SB0052 creates the Illinois Privacy Rights Act, a comprehensive consumer data privacy law governing how covered businesses collect, use, share, sell, retain, and secure personal information and sensitive personal information. The bill gives Illinois consumers a set of rights similar to modern privacy statutes in other states, including the right to know what data is collected and disclosed, access specific pieces of personal information, delete personal information, correct inaccurate information, opt out of the sale or sharing of personal information, and limit the use and disclosure of sensitive personal information. It also prohibits retaliation against consumers who exercise these rights and establishes special protections for minors, including heightened consent requirements for sale or sharing of data for consumers under 16.
The bill imposes affirmative duties on businesses, including notice at or before collection, data minimization, purpose limitation, retention limits, written contracts with service providers and contractors, and reasonable security safeguards. It also requires businesses to provide accessible request mechanisms, respond within set timeframes, and maintain privacy policies describing consumer rights and data practices. The measure creates a new Privacy Protection Agency to administer and enforce the Act, authorizes rulemaking by the Attorney General and later the Agency, and establishes a Consumer Privacy Fund to support enforcement, grants, and related programs. It also amends the State Finance Act to accommodate the new fund.
SB0052 would significantly change Illinois law by adding a broad statewide privacy regime that applies to many for-profit businesses meeting revenue or data-processing thresholds, while also including extensive exemptions for certain regulated data and activities. The bill expressly preempts local laws on the collection and sale of consumers’ personal information, and it contains detailed carve-outs for health information, financial information governed by federal law, credit reporting, vehicle warranty/recall data, household data, employee and contractor data in certain contexts, research, and some educational records. It also creates a private right of action only for certain security-breach-related violations, while leaving most enforcement to the Attorney General and the new Agency through administrative and civil penalties.
The overall sentiment reflected by the bill text is strongly pro-consumer and privacy-protective, with a clear emphasis on transparency, control, and accountability for businesses. Because there were no committee transcripts or recorded votes provided, there is no documented legislative debate or recorded support/opposition in the supplied materials. The bill’s structure and findings suggest an intent to align Illinois with leading state privacy frameworks while balancing business compliance concerns and innovation.
The main points of contention likely concern the bill’s breadth, compliance burden, and enforcement structure. Businesses may object to the extensive notice, opt-out, deletion, correction, and contract requirements, the creation of a new agency, and the potential exposure to administrative fines and a limited private right of action for security breaches. Consumer advocates would likely support the stronger rights and enforcement tools, while regulated industries may focus on the many exemptions and the bill’s interaction with existing federal privacy regimes. The bill also includes detailed rulemaking authority, indicating that several operational issues—such as opt-out signals, automated decision-making, and cybersecurity audits—would be further shaped by future agency rules.
SB0052 would add a new statewide consumer privacy statute to the Illinois Compiled Statutes and amend the State Finance Act to create the Consumer Privacy Fund. It would impose new compliance obligations on covered businesses, service providers, and contractors, while granting consumers enforceable rights over personal information and sensitive personal information. The bill also creates a new Privacy Protection Agency with rulemaking and enforcement authority, authorizes Attorney General rulemaking, and establishes civil and administrative penalties for violations, with a limited private right of action for certain data security breaches.
The bill is framed in strongly pro-privacy terms and is designed to expand consumer control over personal data, improve transparency, and increase business accountability. No committee transcripts or votes were provided, so there is no recorded legislative debate or formal vote history to indicate partisan or stakeholder support. Based on the text alone, the measure appears to be a comprehensive consumer-protection proposal with an emphasis on privacy rights, enforcement, and future rulemaking.
Likely areas of contention include the scope of covered businesses, the cost and complexity of compliance, the creation of a new enforcement agency, and the bill’s penalties and private right of action for security breaches. Businesses may also object to opt-out, deletion, correction, and data-sharing restrictions, especially where they affect advertising, analytics, and data-driven services. Consumer advocates would likely favor the stronger rights and enforcement mechanisms, while regulated sectors such as health care, finance, insurance, education, and automotive businesses may focus on the bill’s exemptions and how future rules will define key terms and obligations.