Illinois Children’s Privacy Laws (2026)

HB 5511 (Public Act 104-0664)

Enacted, not yet effective · Social media · effective 2028-01-01 · binds operators, platforms

Ages: under 13; 13-15; 16-17; 18+

Requires: Device makers, operating system providers and app stores that offer account setup must, by 2028-01-01, ask the account holder for the primary user's birth date or age at setup and, once the user separately consents to sharing with a specific operator, let that operator call an encrypted age-bracket signal (under 13, 13-15, 16-17, 18+). By 2028-07-01, operators of services used by Illinois minors that let users socially interact (profiles, connection lists or posts) must request the signal when a user downloads or launches the service and treat an under-18 signal as actual knowledge for that device; they 'shall not be required to independently verify the age of the user' and are not liable for an inaccurate age determination caused by an erroneous signal they reasonably relied on. For users determined to be minors under 18, defaults must hide the minor's account and media from known adults, block adult likes, comments and direct messages, share no precise geolocation, allow gifted currency only with existing connections and disable search-engine indexing; parents get a monthly gifted-currency limit and history, and notifications are barred from 10 p.m. to 7 a.m. without verifiable parental consent, except direct-message alerts. On addictive social media platforms it is unlawful to give a minor an addictive feed without verifiable parental consent or to autoplay media by default. Only the Attorney General may request the Act's civil penalty of $50,000 per violation; the Act creates no private right of action but leaves remedies under other laws, such as the Consumer Fraud Act, intact.

Timing: Takes effect 2028-01-01 (Sec. 99). Device makers, operating system providers and app stores must offer the account-setup age interface and signal by 2028-01-01, and, for devices set up before that date, an age interface by 2028-07-01 (Sec. 10(a)); operators must begin requesting age-bracket signals by 2028-07-01 (Sec. 10(b)).

Litigation: None found. NetChoice, which asked the Governor to veto HB 5511, lists no suit against Public Act 104-0664 on its Litigation Center; its Illinois cases, NetChoice v. Illinois (complaints filed 2026-09-11 in the Circuit Court of Cook County) and NetChoice v. Chicago, challenge Illinois' Social Media User Tax and Digital Ad Tax and Chicago's Social Media Amusement Tax, not this Act. A RECAP search of the Illinois federal district courts and the Seventh Circuit found no challenge either. Duties begin 2028-01-01.

Entry last reviewed 2026-10-01

SB 316 (104th GA), Senate engrossed with Floor Amendments 2 and 3

Pending · AI companion · binds operators

Ages: All users for the crisis protocol and AI disclosure; an added duty for users the operator knows are under 18 and for companions directed to minors

AI chatbot access for minors: Safeguards only (proposed in a pending bill, not law).

Requires: Would bar operators from making an AI companion (a product designed to simulate a sustained human-like relationship by remembering prior sessions, asking unprompted emotion-based questions and sustaining personal dialogue) available in Illinois unless it runs a protocol to detect suicidal ideation and self-harm, refer users to crisis services such as 988 and curb self-harm content, with the protocol and the prior year's count of crisis referrals published. Operators must tell users at the start and at least every 3 hours that they are talking to an automated system, not a human, and take reasonable measures to stop the companion claiming to be human. For a user the operator knows is a minor, or a companion directed to minors, they must take reasonable measures against generating material harmful to minors or directly telling the minor to engage in harmful conduct. Business and customer-service bots, game and entertainment bots limited to their content, stand-alone smart speakers, narrow classroom tools and vehicle bots are excluded, as are app stores, operating systems and search engines that only provide access. Enforced by the Attorney General or a State's Attorney as a Consumer Fraud Act violation, with a private action for actual damages; a compliant chatbot that does not provide therapy would also be exempt from Illinois' AI-therapy law (225 ILCS 155).

Timing: Would take effect 2027-01-01 if enacted (Sec. 99).

Litigation: None; not enacted. Passed the Senate 57-0-0 on 2026-05-21 and was re-referred to the House Rules Committee under Rule 19(a) on 2026-05-31; the only later action is a House co-sponsor added 2026-06-15.

Entry last reviewed 2026-10-01

SB 340 (104th GA), Senate engrossed with Floor Amendments 1-4

Pending · Privacy law (minors) · binds operators

Ages: Known children under 13 (sensitive data, parental consent per COPPA); consumers the controller knows are between the ages of 13 and 16 must opt in to targeted advertising or sale

Requires: Would make the personal data of a known child (a consumer the controller actually knows, or willfully disregards, is under 13) sensitive data that may be processed only with a parent's or guardian's consent under COPPA; COPPA-compliant controllers are deemed to meet that consent duty, and a parent may exercise the child's data rights and withdraw consent. A controller that knows a consumer is between the ages of 13 and 16 may not use the consumer's data for targeted advertising, or sell it, without the consumer's consent. Applies to entities that process the data of 100,000 or more Illinois consumers a year, or 25,000 or more while deriving over 25% of revenue from data sales; SBA-defined small businesses may not sell sensitive data. Enforced by the Attorney General and State's Attorneys as a Consumer Fraud Act violation, with a 30-day warning letter before suit until 2029-01-01; no private right of action.

Timing: Would take effect 2027-01-01 if enacted (Sec. 999).

Litigation: None; not enacted. Passed the Senate 54-3-0 on 2026-05-21 and was re-referred to the House Rules Committee under Rule 19(a) on 2026-05-31, with no later action.

Entry last reviewed 2026-10-01