Illinois Children's Privacy Laws (2026)

Children's Online Social Media Safety Act (HB 5511) · HB 5511

Pending — A bill was introduced this cycle but is not yet law. · Social media · effective 2028-01-01 · binds operators, platforms

Ages: under 13; 13-15; 16-17; 18+

Requires: OS providers (Apple/Google) must offer an age-indication interface at device/account setup and supply age-category signals (under 13, 13-15, 16-17, 18+) to apps that request them by no later than 1/1/2028; social-media platform operators must conduct age verification and apply default minor protections (limit algorithmic feeds, restrict profile visibility, location sharing, nighttime notifications). Enforced by the Illinois Attorney General; civil penalties up to $2,500/child (negligent) and $7,500/child (intentional).

Litigation: No injunction (bill unsigned, cannot be enjoined). NetChoice submitted a veto-request letter to Gov. Pritzker and signaled likely First Amendment litigation if the bill becomes law.

Parental Consent for Social Media Act (SB 2316) · SB 2316

Pending — A bill was introduced this cycle but is not yet law. · Social media · binds operators, platforms

Ages: under 18

Requires: Would bar social-media platforms from allowing Illinois minors (<18) to hold accounts without express parental/guardian consent; require third-party 'reasonable age verification' before access; prohibit minor access 10pm-6am; bar retention of identifying info after access is granted. Civil penalties up to $2,500/violation.

Litigation: None — not enacted.

Illinois Age-Appropriate Design Code Act · SB51

Pending — A bill was introduced this cycle but is not yet law. · Design code · binds operators

Ages: Children under 18

Requires: Businesses offering an online service, product, or feature likely to be accessed by children would have to complete and maintain a data protection impact assessment, configure default privacy settings to a high level of privacy for children, and turn off precise geolocation collection by default. It bans profiling children by default and using dark patterns to lead children to provide unnecessary personal data, unless a compelling, child-best-interest justification exists.