Illinois

The Artificial Intelligence Safety Measures Act splits its duties across two classes of developer. A frontier developer is one that trains, or initiates the training of, a frontier model using more than 10^26 integer or floating-point operations of computing power. A large frontier developer is a frontier developer whose group had annual gross revenues over $500,000,000 in the preceding calendar year.

Every frontier developer must publish a transparency report on its website before or when it deploys a new or substantially modified frontier model. Every frontier developer must also report a critical safety incident to the Illinois Emergency Management Agency and Office of Homeland Security and to the Attorney General within 72 hours of learning facts sufficient to establish a reasonable belief that one has occurred.

Where it discovers that a critical safety incident poses an imminent risk of death or serious physical injury, it must separately disclose that incident within 24 hours to an appropriate law enforcement or public safety authority. No frontier developer may retaliate against a covered employee who discloses, with reasonable cause, a specific and substantial danger to public health or safety from a catastrophic risk, or a violation of the Act.

A large frontier developer carries four further duties. It must write, implement and publish a frontier AI framework from January 1, 2028. It must add summaries of its catastrophic-risk assessments to that transparency report. It must obtain an annual independent third-party audit and meet the Act's access, retention and publication requirements for the results.

And it must provide a reasonable internal process through which a covered employee can disclose that kind of information to it anonymously. The Act establishes civil penalties for violations and expressly creates no private right of action, and takes effect January 1, 2027. The bill (as Senate Floor Amendment No. 2, further narrowed by Amendments No. 3 and No. 4) was approved by the Governor on July 6, 2026.

Section 11-20.1(a)(7) defines child sexual abuse material to include a film, photograph, or other visual medium or depiction by computer that is or appears to be a person under 18, regardless of the method by which it is created, adopted, or modified to appear as such, a technology-neutral test that reaches an artificial-intelligence-generated or AI-altered depiction on the same footing as a photograph of a real event.

Producing, disseminating, or possessing such material is a felony under subsection (c): a still-image violation is a Class 1 felony and a moving-image violation a Class X felony for most paragraphs of subsection (a), each carrying a mandatory minimum fine and a maximum fine of $100,000, with the mandatory minimum ranging from $1,000 to $2,000 depending on which paragraph of subsection (a) was violated; subsection (c-5) raises every tier to a Class X felony, and a repeat offender to a mandatory 9-year minimum term, where the child depicted is under 13.

The section was renamed from Child Pornography to Child Sexual Abuse Material by Public Act 104-245, effective January 1, 2026, without changing the underlying prohibition.

A 2024 amendment added a digitally altered sexual image, defined in Section 5(3.5) as visual media created or substantially altered so that it would falsely appear to a reasonable person to be an authentic depiction of a person, to the images a depicted individual can sue over.

Section 10 gives an identifiable, depicted individual a cause of action against a person over 18 who intentionally disseminates or threatens to disseminate such an image, real or digitally altered (including an AI-generated fake), without consent and knowing or recklessly disregarding that the person did not consent; Section 10(c) specifically bars disclosing that an image was digitally altered as a defense to liability.

A prevailing plaintiff may recover the greater of actual damages or statutory damages of up to $10,000 per defendant under Section 25, plus the defendant's monetary gain, punitive damages, attorney's fees, and injunctive relief.

Section 5 defines a digital replica as a newly created electronic representation of an actual individual's voice, image, or likeness, made using a computer, algorithm, software, tool, artificial intelligence, or other technology, fixed in a sound recording or audiovisual work the individual did not actually perform in, that a reasonable person would believe is that individual.

Section 30(b) makes it unlawful to knowingly distribute, transmit, or make available to the public a sound recording or audiovisual work with actual knowledge that it contains an unauthorized digital replica, enforceable by the individual depicted or their authorized representative under Section 20; Section 35 exempts news, documentary, biographical, comment, criticism, and parody uses unless the replica falsely creates the impression that the individual actually participated.

