Bill > SB3603

This bill, effective January 1, 2028, amends the Consumer Fraud and Deceptive Business Practices Act to give consumers more control over their personal data, specifically regarding targeted advertising. A "controller" is defined as the entity that determines how personal data is processed, and "personal data" refers to any information linked to an identifiable individual, excluding deidentified or publicly available information. "Targeted advertising" is defined as ads selected based on a consumer's past online activities to predict their preferences, with certain exceptions like ads based on current searches or within the controller's own website. The bill mandates that consumers can opt out of targeted advertising by following instructions in a company's privacy notice, and companies must provide a clear and easily accessible method outside of the privacy notice for consumers to opt out of targeted advertising or the sale of their data for this purpose. This includes allowing authorized agents to act on a consumer's behalf and giving parents or guardians the ability to opt out children. Companies that process personal data of 100,000 or more consumers annually, or derive significant revenue from selling personal data and process data for 25,000 or more consumers, will be subject to these requirements. Violating these provisions will be considered an unlawful practice.

Government Affairs

https://www.ilga.gov/Legislation/BillStatus?DocNum=3603&GAID=18&DocTypeID=SB&SessionID=114&GA=104