Illinois

The Artificial Intelligence Safety Measures Act splits its duties across two classes of developer. A frontier developer is one that trains, or initiates the training of, a frontier model using more than 10^26 integer or floating-point operations of computing power. A large frontier developer is a frontier developer whose group had annual gross revenues over $500,000,000 in the preceding calendar year.

Every frontier developer must publish a transparency report on its website before or when it deploys a new or substantially modified frontier model. Every frontier developer must also report a critical safety incident to the Illinois Emergency Management Agency and Office of Homeland Security and to the Attorney General within 72 hours of learning facts sufficient to establish a reasonable belief that one has occurred.

Where it discovers that a critical safety incident poses an imminent risk of death or serious physical injury, it must separately disclose that incident within 24 hours to an appropriate law enforcement or public safety authority. No frontier developer may retaliate against a covered employee who discloses, with reasonable cause, a specific and substantial danger to public health or safety from a catastrophic risk, or a violation of the Act.

A large frontier developer carries four further duties. It must write, implement and publish a frontier AI framework from January 1, 2028. It must add summaries of its catastrophic-risk assessments to that transparency report. It must obtain an annual independent third-party audit and meet the Act's access, retention and publication requirements for the results.

And it must provide a reasonable internal process through which a covered employee can disclose that kind of information to it anonymously. The Act establishes civil penalties for violations and expressly creates no private right of action, and takes effect January 1, 2027. The bill (as Senate Floor Amendment No. 2, further narrowed by Amendments No. 3 and No. 4) was approved by the Governor on July 6, 2026.

Section 11-20.1(a)(7) defines child sexual abuse material to include a film, photograph, or other visual medium or depiction by computer that is or appears to be a person under 18, regardless of the method by which it is created, adopted, or modified to appear as such, a technology-neutral test that reaches an artificial-intelligence-generated or AI-altered depiction on the same footing as a photograph of a real event.

Producing, disseminating, or possessing such material is a felony under subsection (c): a still-image violation is a Class 1 felony and a moving-image violation a Class X felony for most paragraphs of subsection (a), each carrying a mandatory minimum fine and a maximum fine of $100,000, with the mandatory minimum ranging from $1,000 to $2,000 depending on which paragraph of subsection (a) was violated; subsection (c-5) raises every tier to a Class X felony, and a repeat offender to a mandatory 9-year minimum term, where the child depicted is under 13.

The section was renamed from Child Pornography to Child Sexual Abuse Material by Public Act 104-245, effective January 1, 2026, without changing the underlying prohibition.

A 2024 amendment added a digitally altered sexual image, defined in Section 5(3.5) as visual media created or substantially altered so that it would falsely appear to a reasonable person to be an authentic depiction of a person, to the images a depicted individual can sue over.

Section 10 gives an identifiable, depicted individual a cause of action against a person over 18 who intentionally disseminates or threatens to disseminate such an image, real or digitally altered (including an AI-generated fake), without consent and knowing or recklessly disregarding that the person did not consent; Section 10(c) specifically bars disclosing that an image was digitally altered as a defense to liability.

A prevailing plaintiff may recover the greater of actual damages or statutory damages of up to $10,000 per defendant under Section 25, plus the defendant's monetary gain, punitive damages, attorney's fees, and injunctive relief.

Section 5 defines a digital replica as a newly created electronic representation of an actual individual's voice, image, or likeness, made using a computer, algorithm, software, tool, artificial intelligence, or other technology, fixed in a sound recording or audiovisual work the individual did not actually perform in, that a reasonable person would believe is that individual.

Section 30(b) makes it unlawful to knowingly distribute, transmit, or make available to the public a sound recording or audiovisual work with actual knowledge that it contains an unauthorized digital replica, enforceable by the individual depicted or their authorized representative under Section 20; Section 35 exempts news, documentary, biographical, comment, criticism, and parody uses unless the replica falsely creates the impression that the individual actually participated.

A service provider that only transmits, stores, or provides access to the material carries a Digital Millennium Copyright Act (DMCA)-style safe harbor under Section 30(e) and (f) if it acts expeditiously once it has actual knowledge of the infringing replica.