A service provider that only transmits, stores, or provides access to the material carries a Digital Millennium Copyright Act (DMCA)-style safe harbor under Section 30(e) and (f) if it acts expeditiously once it has actual knowledge of the infringing replica.

Each school district, charter school, and non-public, non-sectarian elementary or secondary school must create, maintain, and implement a policy on bullying and file it with the State Board of Education. Every 2 years it must review and re-evaluate the policy and file the updated policy by September 30 of the subject year.

Beginning with the 2026-2027 school year, the definition of cyber-bullying also includes the posting or distribution of an unauthorized digital replica by electronic means if the posting or distribution creates any of the effects enumerated in the definition of bullying. An unauthorized digital replica is the use of a digital replica of an individual without the consent of the depicted individual.

Digital replica has the meaning given to that term in the Digital Voice and Likeness Protection Act. The policy on bullying must include procedures for informing parents or guardians of all students involved in the alleged incident within 24 hours after the school's administration is made aware of the students' involvement.

The policy must also contain procedures for promptly investigating and addressing reports of bullying, making all reasonable efforts to complete the investigation within 10 school days after the report was received. The Act took effect July 1, 2026.

Section 10(a) makes a provision in an agreement between an individual and any other person for the performance of personal or professional services contrary to public policy and unenforceable when three conditions are all met: the provision allows the creation and use of a digital replica of the individual's voice or likeness in place of work the individual would otherwise have performed in person, the provision does not include a reasonably specific description of the intended uses of the digital replica, and the individual was not represented in the way the Act describes.

The individual is represented in that way if represented by legal counsel who negotiated the licensing of the digital replica rights under a written agreement, or by a labor union whose collective bargaining agreement expressly covers uses of digital replicas.

Section 5 defines a digital replica as a newly created, electronic representation of the identity of an actual individual, made using a computer, algorithm, software, tool, artificial intelligence, or other technology, fixed in a sound recording or audiovisual work in which the individual did not actually perform or appear, and so realistic that a reasonable observer would believe it is a performance by that individual and no other. Section 15 applies the Act to agreements entered into after its effective date.

Section 2-102(L)(1) makes it a civil rights violation for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of a protected class, or to use zip codes as a proxy for a protected class, with respect to recruitment, hiring, promotion, discharge, discipline, or the terms and conditions of employment.

Section 2-102(L)(2) separately makes it a civil rights violation for an employer to fail to provide notice to an employee that the employer is using artificial intelligence for those purposes; the Illinois Department of Human Rights is directed to adopt rules on the timing, circumstances, and means of that notice.

The Human Rights Act's own employer definition reaches the State and every political subdivision as well as private employers, so this duty binds government and private employers alike.

Section 24A-5 of the School Code, as amended, bars an evaluator from using an artificial intelligence tool to assign a numerical score or qualitative rating for any component of a teacher's evaluation or any evaluation task that requires professional judgment. An evaluator may still use an artificial intelligence tool to support administrative tasks.

A teacher may not use an artificial intelligence tool to generate evidence of professional practice that an evaluator will use to evaluate the teacher's performance, though a teacher may use one to support administrative tasks. The joint committee under Section 24A-4(b-5) determines how artificial intelligence tools may be used within the Section's evaluation provisions.

Where an evaluator uses an artificial intelligence tool, its name and specific purpose must be disclosed to the teacher being evaluated, and where a teacher uses one, to the evaluator.

Section 20(a) bars any individual, corporation, or entity from providing, advertising, or offering therapy or psychotherapy services to the public in Illinois, including through internet-based artificial intelligence, unless the services are conducted by a licensed professional.

A licensed professional may only use AI for administrative or supplementary support, and may never let AI make an independent therapeutic decision, interact directly with a client in therapeutic communication, generate a treatment plan without the professional's review and approval, or detect a client's emotions or mental state; using AI to record or transcribe a session requires prior written notice and the patient's consent.

