SB2875

Applies to companies handling personal data of 100,000+ Illinois consumers annually, or 25,000+ consumers if more than 25% of revenue comes from selling data (payment-only transaction data excluded from the count).

Companies using automated profiling for consequential decisions (lending, hiring, housing, insurance, healthcare, education, criminal justice) must let consumers question the outcome, see the data used, and get decisions reevaluated after corrections.

Consumers can opt out of targeted advertising, data sales, and profiling via universal opt-out signals (like browser-based Global Privacy Control), forcing ad tech, retail, and publisher platforms to honor those signals within 45 days.

Controllers must sign binding contracts with processors (vendors) covering data handling, subcontractor approval, deletion at contract end, and annual third-party assessments; existing vendor contracts will need renegotiation.

Sensitive data (biometrics, health status, immigration status, geolocation accurate beyond 3 decimal degrees, data on children under 13) triggers heightened protections and consent requirements.

Broad carve-outs exist for HIPAA-covered data, Gramm-Leach-Bliley financial data, FCRA credit data, FERPA education data, insurance companies, banks, small businesses (as defined by the SBA), and employment/B2B data.

Illinois Attorney General has exclusive enforcement authority (no private right of action), but companies should expect AG investigations and consent decrees similar to enforcement patterns in other state privacy laws.