Section 2-102(L)(1) makes it a civil rights violation for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of a protected class, or to use zip codes as a proxy for a protected class, with respect to recruitment, hiring, promotion, discharge, discipline, or the terms and conditions of employment.

Section 2-102(L)(2) separately makes it a civil rights violation for an employer to fail to provide notice to an employee that the employer is using artificial intelligence for those purposes; the Illinois Department of Human Rights is directed to adopt rules on the timing, circumstances, and means of that notice.

The Human Rights Act's own employer definition reaches the State and every political subdivision as well as private employers, so this duty binds government and private employers alike.

Section 20(a) bars any individual, corporation, or entity from providing, advertising, or offering therapy or psychotherapy services to the public in Illinois, including through internet-based artificial intelligence, unless the services are conducted by a licensed professional.

A licensed professional may only use AI for administrative or supplementary support, and may never let AI make an independent therapeutic decision, interact directly with a client in therapeutic communication, generate a treatment plan without the professional's review and approval, or detect a client's emotions or mental state; using AI to record or transcribe a session requires prior written notice and the patient's consent.

The Department of Financial and Professional Regulation may assess a civil penalty of up to $10,000 per violation after a hearing, with religious counseling, peer support, and public self-help material exempted.

An employer that asks applicants for Illinois-based positions to record video interviews and uses artificial intelligence to analyze those videos must, before the interview, notify the applicant that AI may be used, explain how the AI works and what general characteristics it evaluates, and obtain the applicant's consent; sharing of the video is limited to persons whose expertise or technology is necessary to evaluate fitness for the position, and an applicant may request deletion of their video within 30 days.

An employer that relies solely on AI analysis of a video interview to decide who receives an in-person interview must collect and annually report race and ethnicity data on applicants and hires to the Department of Commerce and Economic Opportunity, which reports to the Governor and General Assembly whether the data disclose racial bias.

Requires a private entity to give written notice of the purpose and length of collection, storage and use, and to obtain a written release, before capturing a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry; a 2024 amendment recognizes an electronic signature as a valid release.

Bars selling, leasing, trading, or profiting from biometric data, limits disclosure to consent, a subject-requested transaction, or legal process, and requires a public written retention schedule that destroys the data within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever is first.

The Act excludes photographs, writing samples, and similar raw items from the definition of biometric identifier, but not an identifier such as a face-geometry scan that is itself enumerated, even when computed from an otherwise excluded item; no controlling appellate holding on that specific application was found.

Requires a data collector, government agency or private entity, holding computerized personal information of Illinois residents to notify affected residents of a security breach in the most expedient time possible and without unreasonable delay.

Personal information expressly includes unique biometric data used to authenticate an individual, such as a fingerprint, retina or iris image, or other physical or digital biometric representation, alongside a name paired with a Social Security number, account number, or medical information.

A data collector must notify the Illinois Attorney General once a single breach affects more than 500 Illinois residents, and a State agency must do so above 250 residents; a violation is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

Arms any person aggrieved by a Biometric Information Privacy Act (BIPA) violation with a private right of action in state circuit court or as a supplemental federal claim, recovering the greater of $1,000 or actual damages for a negligent violation and the greater of $5,000 or actual damages for an intentional or reckless violation, plus attorneys' fees, costs, and injunctive relief.

The Illinois Supreme Court held a claim accrues with each scan or disclosure (Cothron v. White Castle, 2023) under one uniform five-year limitations period for every Section 15 claim (Tims v. Black Horse Carriers, 2023); a 2024 amendment then capped recovery at one award per person per collection or disclosure method, responding directly to Cothron's invitation to the legislature to revisit the resulting damages exposure.

The Seventh Circuit held in 2026 that the cap is a remedial change to available damages, not a substantive change to BIPA's liability standard, so it applies retroactively to cases already pending when the amendment took effect (Clay v. Union Pacific Railroad Co., 2026).

Section 17-51(a) provides that a person commits computer tampering when he or she knowingly and without the authorization of a computer's owner or in excess of the authority granted to him or her accesses a computer, network, program, or data, naming both the without authorization and in excess of authority granted prongs the Computer Fraud and Abuse Act (CFAA) is built on, unaffected in its Illinois application by Van Buren v. United States, which narrowed only the federal statute.