The Department of Financial and Professional Regulation may assess a civil penalty of up to $10,000 per violation after a hearing, with religious counseling, peer support, and public self-help material exempted.

An employer that asks applicants for Illinois-based positions to record video interviews and uses artificial intelligence to analyze those videos must, before the interview, notify the applicant that AI may be used, explain how the AI works and what general characteristics it evaluates, and obtain the applicant's consent; sharing of the video is limited to persons whose expertise or technology is necessary to evaluate fitness for the position, and an applicant may request deletion of their video within 30 days.

An employer that relies solely on AI analysis of a video interview to decide who receives an in-person interview must collect and annually report race and ethnicity data on applicants and hires to the Department of Commerce and Economic Opportunity, which reports to the Governor and General Assembly whether the data disclose racial bias.

Requires a private entity to give written notice of the purpose and length of collection, storage and use, and to obtain a written release, before capturing a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry; a 2024 amendment recognizes an electronic signature as a valid release.

Bars selling, leasing, trading, or profiting from biometric data, limits disclosure to consent, a subject-requested transaction, or legal process, and requires a public written retention schedule that destroys the data within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever is first.

The Act excludes photographs, writing samples, and similar raw items from the definition of biometric identifier, but not an identifier such as a face-geometry scan that is itself enumerated, even when computed from an otherwise excluded item; no controlling appellate holding on that specific application was found.

Requires a data collector, government agency or private entity, holding computerized personal information of Illinois residents to notify affected residents of a security breach in the most expedient time possible and without unreasonable delay.

Personal information expressly includes unique biometric data used to authenticate an individual, such as a fingerprint, retina or iris image, or other physical or digital biometric representation, alongside a name paired with a Social Security number, account number, or medical information.

A data collector must notify the Illinois Attorney General once a single breach affects more than 500 Illinois residents, and a State agency must do so above 250 residents; a violation is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

Arms any person aggrieved by a Biometric Information Privacy Act (BIPA) violation with a private right of action in state circuit court or as a supplemental federal claim, recovering the greater of $1,000 or actual damages for a negligent violation and the greater of $5,000 or actual damages for an intentional or reckless violation, plus attorneys' fees, costs, and injunctive relief.

The Illinois Supreme Court held a claim accrues with each scan or disclosure (Cothron v. White Castle, 2023) under one uniform five-year limitations period for every Section 15 claim (Tims v. Black Horse Carriers, 2023); a 2024 amendment then capped recovery at one award per person per collection or disclosure method, responding directly to Cothron's invitation to the legislature to revisit the resulting damages exposure.

The Seventh Circuit held in 2026 that the cap is a remedial change to available damages, not a substantive change to BIPA's liability standard, so it applies retroactively to cases already pending when the amendment took effect (Clay v. Union Pacific Railroad Co., 2026).

The Reproductive Health Records Privacy Act, Public Act 104-0471 (House Bill 5295), was approved by the Governor on June 24, 2026 and takes effect on July 1, 2027.

An electronic health network must prevent the disclosure of a patient's coded private health care information to a provider, business entity, other electronic health network, or health information exchange outside Illinois unless the disclosure is for technical support, quality assurance, payment or health care operations, or to a specific covered entity with the consent of the patient or of the patient's parent, guardian, health care surrogate decision maker, or power of attorney.

The network must develop and enable the technological capabilities to parse coded private health care information, let a health care provider manually segregate private health care information, let a patient request and consent to its exchange with a specific covered entity, and let a patient opt out of segregation. A network may not notify an out-of-state recipient that private health care information may have been segregated from a patient's electronic health record.

Private health care information means health information in an electronic health network that is coded private health care information, such as codes for induced abortion, mifepristone or gender dysphoria, or that relates to abortion or abortion-related health care services. A person aggrieved by a violation by an electronic health network may bring an action against it and may be awarded actual damages, injunctive relief, and reasonable attorney's fees and costs. The Act does not authorize an action against any health care provider.

