IL HB2871

Requires data brokers to register annually with the Secretary of State by January 31, paying a $100 registration fee, and provide information about their data collection practices, opt-out policies, security breaches, and practices regarding minors' data.

Defines "data broker" as a business that knowingly collects and sells or licenses brokered personal information (names, addresses, Social Security numbers, biometric data, etc.) to third parties with whom it has no direct relationship.

Imposes civil penalties of $50 per day (maximum $10,000 annually) plus unpaid fees on data brokers that fail to register.

Mandates data brokers develop and maintain a comprehensive information security program with administrative, technical, and physical safeguards appropriate to their size, resources, and data volume.

Requires security programs to include encryption of sensitive data, secure user authentication, access controls, employee training, incident documentation, and regular security reviews at least annually or when business practices change materially.

Effective January 1, 2020.