Bill > SB3180

This bill, the Artificial Intelligence Data Privacy Act, aims to protect user data when interacting with artificial intelligence (AI) systems. Starting January 1, 2027, companies that "deploy" AI, meaning they make it accessible to users through websites or apps, will be prohibited from indefinitely keeping a user's "covered information" – data created by or gathered from the user during AI use – for training purposes unless they get the user's explicit written consent after informing them about the indefinite retention. Alternatively, AI systems can have a default setting that prevents training on user data, requiring users to actively opt-in and consent to indefinite retention after being notified. The bill also prevents companies from sharing user data with third parties without express written consent. Individuals harmed by violations can sue, potentially recovering damages, attorney fees, and other relief. Furthermore, violations of this Act will be considered unlawful practices under the existing Consumer Fraud and Deceptive Business Practices Act, allowing the Attorney General to enforce these new AI data privacy rules with the same powers they have for consumer fraud cases.

Government Affairs

https://www.ilga.gov/Legislation/BillStatus?DocNum=3180&GAID=18&DocTypeID=SB&SessionID=114&GA=104