Technology

Creates the Data Broker Registration and Accessible Deletion Mechanism Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund. Provides that, no later than January 1, 2027, the Attorney General shall establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker. Amends the State Finance Act and the Consumer Fraud and Deceptive Business Practices Act to make conforming changes.

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that it is an unlawful practice for a high-impact social media company in the State to fail to make available to its customers, at no cost, a customer support service for customers to notify the company of any harmful content that the customer believes is illegal or violates the high-impact social media company's terms of service. Provides that the customer support service must timely respond to customers within one business day after a customer initially contacts the company. Provides that the customer support service must take active steps to resolve the customer's issue or complaint and communicate the steps taken to resolve the issue or complaint with the customer by mail, telephone, or email, as requested by the customer, within 3 business days after a customer initially contacts the company. Provides that the customer support service shall communicate with the customer at least once every 3 business days until the issue has been resolved or until the issue has been determined to be unsolvable. Provides that the Attorney General may bring an action against a high-impact social media company that does not comply with these provisions. Provides that any company that violates these provisions shall be fined $1,000 per day per violation. Provides that fines collected under these provisions shall be deposited into a fund to support mental health awareness in Illinois. Effective January 1, 2026.

Amends the Local Governmental and Governmental Employees Tort Immunity Act. Provides that a public entity or a public employee is not liable for injury caused by any unauthorized access to government records, data, or electronic information systems by any person or entity.

Creates the Anti-Click Gambling Data Analytics Collection Act. Provides that no entity that operates a remote gambling platform or a subsidiary of the entity shall collect data from a participant with the intent to predict how the participant will gamble in a particular gambling or betting scenario. Effective immediately.

Amends the Personal Information Protection Act. Provides that a data collector shall not own, maintain, license, store, or disclose records that contain immigration or citizenship status information concerning an Illinois resident. Provides that the provision shall not apply to government agencies, public and private universities, or financial institutions. Provides that the definition of "personal information" includes immigration or citizenship status information. Defines "immigration or citizenship status information".

Amends the Illinois Century Network Act. Provides that the connection of anchor institutions to the Illinois Century Network shall be prioritized according to the type of anchor institution, starting with schools and libraries.

Amends the Higher Education Student Assistance Act. Provides that an institution of higher learning that participates in the Monetary Award Program may not release the personally identifiable information of any of its students for voter registration activities unless the student gives consent in writing.

Amends the Department of Innovation and Technology Act. Provides that, on or before January 1, 2026, the Department of Innovation and Technology shall develop and implement a system that allows users accessing a website operated by the State to automatically translate the contents of that website into another language. Provides that the system shall provide automatic translation to at least the 100 most commonly spoken language in the State. Effective immediately.

Creates the Light Detection and Ranging Technology Security Act. Provides that all State infrastructure located within or serving Illinois shall be constructed so as not to include any light detection and ranging (LIDAR) equipment manufactured in or by, including any equipment whose critical or necessary components are manufactured in or by, a company domiciled within a country of concern, or a company owned by a company domiciled in a country of concern. Provides that all State infrastructure in operation within or serving Illinois, including any covered infrastructure that is not permanently disabled, that contains LIDAR equipment prohibited by the Act shall be removed and replaced with LIDAR equipment that is not prohibited by the Act within 90 days after the effective date of the Act. Provides that an agency, private entity, or political subdivision primarily responsible for any covered infrastructure that includes prohibited LIDAR equipment may request a reimbursement up to the cost of the original purchase price of such prohibited LIDAR equipment from the State Comptroller, provided the request includes purchase orders and is submitted within 90 days after the effective date of the Act. Provides that no procurement made by the State government or a political subdivision of the State government can include LIDAR equipment manufactured in or by, including any equipment whose critical or necessary components are manufactured in or by, a company domiciled within a country of concern, or a company owned by a company domiciled in a country of concern. Defines "country of concern" as the People's Republic of China, the Russian Federation, the Islamic Republic of Iran, the Democratic People's Republic of Korea, the Republic of Cuba, the Venezuelan regime of Nicolas Maduro, or the Syrian Arab Republic, or any other entity deemed by the Governor in consultation with the Director of the Illinois Emergency Management Agency and Office of Homeland Security (IEMA-OHS). Defines other terms. Provides that the Act is fully enforceable as of 90 days after the effective date of the Act. Contains a severability provision.

Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.