IL HB3041

Creates the Illinois Data Privacy and Protection Act, restricting covered entities from collecting, processing, or transferring personal data unless reasonably necessary to provide a requested product/service or for specific permitted purposes like security, fraud prevention, legal compliance, or research

Establishes individual data rights including the ability to access, correct, delete, and export personal data, with covered entities required to respond within 45-60 days depending on their size; individuals get two free requests per year

Requires affirmative express consent before transferring data to third parties or engaging in targeted advertising, with heightened protections for minors under 17 including a ban on targeted advertising to known minors

Defines "large data holders" as entities with $250 million+ in annual revenue handling data of 5 million+ individuals, imposing additional requirements including executive certifications, privacy officers, biennial impact assessments, and 10-year retention of privacy policy versions

Authorizes enforcement by the Attorney General, State's Attorneys, and municipal attorneys, plus a private right of action for individuals (except against small businesses) with remedies including compensatory, liquidated, and punitive damages; effective 180 days after becoming law