SB0051 creates the Illinois Age-Appropriate Design Code Act, a new state law aimed at protecting children’s privacy and well-being in online services, products, and features likely to be accessed by minors. The bill defines a child as a consumer under 18 and requires covered businesses to conduct data protection impact assessments that identify how children’s data is used, the risks posed by design and data practices, and steps to mitigate those risks. Businesses would also need to review those assessments every two years and, for existing services, complete the required assessment by July 1, 2026.
The bill imposes a set of affirmative duties on businesses, including using high-privacy default settings for children, providing age-appropriate privacy notices, signaling when a child is being monitored or tracked, offering accessible privacy tools, and enforcing published policies. It also prohibits a range of practices, such as using children’s data in materially detrimental ways, default profiling of children without safeguards, unnecessary collection or sharing of personal information, misuse of precise geolocation, dark patterns, and retention or reuse of age-estimation data beyond what is needed for age assurance. The bill authorizes the Attorney General to enforce the act through injunctions and civil penalties, and it creates a Children’s Data Protection Working Group to study implementation and report recommendations to the General Assembly.
If enacted, the bill would add a new chapter of child-focused online privacy requirements to Illinois law and would directly affect businesses offering digital services that are likely to be used by children, including platforms that use targeted advertising, profiling, age estimation, or location tracking. It would also give the Attorney General a central enforcement role, while expressly barring private lawsuits under the act. The measure includes a cure period for certain violations if a business is in substantial compliance and remedies issues within 90 days of notice.
Because there were no committee transcripts or recorded votes provided, the overall sentiment cannot be measured from legislative debate or roll calls. Based on the bill text alone, the proposal appears strongly protective of children’s privacy and online safety, but it also places significant compliance obligations on technology and media businesses. The structure of the bill suggests a policy preference for privacy-by-design and age-appropriate defaults, with enforcement and implementation details left partly to the Attorney General and the working group.
The main points of contention likely center on how broadly the bill applies to online services “likely to be accessed by children,” the operational burden of conducting impact assessments and age assurance, and whether the restrictions on profiling, targeted advertising, and data collection are too expansive for businesses. Another likely issue is the balance between child protection and business flexibility, especially for platforms that serve mixed-age audiences or rely on personalization, advertising, or geolocation features.
The bill would create a new Illinois statutory framework governing online services, products, and features likely to be accessed by children, imposing privacy-by-design obligations, data protection impact assessments, default privacy settings, disclosure requirements, and limits on profiling, targeted advertising, geolocation, and dark patterns. It would authorize enforcement by the Attorney General through civil actions seeking injunctions and penalties of up to $2,500 per affected child for negligent violations and $7,500 per affected child for intentional violations, while also creating a temporary Children’s Data Protection Working Group to advise on implementation. The act would not create a private right of action.
No committee discussion or voting history was provided, so there is no recorded legislative sentiment to summarize from debate or roll call. The bill’s text reflects a clear pro-child-privacy and pro-consumer-safety posture, with strong regulatory requirements for businesses that collect or process children’s data. At the same time, the absence of supporting legislative context means any opposition or support can only be inferred from the bill’s likely compliance impact on online businesses.
The most likely areas of contention are the breadth of the term “likely to be accessed by children,” the cost and feasibility of required data protection impact assessments and age-estimation measures, and the limits placed on profiling, targeted advertising, and data retention. Businesses, especially large online platforms and ad-supported services, may view the bill as burdensome or difficult to operationalize, while child privacy advocates would likely support the restrictions as necessary to reduce harm. Another possible point of debate is whether the Attorney General’s enforcement authority and per-child penalties are appropriately calibrated, and whether the cure period provides enough flexibility for good-faith compliance.