Technology

Creates the Children's Social Media Safety Act. Provides that, no later than January 1, 2028, an operating system provider shall: (1) provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both; (2) provide an operator who has requested a signal with respect to a particular user a signal that identifies the user's age by category; and (3) send only the minimum amount of information necessary to comply with the provision. Provides that an operator shall not offer a platform in the State without conducting age verification as required under the Act to determine whether a user is a minor. Provides that, for all users that the operator has actual knowledge to be a minor, the operator shall use specified default settings for the minor. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

Amends the Genetic Information Privacy Act. Provides that the use of genetic testing, biomarker testing, or both (rather than only genetic testing), and the information derived from testing is confidential and privileged and may be released only to the individual tested and persons specifically authorized in writing by the individual tested to receive the information. Provides that an insurer may not seek information derived from genetic or biomarker testing (rather than only genetic testing) for use in connection with a policy of accident or health insurance (unless the individual voluntarily submits the results and the results are favorable to the individual), for nontherapeutic purposes, or for underwriting purposes. In provisions concerning the use of testing information by employers, provides that an employer may release genetic testing or biomarker testing information (rather than only genetic testing information) under specified circumstances. Limits an employer's use of genetic information, genetic testing, biomarkers, and biomarker testing (rather than only genetic information and genetic testing). In provisions concerning testing, provides that no person may disclose or be compelled to disclose the identity of any person upon whom a genetic test or biomarker test (rather than only genetic test) is performed or the results of a genetic test or biomarker test (rather than only genetic test) in a manner that permits identification of the subject of the test, except to the persons specified in the Act. Limits the concurrent exercise of home rule powers. Defines "biomarker" and "biomarker testing". Makes other and conforming changes.

Amends the Illinois Credit Union Act. Provides that the business office for a credit union's registered agent may, but is not required to, be (instead of shall be) the same as the principal place of business of the credit union. In provisions concerning meetings of directors, sets forth provisions concerning the preparation and approval of meeting minutes. Adds provisions concerning disclosure and due diligence requirements for credit unions when providing digital asset services or contracting with a covered person or digital asset service provider and provisions concerning sales of debt cancellation services and products by a credit union to its members. In provisions concerning the investment of funds not used in loans, provides that the funds may be invested in commercial mortgage related securities and collateralized mortgage obligations to aid in the credit union's management of its assets, liabilities, and liquidity. Effective immediately.

Amends the Public Utilities Act. Defines "video programming" and "video streaming service". Provides that, on and after July 1, 2027, a video streaming service that serves consumers residing in the State shall not transmit the audio of commercial advertisements louder than the video content the advertisements accompany, consistent with the regulations adopted by the Federal Communications Commission pursuant to the Commercial Advertisement Loudness Mitigation (CALM) Act (Public Law 111-311) for television broadcast stations, cable operators, and other video programming distributors. Provides that the amendatory provisions do not create a private right of action.

Creates the Algorithmic Pricing Transparency Act. Provides that any person or entity that sells or offers to sell goods or services through an online platform to consumers in this State shall provide a clear and conspicuous disclosure if the price displayed to a consumer is generated using surveillance pricing. Provides that a consumer may opt out of surveillance pricing and a covered entity shall provide the consumer with a non-personalized baseline price for the goods or services. Prohibits a covered entity from using specified personal information to generate algorithmic pricing. Provides that a violation of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective one year after becoming law.

Amends the Illinois Credit Union Act. Provides that the business office for a credit union's registered agent may, but is not required to, be (instead of shall be) the same as the principal place of business of the credit union. In provisions concerning meetings of directors, sets forth provisions concerning the preparation and approval of meeting minutes. Adds provisions concerning disclosure and due diligence requirements for credit unions when providing digital asset services or contracting with a covered person or digital asset service provider and provisions concerning sales of debt cancellation services and products by a credit union to its members. In provisions concerning the investment of funds not used in loans, provides that the funds may be invested in commercial mortgage related securities and collateralized mortgage obligations to aid in the credit union's management of its assets, liabilities, and liquidity. Effective immediately.

Creates the Civil Liability for Unsolicited Intimate Images Act. Provides that any person 18 years of age or older who knowingly and intentionally transmits obscene material by computer or other electronic means to the computer or electronic communication device of another person 18 years of age or older commits a trespass and is liable to the recipient of the obscene material for actual damages or $500, whichever is greater, in addition to reasonable attorney's fees and costs, if the person who receives the obscene material has not consented to the receipt of the obscene material or has expressly forbidden the receipt of the obscene material and if a reasonable person who receives the obscene material would suffer emotional distress as a result of the receipt of the obscene material. Authorizes the court to enjoin and restrain the defendant from committing such further acts. Provides that "obscene material" means material, including, but not limited to, images depicting a person engaging in an act of sexual intercourse, sodomy, oral copulation, sexual penetration, or masturbation, or depicting the exposed genitals or anus of any person, taken as a whole, that to the average person, applying contemporary statewide standards, appeals to the prurient interest, that, taken as a whole, depicts or describes sexual conduct in a patently offensive way, and that, taken as a whole, lacks serious literary, artistic, political, or scientific value. Provides that the Act does not apply to (i) any Internet service provider, mobile data provider, or operator of an online or mobile application, to the extent that such entity is transmitting, routing, or providing connections for electronic communications initiated by or at the direction of another, (ii) any service that transmits material, including an on-demand, subscription, or advertising-supported service, (iii) a health care provider that transmits material for a legitimate medical purpose, or (iv) any transmission of commercial email. Provides that venue for an action under the Act may lie in the jurisdiction where the obscene material is transmitted from or where the obscene material is received or possessed by the plaintiff.

Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.

Creates the Identity Verification for Consumer Services Act. Requires an entity that provides specified services to use identity verification to verify a person's identity before initiating or modifying an agreement to provide the service. Provides that an entity that provides a specified service that becomes aware of an attempted or confirmed identity theft through its compliance with the Act shall report the attempted or confirmed identity theft to the Attorney General. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Limits home rule. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

Creates the Automated License Plate Recognition System Act. Sets forth provisions regarding authorized uses of an automated license plate recognition system, data retention, prohibited uses of an automated license plate recognition system, restrictions, requirements for use, preservation and disclosure, required data collection, reporting requirements, admissibility, privacy, penalties, and a private right of action. Makes a conforming change in the Freedom of Information Act. Effective immediately.