Section 17-51(a) provides that a person commits computer tampering when he or she knowingly and without the authorization of a computer's owner or in excess of the authority granted to him or her accesses a computer, network, program, or data, naming both the without authorization and in excess of authority granted prongs the Computer Fraud and Abuse Act (CFAA) is built on, unaffected in its Illinois application by Van Buren v. United States, which narrowed only the federal statute.

Distinctively, subsection (a-10) provides that accessing a computer network is deemed to be with the authorization of a computer's owner if the owner authorizes patrons, customers, or guests to access the computer network and the person accessing it is an authorized patron, customer, or guest and complies with all terms or conditions for use of the computer network that are imposed by the owner.

This textually ties authorization for guest or public access to compliance with the site owner's own posted terms and conditions, a more explicit authorization-follows-ToS link than a bare computer-misuse statute carries elsewhere, and means a scraper that violates a site's terms of use for public access may be reading itself out of the (a-10) safe harbor even absent any technical circumvention. No Illinois appellate decision applies this provision to scraping specifically.

Section 15(b) requires a private entity, before it may collect, capture, purchase, receive through trade, or otherwise obtain a person's biometric identifier or biometric information, to inform the subject in writing that the data is being collected or stored, inform the subject in writing of the specific purpose and retention period, and obtain a written release.

Section 10 defines biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, expressly excluding photographs and physical descriptions on their own; a scan of face geometry derived from a photograph, rather than the photograph itself, is what the statute reaches.

This is precisely the scraping fact pattern behind Biometric Information Privacy Act (BIPA)'s most consequential litigation: Clearview AI scraped several billion photographs from the open web to construct facial-geometry faceprints without notice or consent, settled a state-court suit in May 2022 (ACLU v. Clearview AI) under a nationwide permanent injunction, and reached a roughly $51.75 million equity-stake class settlement in a parallel federal multidistrict litigation in March 2025.

BIPA carries a private right of action (section 20(a)), under which a prevailing party may recover for each violation liquidated damages of $1,000 or actual damages, whichever is greater, for a negligent violation, or $5,000 or actual damages, whichever is greater, for an intentional or reckless one, plus reasonable attorneys' fees and costs.

The 2024 amendment, P.A. 103-769, effective August 2, 2024, added section 20(b)-(c) limiting a private entity to at most one recovery per person per method of collection or disclosure, responding to Cothron v. White Castle System, Inc., 2023 IL 128004 (Ill. 2023), which had held a separate claim accrues each time biometric data is scanned or transmitted.

The Act defines a State agency as any State agency, department, board, and commission under the jurisdiction of the Governor to which the Department provides services.

The Office of the Statewide Chief Information Security Officer may temporarily suspend operation of an information system or information technology infrastructure that is owned, leased, outsourced, or shared by one or more State agencies to isolate the source of, or stop the spread of, an information security breach or other similar information security incident.

State agencies must comply with directives to temporarily discontinue or suspend operations of information systems or information technology infrastructure. Every employee of a county or municipality must annually complete a cybersecurity training program. The training must include detecting phishing scams, preventing spyware infections and identity theft, and preventing and responding to data breaches. Section 5-30 carries the source note Public Act 102-753, effective January 1, 2023.

The principal executive officer, or a designee, of each municipality with a population of 35,000 or greater and of each county must designate a local official or employee as the primary point of contact for local cybersecurity issues. Each such jurisdiction must provide the name and contact information of the cybersecurity designee to the Statewide Chief Information Security Officer and update the information as necessary. Section 5-35 appears in its current form under Public Act 104-195, effective January 1, 2026.

Section 10 of the Insurance Data Security Law requires each licensee to develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.

A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to the insurance laws of Illinois, and the term excludes a purchasing group or a risk retention group chartered and licensed in another state and a licensee that is acting as an assuming insurer that is domiciled in another state or jurisdiction.

A licensee must select and implement appropriate security measures from a listed set that includes protecting, by encryption or other appropriate means, all nonpublic information while being transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media.

