Technology

Amends the Genetic Information Privacy Act. Removes language exempting insurers that are issuing a long-term care policy from specified provisions. Provides that, with regard to any policy, contract, or plan offered, entered into, issued, amended, or renewed on or after January 1, 2027 by a health insurer, life insurer, disability insurer, or long-term care insurer authorized to transact insurance in this State, a health insurer, life insurer, disability insurer, or long-term care insurer may not: (1) cancel, limit, or deny coverage or establish differentials in premium rates based on a person's genetic information; or (2) require or solicit an individual's genetic information, use an individual's genetic test results, or consider an individual's decisions or actions relating to genetic information or a genetic test in any manner for any insurance purpose. Provides that the provisions may not be construed as: (1) preventing a life insurer, disability insurer, or long-term care insurer from accessing an individual's medical record as part of an application; or (2) prohibiting a life insurer, disability insurer, or long-term care insurer from considering a clinical diagnosis, such as a manifest disease or disorder, included in an individual's medical record for insurance purposes to the extent otherwise allowable by law. Effective July 1, 2026.

Creates the Preventing Algorithmic Pricing Discrimination Act. Requires any person who knowingly advertises, promotes, labels, or publishes a statement, display, image, offer, or announcement of personalized algorithmic pricing using consumer data specific to a particular individual must disclose that this price was set by an algorithm using the individual's personal data. Prohibits the use of algorithmic pricing under certain conditions. Provides that if there is a violation of the Act, the Attorney General may file a civil action requesting that an injunction be issued against the defendant to enjoin and restrain the continuance of the violation. Provides that notice must be given to the defendant of not less than 5 days, and the court may issue an injunction enjoining and restraining any further violation without requiring proof that any person has, in fact, been injured or damaged. Authorizes the court to impose a civil penalty of not more than $1,000 for each violation. Exempts any insurer licensed, regulated, or otherwise authorized to do business in the State or any excess lines insurer, including any persons, agents, or affiliates acting on behalf of the insurer. Exempts financial services, including, but not limited to, financial institutions, financial institution affiliates, broker-dealers, registered investment advisors, and entities that provide consumer credit products such as credit cards, personal loans, and mortgages. Amends the Consumer Fraud and Deceptive Business Practices Act. Makes a violation of the Preventing Algorithmic Pricing Discrimination Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Limits home rule.

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that a person shall not use artificial intelligence while engaging in trade and commerce to communicate with a consumer in a manner that may mislead or deceive a reasonable consumer into believing that the consumer is engaging with a human, unless the consumer is notified in a clear and conspicuous manner that the consumer is not engaging with a human. Provides that a person shall not use artificial intelligence to sell or offer to sell goods or services unless the consumer is notified in a clear and conspicuous manner that artificial intelligence is being used to sell or offer to sell goods or services and the consumer is given an option to request more information regarding the specific use of the artificial intelligence. Provides that a business entity that uses artificial intelligence while engaging in trade and commerce to communicate with a consumer shall give the consumer the option to communicate with a human during the business entity's ordinary business hours. Provides that a violation of the provisions constitutes an unlawful practice within the meaning of the Act.

Amends the Genetic Information Privacy Act. Provides that the use of genetic testing, biomarker testing, or both (rather than only genetic testing), and the information derived from testing, is confidential and privileged and may be released only to the individual tested and persons specifically authorized in writing by the individual tested to receive the information. Provides that an insurer may not seek information derived from genetic or biomarker testing (rather than only genetic testing) for use in connection with a policy of accident or health insurance (unless the individual voluntarily submits the results and the results are favorable to the individual), for nontherapeutic purposes, or for underwriting purposes. In provisions concerning the use of testing information by employers, provides that an employer may release genetic testing or biomarker testing information (rather than only genetic testing information) under specified circumstances. Limits an employer's use of genetic information, genetic testing, biomarkers, and biomarker testing (rather than only genetic information and genetic testing). In provisions concerning testing, provides that no person may disclose or be compelled to disclose the identity of any person upon whom a genetic test or biomarker test (rather than only genetic test) is performed or the results of a genetic test or biomarker test (rather than only a genetic test) in a manner that permits identification of the subject of the test, except to the persons specified in the Act. Limits the concurrent exercise of home rule powers. Defines "biomarker" and "biomarker testing". Makes other and conforming changes.

Creates the Illinois Consumer Data Privacy Act. Applies to legal entities that conduct business in Illinois or produce products or services that are targeted to Illinois residents and that satisfy one or more of the following thresholds: during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or derives over 25% of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more. "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person but does not include deidentified data or publicly available information. Requires a controller who, alone or jointly with others, to consider the purposes and means of the processing of personal data in protecting the security of consumers while processing personal data and in notifying consumers of a breach of the security of the system. Authorizes rights to consumers under the Act to include, but not be limited to, the right to access their personal data, obtain a list of third parties to whom their data has been disclosed, request corrections to inaccurate data, and question the profiling of their information. Creates an appeal process for a consumer to gather more information on the actions of a covered entity. Exempts the State, a political subdivision of the State, and units of local government, a federally recognized Indian tribe, nonprofits established to prevent insurance fraud, and data already covered by federal law. Authorizes the Attorney General to enforce the Act. Makes definitions. Makes other changes. Limits the concurrent exercise of home rule powers. Contains a severability provision.

Appropriates the amount of $250,000 from the General Revenue Fund to the Department of Central Management Services for the purpose of making a grant to Amp AI, doing business as Nozma, to conduct a procurement modernization and artificial intelligence pilot program. Effective July 1, 2026.

Creates the Identity Verification for Consumer Services Act. Requires an entity that provides specified services to use identity verification to verify a person's identity before initiating or modifying an agreement to provide the service. Provides that an entity that provides a specified service that becomes aware of an attempted or confirmed identity theft through its compliance with the Act shall report the attempted or confirmed identity theft to the Attorney General. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Limits home rule. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that it is an unlawful practice for a seller of a digital good to offer for sale or advertise a digital good to a consumer using the terms "buy" or "purchase" or any other term that a reasonable person would understand to confer an unrestricted ownership interest in that digital good unless specified disclosures are made by the seller. Sets forth exemptions to the provision.

Amends the Genetic Information Privacy Act. Adds legislative findings. Defines "neurotechnology" and "neurotechnology data". Prohibits insurers from using genetic testing or neurotechnology data (rather than only genetic testing) for nontherapeutic purposes or underwriting, with limited exceptions. Prohibits employers, employment agencies, labor organizations, and licensing agencies from requesting, requiring, or using neurotechnology data in employment decisions, subject to specified exceptions. Adds new provisions governing confidentiality, consent, privacy policies, and security requirements for entities collecting neurotechnology data. Regulates disclosure to government agencies and sets conditions for clinical research. Makes conforming changes. Effective January 1, 2027.

Amends the Election Code. Provides that the State Board of Elections shall adopt rules setting forth standardized reporting protocols for election data. Provides that, no later than July 1, 2027, the State Board of Elections shall publish guidelines for compliance with standardization conventions for data fields related to election districts, precincts, polling places, and other election data. Provides for periodic audits of the election data subject to the standardized reporting protocols. Provides that, beginning with the 2028 general primary election, no less than 75 days before each election, every election authority shall ensure that all data reported by the election authority conforms to the data standardization requirements adopted by the Board.