IL SB3299

Creates the Consumer Privacy Act granting Illinois residents rights to request disclosure of personal information collected about them, request deletion of personal information, and opt out of sales of personal information to third parties, effective January 1, 2021.

Applies to "businesses" meeting specified thresholds: annual gross revenues exceeding $25,000,000, buying/selling/sharing personal information of 50,000+ consumers/households/devices, or deriving 50%+ of annual revenue from selling personal information.

Requires businesses to disclose at or before collection what personal information will be collected and its intended uses; prohibits collecting additional categories or using information for additional purposes without notice.

Prohibits discrimination against consumers exercising privacy rights through denial of goods/services or different pricing, though businesses may offer financial incentives directly related to data value or charge different prices if reasonably related to data value provided by consumers.

Establishes civil penalties of up to $2,500 per violation or $7,500 per intentional violation enforceable by the Attorney General, and creates a Consumer Privacy Fund to offset enforcement costs; allows consumers private right of action for data breaches resulting from failure to implement reasonable security with damages of $100-$750 per consumer per incident.