Technology

Creates the Illinois Consumer Data Privacy Act. Applies to legal entities that conduct business in Illinois or produce products or services that are targeted to Illinois residents and that satisfy one or more of the following thresholds: during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or derives over 25% of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more. "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person but does not include deidentified data or publicly available information. Requires a controller who, alone or jointly with others, to consider the purposes and means of the processing of personal data in protecting the security of consumers while processing personal data and in notifying consumers of a breach of the security of the system. Authorizes rights to consumers under the Act to include, but not be limited to, the right to access their personal data, obtain a list of third parties to whom their data has been disclosed, request corrections to inaccurate data, and question the profiling of their information. Creates an appeal process for a consumer to gather more information on the actions of a covered entity. Exempts the State, a political subdivision of the State, and units of local government, a federally recognized Indian tribe, nonprofits established to prevent insurance fraud, and data already covered by federal law. Authorizes the Attorney General to enforce the Act. Makes definitions. Makes other changes. Limits the concurrent exercise of home rule powers. Contains a severability provision.

Appropriates the amount of $250,000 from the General Revenue Fund to the Department of Central Management Services for the purpose of making a grant to Amp AI, doing business as Nozma, to conduct a procurement modernization and artificial intelligence pilot program. Effective July 1, 2026.

Creates the Identity Verification for Consumer Services Act. Requires an entity that provides specified services to use identity verification to verify a person's identity before initiating or modifying an agreement to provide the service. Provides that an entity that provides a specified service that becomes aware of an attempted or confirmed identity theft through its compliance with the Act shall report the attempted or confirmed identity theft to the Attorney General. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Limits home rule. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that it is an unlawful practice for a seller of a digital good to offer for sale or advertise a digital good to a consumer using the terms "buy" or "purchase" or any other term that a reasonable person would understand to confer an unrestricted ownership interest in that digital good unless specified disclosures are made by the seller. Sets forth exemptions to the provision.

Amends the Medical Practice Act of 1987. Provides that "artificial intelligence" has the meaning given to that term in the Illinois Human Rights Act. Prohibits a person licensed under the Act from allowing artificial intelligence to prescribe medication if the person licensed under the Act does not maintain full control and responsibility for the prescription. Establishes penalty provisions for violations of provisions concerning the use of artificial intelligence to prescribe medication. Grants the Department of Financial and Professional Regulation investigatory authority for those violations and rulemaking authority regarding the authorized use of artificial intelligence to prescribe medication. Effective immediately.

Amends the Genetic Information Privacy Act. Adds legislative findings. Defines "neurotechnology" and "neurotechnology data". Prohibits insurers from using genetic testing or neurotechnology data (rather than only genetic testing) for nontherapeutic purposes or underwriting, with limited exceptions. Prohibits employers, employment agencies, labor organizations, and licensing agencies from requesting, requiring, or using neurotechnology data in employment decisions, subject to specified exceptions. Adds new provisions governing confidentiality, consent, privacy policies, and security requirements for entities collecting neurotechnology data. Regulates disclosure to government agencies and sets conditions for clinical research. Makes conforming changes. Effective January 1, 2027.

Amends the Election Code. Provides that the State Board of Elections shall adopt rules setting forth standardized reporting protocols for election data. Provides that, no later than July 1, 2027, the State Board of Elections shall publish guidelines for compliance with standardization conventions for data fields related to election districts, precincts, polling places, and other election data. Provides for periodic audits of the election data subject to the standardized reporting protocols. Provides that, beginning with the 2028 general primary election, no less than 75 days before each election, every election authority shall ensure that all data reported by the election authority conforms to the data standardization requirements adopted by the Board.

Amends the Genetic Information Privacy Act. Provides that the use of genetic testing, biomarker testing, or both (rather than only genetic testing), and the information derived from testing is confidential and privileged and may be released only to the individual tested and persons specifically authorized in writing by the individual tested to receive the information. Provides that an insurer may not seek information derived from genetic or biomarker testing (rather than only genetic testing) for use in connection with a policy of accident or health insurance (unless the individual voluntarily submits the results and the results are favorable to the individual), for nontherapeutic purposes, or for underwriting purposes. In provisions concerning the use of testing information by employers, provides that an employer may release genetic testing or biomarker testing information (rather than only genetic testing information) under specified circumstances. Limits an employer's use of genetic information, genetic testing, biomarkers, and biomarker testing (rather than only genetic information and genetic testing). In provisions concerning testing, provides that no person may disclose or be compelled to disclose the identity of any person upon whom a genetic test or biomarker test (rather than only genetic test) is performed or the results of a genetic test or biomarker test (rather than only genetic test) in a manner that permits identification of the subject of the test, except to the persons specified in the Act. Limits the concurrent exercise of home rule powers. Defines "biomarker" and "biomarker testing". Makes other and conforming changes.

Creates the Illinois Low Income Broadband Assistance Program Act. Requires the Department of Commerce and Economic Opportunity to establish an Illinois Low Income Broadband Assistance Program (Program) to ensure the availability and affordability of broadband service to low income families in order to access remote learning and work platforms. Provides that the Department shall coordinate with local administrative agencies to determine eligibility for the Program, provided that eligible income shall be no more than 150% of the federal poverty level. Provides that families whose annual household income is at or below 135% of the federal poverty level shall be eligible for free broadband service. Provides that a credit of at least $9.95 a month for broadband services shall be payable monthly to: (i) families whose annual household income is above 135% of the federal poverty level but no greater than 150% of the federal poverty level; and (ii) families that include at least one adult person or dependent child who qualifies for or participates in the Supplemental Nutrition Assistance Program, the Supplemental Security Income program, Veterans Pension and Survivors Benefits Programs, and other specified assistance programs. Provides that the $9.95 broadband service credit may be adjusted according to family size. Provides that families who participate in the federal Lifeline program or any other State Internet service subsidy program shall not be eligible to participate in the Illinois Low Income Broadband Assistance Program. Provides bill payment requirements. Provides for the adoption of rules.

Creates the Higher Education Enrollment Fraud Act. Requires the Board of Higher Education to convene a working group to develop policies and procedures for institutions of higher education to prevent fraudulent enrollment in online courses for the purpose of gaining access to financial aid, campus information technology systems, and student support services. Requires each institution of higher education to complete an annual cybersecurity self-assessment of its information technology infrastructure to determine its Information Technology Laboratory score and annually report local and systemwide technology and data security measures that support improved oversight of fraud mitigation, online learning quality, and cybersecurity efforts to the Board. Requires the self-assessment and report to be submitted to the Board by December 15, 2026 and each December 15 thereafter and the Board to compile a report of these submissions and submit that report to the General Assembly by January 15, 2027 and each January 15 thereafter. Includes other information an institution of higher education must submit related to enrollment fraud. Effective immediately.