AI Frontier Institute

AI DATA PRIVACY ACT

View primary source →

Illinois SB3180, introduced February 2, 2026 by Sen. Rachel Ventura, creates the Artificial Intelligence Data Privacy Act (Section 1). Effective January 1, 2027 (Section 99), the bill regulates 'deployers'—persons or entities who integrate AI into websites, apps, dashboards, or other products accessible to Illinois residents ('users'). Under Section 10, deployers must comply with one of two options: (1) obtain the user's prior written notice and express written consent before training an AI on the user's 'covered information' and retaining that training data indefinitely, or (2) set the AI's default to prohibit such training and retention, allowing it only if the user is notified and affirmatively opts in. Deployers are also prohibited from disclosing a user's covered information to third parties without express written consent. Section 15 establishes a private right of action: aggrieved users may sue for liquidated damages of $1,000 (negligent violations) or $5,000 (intentional or reckless violations), or actual damages if greater, plus attorney's fees and injunctive relief. Section 20 classifies violations as unlawful practices under the Consumer Fraud and Deceptive Business Practices Act, giving the Attorney General enforcement authority. Section 90 amends that Act by adding 815 ILCS 505/2MMMM to incorporate violations of the new law.

← Back to the tracker