SB0051

Any online service, app, game, or feature 'likely to be accessed' by users under 18 falls under this law, even if kids aren't the target audience, so social media, gaming, edtech, streaming, and retail apps with kid-appealing content are all in scope.

Data Protection Impact Assessments (DPIAs) become mandatory by July 1, 2026 for existing products and before launch for new ones, and must be biennially reviewed and handed to the Attorney General within 5 business days of request.

High-privacy defaults must be turned on for child users, and profiling minors (including personalization algorithms and targeted ads) is banned by default unless the business can prove it serves the child's best interest.

Precise geolocation collection, dark patterns nudging kids to share more data, and using kids' data beyond its original purpose are all prohibited, forcing changes to common ad tech and engagement design practices.

Penalties reach $2,500 per affected child for negligent violations and $7,500 per affected child for intentional ones, meaning a single feature affecting 10,000 Illinois minors could trigger $25 million or more in fines.

Businesses must either use reasonable age estimation technology or apply child-level protections to all users, which is a meaningful product and UX decision.

A 90-day cure period exists for DPIA-related violations if the business is substantially compliant, and there is no private right of action (only the AG can sue).