The listed measures also include utilizing effective controls, including multifactor authentication procedures, for any individual accessing nonpublic information.

A licensee must establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.

A licensee must exercise due diligence in selecting its third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to or held by the provider. An insurer domiciled in Illinois must submit to the Director by April 15 each year a written statement certifying that the insurer is in compliance with the requirements of section 10.

Licensees must comply with subsection (f) 2 years after the effective date of the Act, and with all other subsections of section 10 one year after the effective date of the Act. The Act takes effect January 1, 2024. A licensee with fewer than 50 employees, including any independent contractors, is exempt from section 10. A violation of the Act may be penalized in accordance with the provisions of the Illinois Insurance Code, including Section 403A of the Illinois Insurance Code. The Act does not create or imply a private cause of action for a violation of its provisions.

Section 4-101 of the Public Utilities Act directs the Commerce Commission to require all public utilities to establish a security policy that includes on-site safeguards to restrict physical or electronic access to critical infrastructure and computerized control and data systems. Each regulated entity must provide to the Commission an annual affidavit signed by a representative of the regulated entity that states that the entity has a security policy in place.

The affidavit must state that the entity has conducted at least one practice exercise based on the security policy within the 12 months immediately preceding the date of the affidavit. For an electric public utility, the affidavit must state that the entity follows, at a minimum, the most current security standards set forth by the North American Electric Reliability Council.

A data collector, defined to include a government agency, a public or private university, and a privately or publicly held corporation, that owns or licenses, or maintains or stores without owning or licensing, records containing personal information about an Illinois resident must implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

It must require by contract that any party to whom it discloses that information do the same. A data collector already subject to and compliant with Gramm-Leach-Bliley Act Title V standards, or with a state or federal law requiring greater protection, is deemed to comply.

The duty carries no penalty of its own; Section 20 deems a violation of the Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, exposing a violator to the Attorney General's injunctive and civil-penalty authority and to a private action for actual damages.

Any person, defined to include a natural person, a corporation or other legal entity, a unit of local government, or the State of Illinois or one of its agencies, that disposes of materials containing personal information about an Illinois resident must do so in a manner that renders the personal information unreadable, unusable, and undecipherable, such as by redacting, burning, pulverizing, or shredding paper records, or destroying or erasing electronic media.

A third party contracted to dispose of such materials must implement and monitor policies and procedures against unauthorized access, acquisition, or use of personal information during collection, transport, and disposal. A financial institution regulated under Gramm-Leach-Bliley Act Title V, or a person subject to the disposal rule at 15 U.S.C. section 1681w, is exempt.

The Attorney General may impose a civil penalty of up to $100 per individual whose information was improperly disposed of, capped at $50,000 per instance of improper disposal, after notice and an opportunity to be heard, and may separately bring a circuit court action for any appropriate relief; Section 20 also deems a violation of this Section an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

Section 20 of the Insurance Data Security Law requires a licensee to notify the Director as promptly as possible but no later than 3 business days after a determination that a cybersecurity event has occurred when either of two criteria is met.

The first criterion is that Illinois is the licensee's state of domicile, in the case of an insurer, or home state, in the case of an insurance producer, and the cybersecurity event has a reasonable likelihood of materially harming any consumer residing in Illinois or any material part of the normal operations of the licensee.

The second criterion is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in Illinois and the event requires notice to a government body, self-regulatory agency, or other supervisory body under state or federal law or has a reasonable likelihood of materially harming a consumer or a material part of the licensee's normal operations.

A licensee must provide as much as possible of 13 listed items of information, from the date of the cybersecurity event to the name of a contact person who is familiar with the event and authorized to act for the licensee. A licensee has a continuing obligation to update and supplement initial and subsequent notifications to the Director regarding material changes to previously provided information.

