Illinois Site Laws Report: Laws, Updates, and Information That May Affect Your Website

Why Illinois Site Laws Look Different From Most States

Illinois has never enacted a comprehensive consumer privacy statute. Several bills modeled on Virginia and Connecticut have stalled since 2019. None passed in the 2026 spring session, which adjourned on May 31, 2026. So Illinois still relies on targeted statutes rather than one umbrella law. Those targeted statutes carry more litigation risk than most umbrella laws.

The 2026 session focused on AI and minors instead. Governor JB Pritzker signed the AI Safety Measures Act on July 6, 2026. He signed the Children’s Social Media Safety Act on July 31, 2026. Both laws target large companies rather than small sites. The sections below explain which Illinois site laws reach you and which do not.

The Biometric Information Privacy Act: The Law That Reaches Small Sites

The most litigated of the Illinois site laws is the Biometric Information Privacy Act, or BIPA. The law appears at 740 ILCS 14 and has applied since 2008. BIPA covers biometric identifiers such as fingerprints, face geometry, voiceprints, and retina scans. Any private entity that collects biometric data from an Illinois resident is covered. There is no size threshold.

Before collecting biometric data, you must give written notice of the purpose and retention period. You must obtain a written release. You must publish a retention schedule and destroy the data when the purpose ends. You may not sell or profit from biometric data. You may not disclose the data without consent.

BIPA allows private lawsuits for $1,000 per negligent violation and $5,000 per reckless one. Senate Bill 2979, effective August 2, 2024, limited damages to one violation per person per method. Before that amendment, damages accrued with every scan. Even after the amendment, class actions remain common. Face based login, photo tagging, voice assistants, and employee time clocks all trigger the law.

For a small business site, BIPA matters if any tool scans faces or voices. Virtual try on features, identity verification vendors, and AI photo tools deserve a close look. Ask each vendor whether the tool creates a biometric template. If so, add the written notice and consent flow before launch. A short consent screen costs far less than a class action.

Senate Bill 315: The AI Safety Measures Act

The AI headline of 2026 is Senate Bill 315, the Artificial Intelligence Safety Measures Act. The General Assembly passed the bill on May 31, 2026, the last day of session. Governor Pritzker signed SB 315 on July 6, 2026. Primary provisions take effect January 1, 2027. Audit and transparency reporting duties take effect January 1, 2028.

The law applies only to developers of frontier AI models. Covered developers earn more than $500 million a year and train models with massive computing power. They must publish a safety framework for catastrophic risk. They must report harmful incidents within 72 hours, or 24 hours for imminent danger. Illinois became the first state to require annual independent third party audits.

The Attorney General enforces the law with penalties of up to $1 million per first offense. Subsequent violations reach $3 million. For a small business site, this law does not apply. You may use AI tools from covered developers without any duty of your own. The law matters to you only as a signal of where Illinois site laws are heading.

House Bill 5511: The Children’s Social Media Safety Act

The second July law is House Bill 5511, the Children’s Social Media Safety Act. Governor Pritzker signed the bill on July 31, 2026. Implementation begins in 2028. The law covers social media platforms with addictive algorithms and gaming platforms with stranger contact. News media, broadband providers, email providers, and learning management systems are excluded.

Covered platforms must use device based age signals rather than ID uploads. Minors’ feeds must default to chronological content from followed accounts. Notifications must pause from 10 p.m. to 7 a.m., except direct messages. Minors’ profiles stay hidden from adult strangers, location sharing is blocked, and parents may override defaults.

The Attorney General enforces the law with civil penalties of up to $50,000 per violation. Most small business sites fall outside the definitions. Still, the law signals where Illinois site laws are heading. A community forum or app popular with teens should watch the 2028 rollout. Federal COPPA rules still apply if your site targets children under 13.

Other AI Rules Already in Force

Two older AI laws reach more businesses than the July 2026 headlines. House Bill 3773 took effect January 1, 2026. That law amends the Human Rights Act to bar AI with discriminatory effects in employment decisions. Employers must notify workers when AI is used for hiring, promotion, or discipline. If you use an AI screening tool for job applicants, the notice applies to you.

The Wellness and Oversight for Psychological Resources Act was signed August 4, 2025. That law bars AI from providing therapy or making treatment decisions without a licensed professional. A general chatbot may not present itself as a therapist to Illinois users. Illinois has no general chatbot disclosure law like Idaho or Hawaii. A clear AI disclosure remains a best practice under the Consumer Fraud Act.

The Personal Information Protection Act: Breach Notification

Illinois site laws on data breaches center on the Personal Information Protection Act, 815 ILCS 530. The law applies to any data collector that handles personal information of Illinois residents. Personal information means a name combined with a Social Security number or driver’s license number. Account numbers with access codes, medical information, and biometric data also qualify. A username with a password counts on its own.

After a breach of unencrypted data, you must notify affected residents as quickly as possible. Illinois sets no fixed number of days. You may delay only at a law enforcement request. If a breach affects 500 or more residents, you must notify the Attorney General. That notice must arrive no later than the notice to residents.

Notice may go by mail or email. Substitute notice applies when direct notice would cost over $250,000 or reach over 500,000 people. The Act also requires reasonable security measures and secure disposal of records. Violations are enforced under the Consumer Fraud Act. A written breach plan remains the sensible default.

The Consumer Fraud Act and Your Online Store

Illinois polices advertising through the Consumer Fraud and Deceptive Business Practices Act at 815 ILCS 505. The Act prohibits unfair or deceptive acts in trade or commerce. Illinois courts look to Federal Trade Commission interpretations for guidance. That makes federal advertising standards part of Illinois site laws. Consumers may recover actual damages, punitive damages, and attorney fees.

