use your federal rights — HIPAA protects your medical data, COPPA protects children's data under 13, and FCRA gives you rights over your credit data nationwide.
• Exercise California rights if you travel or have accounts there — Some companies apply CCPA rights to all users regardless of state.
• Opt out of data brokers directly — Even without a state law, you can submit opt-out requests to major data brokers. Many comply voluntarily.
• Enable the Global Privacy Control — States like California and Colorado legally require websites to honor this browser signal, which still protects your data on those sites.

Stay Updated on Illinois's Privacy Law Progress

Privacy legislation moves quickly. Subscribe to our newsletter and we'll alert you the moment Illinois passes a new privacy bill, a vote is scheduled, or a major amendment changes the bill's scope. You'll also receive our monthly digest of all U.S. privacy law changes — free, always.