HB5581 - Illinois Privacy Rights Act

• Creates comprehensive privacy protections for Illinois residents by establishing consumer rights to access, correct, delete, and obtain portable copies of their personal data, with exceptions for trade secrets.

• Applies to entities conducting business in Illinois that process personal data of at least 35,000 unique consumers annually, or 10,000 consumers where over 25% of gross revenue comes from data sales.

• Grants consumers rights to opt out of targeted advertising, personal data sales, and automated profiling decisions, with support for opt-out preference signals and authorized agents to submit requests.

• Requires controllers to obtain explicit consent before processing sensitive data (biometric, health, racial/ethnic, sexual orientation, geolocation), limit data collection to necessary purposes, maintain reasonable security practices, and provide clear privacy notices.

• Grants exclusive enforcement authority to the Illinois Attorney General with mandatory notice and 60-day cure period through December 31, 2025; violations constitute unfair or deceptive practices under consumer fraud law with no private right of action; effective January 1, 2025.