For your site, this is the law behind the everyday rules. Reference prices that were never charged create exposure. Timers that reset on every visit create exposure. Subscription trials that convert without clear disclosure create exposure. Hidden fees and staff written testimonials do the same.

Illinois also has the Automatic Contract Renewal Act at 815 ILCS 601. Contracts that renew automatically must disclose the renewal clause clearly. Contracts of 12 months or more that renew for a month or longer require advance notice. That notice must arrive 30 to 60 days before the cancellation deadline. Online sign ups must allow online cancellation.

Illinois Site Laws for eCommerce: Sales and Use Tax

Illinois imposes a 6.25 percent state sales tax, and Chicago’s combined rate tops 10 percent. Following the 2018 Wayfair decision, Illinois required remote sellers to register beginning October 1, 2018. The original test was $100,000 in sales or 200 separate transactions. House Bill 4951 removed the transaction test effective January 1, 2025. Today only the $100,000 threshold applies.

The Leveling the Playing Field law took effect January 1, 2021. Remote sellers must collect the full state and local rate for the customer’s delivery address. Since January 1, 2025, retailers with Illinois locations must also use destination sourcing for shipped orders. Marketplace facilitators have collected on facilitated sales since January 1, 2020. Those marketplace sales do not count toward your own threshold.

Registration runs through the Department of Revenue MyTax Illinois portal. Illinois taxes canned software but exempts most digital goods delivered electronically. Streaming services are exempt at the state level, although Chicago imposes a 10.25 percent amusement tax. Check your product categories against Department guidance instead of trusting default platform settings. Illinois rate tables change often.

What You Should Do Now

You do not need a compliance department to satisfy Illinois site laws. You do need a short list of concrete tasks. Each step below addresses a rule already in force. Each also positions you well for the 2027 and 2028 effective dates.

1. Audit every tool on your site for biometric collection and add BIPA notices, written consent, and a retention schedule before launch.
2. Map every place you store personal information, confirm encryption, and write a breach plan that reaches residents and the Attorney General.
3. Review pricing displays, subscription flows, and reviews against the Consumer Fraud Act and the Automatic Contract Renewal Act.
4. Total your Illinois sales against the $100,000 threshold and confirm destination based rates through MyTax Illinois.
5. Add a clear AI disclosure to any chatbot and a notice to job applicants if AI screens applications.

Once those tasks are done, you will be current on the Illinois site laws covered here. Put two dates on your calendar. Mark January 1, 2027, when SB 315 begins. Then watch the spring 2027 session for another privacy bill. Illinois laws often take effect January 1, which gives you a predictable window each fall.

Key Takeaways

• BIPA requires written consent before any biometric collection and carries a $1,000 to $5,000 private right of action.
• SB 315, the AI Safety Measures Act, signed July 6, 2026, applies only to frontier model developers beginning January 1, 2027.
• HB 5511, the Children’s Social Media Safety Act, signed July 31, 2026, covers large platforms beginning in 2028.
• Breach notices are due without unreasonable delay, with Attorney General notice at 500 or more residents.
• Remote sellers collect Illinois sales tax after $100,000 in sales, with the 200 transaction test gone since January 1, 2025.

Frequently Asked Questions About Illinois Site Laws

Does Illinois have a privacy law like California’s CCPA?

No. Illinois has never enacted a comprehensive consumer privacy statute. Several bills have stalled since 2019, and none passed in 2026. Illinois relies on BIPA, the Personal Information Protection Act, and the Consumer Fraud Act. Federal law fills the remaining gaps.

Do Illinois site laws apply to my business if I am located in another state?

Yes, in most cases. BIPA reaches any private entity collecting biometric data from Illinois residents. The breach statute covers anyone holding Illinois residents’ data. The Consumer Fraud Act covers sales to Illinois consumers. Sales tax rules apply once your Illinois sales exceed $100,000.

Do Illinois site laws require age verification on my website?

No. Illinois has no age verification mandate for adult content sites. HB 5511 will require device based age signals on large social media platforms beginning in 2028. A typical business site is not covered. Federal COPPA rules still apply if your site targets children under 13.

How quickly must I report a data breach in Illinois?

You must notify affected residents in the most expedient time possible and without unreasonable delay. If 500 or more residents are affected, you must notify the Attorney General. That notice is due no later than the notice to residents.

Does BIPA apply to my website if I only use a photo upload feature?

Only if a tool scans the photo to create a face template. A plain photo upload does not trigger BIPA. Face based login, photo tagging, and virtual try on tools usually do. Ask each vendor whether the tool creates a biometric template before launch.

Conclusion

Illinois site laws in 2026 reward the owner who looks past the headlines. SB 315 and HB 5511 drew national attention in July 2026, but both target large companies. BIPA remains the law most likely to reach a small business site. The breach statute demands prompt action, and the Consumer Fraud Act imports federal advertising standards. The sales tax rules simplified in 2025 but still demand destination based rates.

No privacy bill passed in 2026, but the spring 2027 session will likely bring another. Finish the five tasks above this fall. You will meet every current requirement while staying ready for the next session.

Take the Next Step

Staying compliant does not require a law degree. You do need a reliable place to check the rules as they change. Bookmark this report and review your biometric tools, breach plan, and tax settings. For a second set of eyes, ask a website professional or an Illinois attorney. A short review today costs far less than a BIPA class action tomorrow. Also make sure you have a Website Fair Treatment policy.