Makes high-risk automated decisions, in Illinois

815 ILCS 530/40 (P.A. 97-483, eff. 1 January 2012) · Read the law's page

• This binds any person, including a natural person, a corporation, another legal entity, a unit of local government, or the State of Illinois or one of its agencies, that disposes of materials containing personal information about an Illinois resident, except a financial institution regulated under Gramm-Leach-Bliley Act Title V or a person subject to the disposal rule at 15 U.S.C. 1681w.
• Dispose of paper records containing personal information by redacting, burning, pulverizing, or shredding them, and destroy or erase electronic media containing personal information, so the information cannot practicably be read or reconstructed.
• As a third party contracted by a person to dispose of the materials, implement and monitor compliance with policies and procedures that prohibit unauthorized access to, acquisition of, or use of personal information during collection, transportation, and disposal.
• A violation carries a civil penalty of up to $100 per individual whose information was improperly disposed of, capped at $50,000 per instance of improper disposal, imposed by the Attorney General after notice and an opportunity to be heard; Section 20 separately deems a violation of this Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, opening the Attorney General's and a private plaintiff's remedies under 815 ILCS 505/7 and 505/10a as well.

815 ILCS 530/45 (P.A. 99-503, eff. 1 January 2017) · Read the law's page

• Implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
• Require, by contract, that any party to whom personal information is disclosed also implement and maintain reasonable security measures over it.
• This binds any data collector, including a government agency, a public or private university, or a privately or publicly held corporation, that owns, licenses, maintains, or stores records containing personal information about an Illinois resident.
• A data collector already subject to and compliant with Gramm-Leach-Bliley Act Title V standards, or with a state or federal law that requires greater protection, is deemed to comply with this duty.
• There is no dedicated penalty for this section; a violation is deemed an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, exposing a violator to a private action for actual damages and attorneys' fees under 815 ILCS 505/10a and to an Attorney General action for injunctive relief and a civil penalty of up to $50,000, or up to $50,000 per violation where the court finds intent to defraud, under 815 ILCS 505/7.

820 ILCS 42/1 et seq. (P.A. 101-260, eff. Jan. 1, 2020) · Read the law's page

• Before asking an applicant to submit a video interview, notify them that artificial intelligence may be used to analyze it and consider their fitness for the position.
• Explain, before the interview, how the artificial intelligence works and what general types of characteristics it uses to evaluate applicants, and obtain the applicant's consent.
• Do not share an applicant's video except with a person whose expertise or technology is necessary to evaluate fitness for the position.
• Delete an applicant's interview video, and instruct anyone else who received a copy to do the same, within 30 days of the applicant's request.
• If you rely solely on AI analysis of a video interview to select applicants for an in-person interview, collect and report race and ethnicity data on applicants and hires to the Department of Commerce and Economic Opportunity every year by December 31.

Wellness and Oversight for Psychological Resources Act, Public Act 104-0054 (HB 1806, eff. Aug. 1, 2025) · Read the law's page

• Do not provide, advertise, or offer therapy or psychotherapy services to the public in Illinois through artificial intelligence unless a licensed professional is the one actually conducting the therapy.
• If you are a licensed professional, do not let artificial intelligence make an independent therapeutic decision, interact directly with a client in therapeutic communication, generate a treatment plan without your review and approval, or detect a client's emotions or mental state.
• Give written notice and obtain the patient's consent before using artificial intelligence to record or transcribe a therapy session.

775 ILCS 5/2-102(L) (P.A. 103-0804, eff. January 1, 2026) · Read the law's page

• Do not use artificial intelligence in a way that has the effect of subjecting an employee or applicant to discrimination on the basis of a protected class, and do not use a zip code as a proxy for a protected class, in recruitment, hiring, promotion, discipline, discharge, or the terms and conditions of employment.
• Notify an employee or applicant whenever you use artificial intelligence for the employment purposes described above; the Illinois Department of Human Rights sets the timing, circumstances, and means for that notice by rule.

105 ILCS 5/24A-5 (P.A. 104-0565, eff. Jan. 1, 2027) · Read the law's page

• If you are an evaluator under a school district's teacher evaluation plan, do not use an artificial intelligence tool to assign a numerical score or qualitative rating for any component of a teacher's evaluation or any evaluation task that requires professional judgment; you may use one to support administrative tasks.
• If you are a teacher, do not use an artificial intelligence tool to generate evidence of professional practice that an evaluator will use to evaluate your performance; you may use one to support administrative tasks.
• Disclose to the teacher being evaluated the name and specific purpose of any artificial intelligence tool an evaluator uses, and disclose to the evaluator the name and specific purpose of any artificial intelligence tool a teacher uses.