A licensee must conduct a prompt investigation if it learns that a cybersecurity event has occurred or may have occurred. A licensee must maintain records concerning all cybersecurity events for a period of at least 5 years from the date of the cybersecurity event and produce those records upon demand of the Director. A licensee must provide the Director a copy of the notice sent to consumers under the Personal Information Protection Act when the licensee is required to notify the Director.

A licensee that becomes aware of a cybersecurity event in a system maintained by a third-party service provider must treat the event as it would under the notification subsection unless the provider gives the Director the notice. A violation of the Act may be penalized in accordance with the provisions of the Illinois Insurance Code, including Section 403A of the Illinois Insurance Code. The Act takes effect January 1, 2024.

The Act reaches an unsolicited electronic mail advertisement: an email whose principal purpose is to promote the sale or other distribution of goods or services to the recipient, sent to a recipient with whom the initiator has no prior or existing business or personal relationship and not at the recipient's request or with their express consent.

It bars initiating, or causing to be initiated, one that uses a third party's Internet domain name without permission, otherwise misrepresents the point of origin or transmission path, or contains false or misleading information in the subject line. Those prohibitions are framed as rules against falsity or deception, the kind of state email rule the CAN-SPAM Act's preemption clause leaves in force.

The Act separately requires the initiator to establish a toll-free number or a valid sender-operated return email address the recipient can use to ask that no further such messages be sent, bars selling or transferring the address of anyone who has made that request, and requires the subject line of every unsolicited electronic mail advertisement to begin with ADV:, or ADV:ADLT for one about goods, services or credit only a person 18 or older may obtain; these duties are not framed as rules against falsity or deception.

The Act applies only where the unsolicited electronic mail advertisement is delivered to an Illinois resident via an email service provider's service or equipment located in Illinois.

A person who suffers actual damages from a violation, whether an email service provider or anyone else, may sue for attorney's fees and costs and may elect to recover, instead of actual damages, the lesser of $10 for each violating message or $25,000 per day, but has no action against a provider that merely transmits the message. The Act took effect January 1, 2000 under Public Act 91-233, and section 10, which holds its duties, was last amended by Public Act 93-199, effective January 1, 2004.

Section 14-2 makes it eavesdropping to use a device in a surreptitious manner to overhear, transmit or record a private conversation without the consent of all parties, whether or not the person recording is a party. It is also eavesdropping to intercept, record or transcribe in a surreptitious manner a private electronic communication to which the person is not a party without the consent of all parties.

Surreptitious means obtained or made by stealth or deception, or executed through secrecy or concealment. A conversation or electronic communication is private only where a party intended it to be private under circumstances reasonably justifying that expectation, which includes any expectation recognized by law.

Using or disclosing information one knows or reasonably should know was obtained in violation of the article is eavesdropping too, unless all parties consent, as is making, distributing or possessing a device knowing its design makes it primarily useful for surreptitious recording or interception where its intended or actual use is contrary to the article.

Section 14-3 exempts a business engaged in marketing, opinion research or telephone solicitation, which for this purpose includes live calls that take orders, assist in the use of goods or services, or administer or collect credit accounts, that monitors or records its employees' calls for service quality control, training or internal research with the consent of at least one active party.

A recording made under that exemption may not be furnished to law enforcement, used in any proceeding, or divulged to any third party; a call unrelated to those purposes must be cut off and its recording destroyed as soon as practicable; and the business must give current and prospective employees notice, including prominent workplace signage, and access to personal-only lines that are not monitored.

Section 14-3 separately lets a person record a conversation to which they are a party, without the other party's consent, on reasonable suspicion that the other party is committing, about to commit, or has committed a criminal offense against them or a household member, where there is reason to believe the recording may capture evidence of it.

Section 14-4 grades eavesdropping a Class 4 felony for a first offense and a Class 3 felony for a second or subsequent offense, and grades eavesdropping directed at a law enforcement officer, prosecutor, or judge performing official duties a Class 3 felony, rising to a Class 2 felony on a second or subsequent offense. Illinois's general felony sentencing law caps a fine at $25,000 for an individual or $50,000 for a corporation unless the specific offense states a greater amount.

