Bill > SB3241

This bill, titled the Illinois Age-Appropriate Design Code Act, requires companies that operate in Illinois and handle data from children (defined as individuals under 18) to do so in a manner that is in the "best interests of children," meaning their data use and online service design should not harm children physically, financially, or psychologically, nor intrude on their privacy or lead to discrimination. Companies, referred to as "covered entities," must conduct a "data protection impact assessment" for any online service, product, or feature that children are "reasonably likely to access," which means services directed at children, those with a significant child audience, or those that advertise to children. These assessments must evaluate potential harms to children, and companies must configure default privacy settings for children to be highly protective, provide clear privacy information, and offer tools for children or their parents to manage privacy. The bill prohibits certain practices, such as profiling children by default, collecting unnecessary data, using "dark patterns" (interfaces designed to trick users) to obtain more data or compromise privacy, and allowing parents to monitor children's online activity without the child being aware. The Attorney General is empowered to enforce these provisions with civil penalties for violations, and a new "Age-Appropriate Design Code Enforcement Fund" will be created in the State Treasury to support these enforcement efforts. The Act also includes specific deadlines for completing these assessments, with a general requirement for existing services to be assessed by January 1, 2027.

https://www.ilga.gov/Legislation/BillStatus?DocNum=3241&GAID=18&DocTypeID=SB&SessionID=114&GA=104