HB3910 - Consumer Privacy Act Summary

• Establishes a new Consumer Privacy Act granting Illinois residents the right to request disclosure of personal information collected, request deletion of personal data, and opt out of the sale of personal information to third parties.

• Requires businesses meeting specified thresholds (over $25 million annual revenue, buying/selling personal information of 50,000+ consumers, or deriving 50%+ revenue from selling personal information) to inform consumers at collection about what data is gathered and how it will be used.

• Prohibits businesses from discriminating against consumers who exercise privacy rights by denying goods/services or charging different prices, though allows financial incentives related to data collection or deletion with proper disclosure and opt-in consent.

• Mandates businesses respond to consumer requests within 45 days (extendable to 90 days), provide data in portable formats, maintain multiple designated request methods including a toll-free phone number, and disclose information in privacy policies updated at least annually.

• Establishes civil penalties of $2,500 per violation or $7,500 per intentional violation enforceable by the Attorney General, plus private right of action for data breaches with statutory damages of $100-$750 per consumer per incident, and creates a Consumer Privacy Fund to offset enforcement costs.