Section 14-6 gives any party to the conversation or electronic communication a civil action for an injunction, actual damages, and punitive damages against the eavesdropper or its principal, and against a landlord, building operator, or common carrier by wire who aids, abets or knowingly permits the eavesdropping, with no statutory-damages floor.

Public Act 98-1142, effective December 30, 2014, rewrote the article's definitions and offense after the Illinois Supreme Court held in People v. Melongo that the earlier recording provision, which reached any conversation whether or not private, was unconstitutional on its face.

The Act's operative rules reach an autodialer, a device that stores telephone numbers and dials them sequentially or randomly to connect a call with a recorded message, which the Act defines as a taped communication soliciting the sale of goods or services without live voice interaction; a burglar alarm, fire alarm or voice message system is excluded. It is a violation to play a prerecorded message placed by an autodialer without the consent of the called party.

The Act bars operating an autodialer between 9 p.m. and 9 a.m., and requires it to disconnect within 30 seconds after the call ends. Where 30-second disconnection is not technically feasible, a live operator must state their name, the name, address, and telephone number of the business or organization being represented, and the purpose of the call, and ask at the outset whether the called person consents to hear the prerecorded message.

An autodialer may not dial numbers by successively increasing or decreasing digits, may not be operated in a way that impedes a called party's caller ID display, and may not be used to call an emergency telephone number.

The Act does not apply to a call made in response to the called person's express request, to a person with whom the caller has a prior or existing business relationship, or on behalf of a political, charitable, polling, research, or broadcast-rating organization, except that every autodialed call must still comply with the caller-ID rule.

Section 30, as last amended by Public Act 98-546 effective August 26, 2013, lets an injured customer sue for three times actual damages plus costs and attorney's fees and lets a consumer separately recover $500 in statutory damages per violation. The Attorney General may also enforce the Act as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, and the court may award each person who received a violating call $500 per violation. The provisions this entry describes came into force on different days.

The Act governs a telephone solicitation, defined as a communication through the use of a telephone by live operators for soliciting the sale of goods or services. It bars soliciting a sale by a telephone call between 9 p.m. and 8 a.m., and requires the live operator to state immediately their name, the name of the business or organization represented, and the purpose of the call, and to ask at the outset whether the called person consents to the solicitation.

It is a violation to continue a live-operator solicitation without the called party's consent, or to call an emergency telephone number. If the called person asks to be taken off the caller's contact list, the operator must not call again and the business must remove the person's name and number from its contact records, though compliance with the Federal Trade Commission's Telemarketing Sales Rule do-not-call provision satisfies this duty.

A telephone solicitor may not impede a called party's caller ID display when its equipment is capable of transmitting it. A telephone solicitor may not obtain or submit for payment a check, draft, or other negotiable paper drawn on a person's account or bond without that person's express written consent.

The Act does not apply to a telecommunications carrier, or to a bank, trust company, savings and loan association, credit union, licensed consumer installment lender, licensed insurer, or licensed real estate broker, or their affiliates, subsidiaries, employees, or agents.

It also does not apply to a call made by an autodialer, which the Automatic Telephone Dialers Act separately governs, or to a call made by a registered securities dealer, investment adviser, or salesperson acting within the scope of that registration, though every call must still comply with the caller-ID rule.

A customer injured by a violation may sue for three times actual damages plus costs and attorney's fees, and the Attorney General may separately enforce the Act as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. The provisions this entry describes came into force on different days.

Requires internet enabled device operating systems to offer an age signal at device setup and pass an age category to apps and social media platforms on request, which must then apply default protections such as restricting algorithmic recommendations and notification hours for minors. Passed the House April 16, 2026, passed the Senate 57 to 0 with a 113 to 0 House concurrence on June 1, 2026, was sent to the Governor on June 26, 2026, and was signed July 31, 2026 as Public Act 104-0664. It was introduced as the Digital Age Assurance Act.