SB3180
AI DATA PRIVACY ACT
TL;DR
Illinois Senator Rachel Ventura's SB3180 would require any company deploying AI to Illinois residents to get explicit written consent before training AI on user data and keeping that training data indefinitely. Starting January 2027, violators face lawsuits from users ($1,000 to $5,000 per violation plus attorney fees) and enforcement by the Illinois Attorney General under the state's consumer fraud law.
How This Might Impact Your Business
Any company deploying AI products to Illinois residents (websites, mobile apps, dashboards, chatbots) must either get express written consent to train on user data and retain it indefinitely, or default the AI to no-training mode until users opt in.
The private right of action is the big financial risk: users can sue for $1,000 per negligent violation or $5,000 per intentional/reckless violation, plus attorney fees, which historically fuels class action activity in Illinois (see BIPA lawsuits).
Sharing user data collected through AI with any third party requires separate express written consent, affecting vendors, analytics providers, and AI model partners.
Applies broadly across SaaS, HR tech, healthcare AI, fintech chatbots, retail personalization, and edtech; no small business carve-out or revenue threshold in the bill text.
Illinois Attorney General can also enforce under the Consumer Fraud Act, which allows civil penalties up to $50,000 per violation.
Effective date is January 1, 2027, giving companies roughly a year to rebuild consent flows, update privacy notices, and reconfigure default AI training settings.
Bill is still early (introduced, re-referred to Assignments), so terms could shift, but the BIPA-style damages structure signals serious litigation exposure if enacted as written.
What Should You Do
Inventory every AI feature accessible to Illinois users and identify which ones train on user inputs or retain that data; loop in product and engineering leads now.
Have legal review your current consent flows and terms of service against the bill's 'express written consent' standard, which is stricter than clickwrap acceptance.
Evaluate switching AI training defaults to 'off' for Illinois users as the safer compliance path, since opt-in defaults reduce litigation exposure.
Audit third-party data sharing arrangements (model vendors, analytics, subprocessors) and prepare consent language covering these disclosures.
Track SB3180 through the Illinois Senate Assignments Committee and watch for amendments; assign someone to monitor given Illinois's history of aggressive AI and privacy enforcement.
Who It Affects
Sponsors
Status Timeline
introduced
Rule 3-9(a) / Re-referred to Assignments
February 2, 2026