Technology (Consumer Data Protection)

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that a social media company shall make available to account holders a 24-hour toll-free telephone number through which an account holder may contact a live customer service representative of the social media company to report fraudulent activity on an account holder's social media account, including, but not limited to, unauthorized access. Provides that a social media company shall include the telephone number and an explanation of the purpose of the telephone number in any email notification concerning account security sent to an account holder and post the telephone number and explanation in a prominent location on the homepage or help page of the social media platform. Provides that a violation of the provision constitutes an unlawful practice within the meaning of the Act.

Creates the Preventing Algorithmic Pricing Discrimination Act. Requires any person who knowingly advertises, promotes, labels, or publishes a statement, display, image, offer, or announcement of personalized algorithmic pricing using consumer data specific to a particular individual must disclose that this price was set by an algorithm using the individual's personal data. Prohibits the use of algorithmic pricing under certain conditions. Provides that if there is a violation of the Act, the Attorney General may file a civil action requesting that an injunction be issued against the defendant to enjoin and restrain the continuance of the violation. Provides that notice must be given to the defendant of not less than 5 days, and the court may issue an injunction enjoining and restraining any further violation without requiring proof that any person has, in fact, been injured or damaged. Authorizes the court to impose a civil penalty of not more than $1,000 for each violation. Exempts any insurer licensed, regulated, or otherwise authorized to do business in the State or any excess lines insurer, including any persons, agents, or affiliates acting on behalf of the insurer. Exempts financial services, including, but not limited to, financial institutions, financial institution affiliates, broker-dealers, registered investment advisors, and entities that provide consumer credit products such as credit cards, personal loans, and mortgages. Amends the Consumer Fraud and Deceptive Business Practices Act. Makes a violation of the Preventing Algorithmic Pricing Discrimination Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Limits home rule.

Creates the Illinois Consumer Data Privacy Act. Applies to legal entities that conduct business in Illinois or produce products or services that are targeted to Illinois residents and that satisfy one or more of the following thresholds: during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or derives over 25% of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more. "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person but does not include deidentified data or publicly available information. Requires a controller who, alone or jointly with others, to consider the purposes and means of the processing of personal data in protecting the security of consumers while processing personal data and in notifying consumers of a breach of the security of the system. Authorizes rights to consumers under the Act to include, but not be limited to, the right to access their personal data, obtain a list of third parties to whom their data has been disclosed, request corrections to inaccurate data, and question the profiling of their information. Creates an appeal process for a consumer to gather more information on the actions of a covered entity. Exempts the State, a political subdivision of the State, and units of local government, a federally recognized Indian tribe, nonprofits established to prevent insurance fraud, and data already covered by federal law. Authorizes the Attorney General to enforce the Act. Makes definitions. Makes other changes. Limits the concurrent exercise of home rule powers. Contains a severability provision.

Creates the Identity Verification for Consumer Services Act. Requires an entity that provides specified services to use identity verification to verify a person's identity before initiating or modifying an agreement to provide the service. Provides that an entity that provides a specified service that becomes aware of an attempted or confirmed identity theft through its compliance with the Act shall report the attempted or confirmed identity theft to the Attorney General. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Limits home rule. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that it is an unlawful practice for a seller of a digital good to offer for sale or advertise a digital good to a consumer using the terms "buy" or "purchase" or any other term that a reasonable person would understand to confer an unrestricted ownership interest in that digital good unless specified disclosures are made by the seller. Sets forth exemptions to the provision.

Creates the Higher Education Enrollment Fraud Act. Requires the Board of Higher Education to convene a working group to develop policies and procedures for institutions of higher education to prevent fraudulent enrollment in online courses for the purpose of gaining access to financial aid, campus information technology systems, and student support services. Requires each institution of higher education to complete an annual cybersecurity self-assessment of its information technology infrastructure to determine its Information Technology Laboratory score and annually report local and systemwide technology and data security measures that support improved oversight of fraud mitigation, online learning quality, and cybersecurity efforts to the Board. Requires the self-assessment and report to be submitted to the Board by December 15, 2026 and each December 15 thereafter and the Board to compile a report of these submissions and submit that report to the General Assembly by January 15, 2027 and each January 15 thereafter. Includes other information an institution of higher education must submit related to enrollment fraud. Effective immediately.

Creates the Algorithmic Pricing Transparency Act. Provides that any person or entity that sells or offers to sell goods or services through an online platform to consumers in this State shall provide a clear and conspicuous disclosure if the price displayed to a consumer is generated using surveillance pricing. Provides that a consumer may opt out of surveillance pricing and a covered entity shall provide the consumer with a non-personalized baseline price for the goods or services. Prohibits a covered entity from using specified personal information to generate algorithmic pricing. Provides that a violation of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective one year after becoming law.

Amends the Personal Information Protection Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its Internet website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund to offset all reasonable costs of enforcing the registration requirements and establishing and maintaining the Internet website. Amends the State Finance Act to create the Data Broker Registry Fund.

Amends the Personal Information Protection Act. Provides that no data collector shall routinely collect the social security number of an Illinois resident without a specific and immediate need. Defines "specific and immediate need".

Creates the Privacy Rights Act. Sets forth duties and obligations of businesses that collected consumers' personal information and sensitive personal information to keep such information private. Sets forth consumer rights in relation to the collected personal information and sensitive personal information, including the right to: delete personal information; correct inaccurate personal information; know what personal information is sold or shared and to whom; opt out of the sale or sharing of personal information; limit use and disclosure of sensitive personal information; and no retaliation for exercising any rights. Sets forth enforcement provisions. Creates the Consumer Privacy Fund. Allows the Attorney General to create rules to implement the Act. Establishes the Privacy Protection Agency. Includes provisions regarding remedies and fines for violations of the Act. Makes a conforming change in the State Finance Act.