Distinctively, subsection (a-10) provides that accessing a computer network is deemed to be with the authorization of a computer's owner if the owner authorizes patrons, customers, or guests to access the computer network and the person accessing it is an authorized patron, customer, or guest and complies with all terms or conditions for use of the computer network that are imposed by the owner.

This textually ties authorization for guest or public access to compliance with the site owner's own posted terms and conditions, a more explicit authorization-follows-ToS link than a bare computer-misuse statute carries elsewhere, and means a scraper that violates a site's terms of use for public access may be reading itself out of the (a-10) safe harbor even absent any technical circumvention. No Illinois appellate decision applies this provision to scraping specifically.

Section 15(b) requires a private entity, before it may collect, capture, purchase, receive through trade, or otherwise obtain a person's biometric identifier or biometric information, to inform the subject in writing that the data is being collected or stored, inform the subject in writing of the specific purpose and retention period, and obtain a written release.

Section 10 defines biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, expressly excluding photographs and physical descriptions on their own; a scan of face geometry derived from a photograph, rather than the photograph itself, is what the statute reaches.

This is precisely the scraping fact pattern behind Biometric Information Privacy Act (BIPA)'s most consequential litigation: Clearview AI scraped several billion photographs from the open web to construct facial-geometry faceprints without notice or consent, settled a state-court suit in May 2022 (ACLU v. Clearview AI) under a nationwide permanent injunction, and reached a roughly $51.75 million equity-stake class settlement in a parallel federal multidistrict litigation in March 2025.

BIPA carries a private right of action (section 20(a)) for each violation, liquidated damages of $1,000 or actual damages for a negligent violation and $5,000 or actual damages for an intentional or reckless one, plus attorney's fees, a materially more exposed damages structure than any general privacy act researched, none of which carries a private right of action at all.

The 2024 amendment, P.A. 103-769, effective August 2, 2024, added section 20(b)-(c) limiting a private entity to at most one recovery per person per method of collection or disclosure, responding to Cothron v. White Castle System, Inc., 2023 IL 128004 (Ill. 2023), which had held a separate claim accrues each time biometric data is scanned or transmitted.

A data collector, defined to include a government agency, a public or private university, and a privately or publicly held corporation, that owns or licenses, or maintains or stores without owning or licensing, records containing personal information about an Illinois resident must implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

It must require by contract that any party to whom it discloses that information do the same. A data collector already subject to and compliant with Gramm-Leach-Bliley Act Title V standards, or with a state or federal law requiring greater protection, is deemed to comply.

The duty carries no penalty of its own; Section 20 deems a violation of the Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, exposing a violator to the Attorney General's injunctive and civil-penalty authority and to a private action for actual damages.

Any person, defined to include a natural person, a corporation or other legal entity, a unit of local government, or the State of Illinois or one of its agencies, that disposes of materials containing personal information about an Illinois resident must do so in a manner that renders the personal information unreadable, unusable, and undecipherable, such as by redacting, burning, pulverizing, or shredding paper records, or destroying or erasing electronic media.

A third party contracted to dispose of such materials must implement and monitor policies and procedures against unauthorized access, acquisition, or use of personal information during collection, transport, and disposal. A financial institution regulated under Gramm-Leach-Bliley Act Title V, or a person subject to the disposal rule at 15 U.S.C. section 1681w, is exempt.

The Attorney General may impose a civil penalty of up to $100 per individual whose information was improperly disposed of, capped at $50,000 per instance of improper disposal, after notice and an opportunity to be heard, and may separately bring a circuit court action for any appropriate relief; Section 20 also deems a violation of this Section an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

Requires internet enabled device operating systems to offer an age signal at device setup and pass an age category to apps and social media platforms on request, which must then apply default protections such as restricting algorithmic recommendations and notification hours for minors. Passed the House April 16, 2026, passed the Senate 57 to 0 with a 113 to 0 House concurrence on June 1, 2026, was sent to the Governor on June 26, 2026, and was signed July 31, 2026 as Public Act 104-0664. It was introduced as the Digital Age Assurance Act.