SB 3220
CONSUMER DATA PRIVACY
TL;DR
Illinois SB 3220 would expand the state's consumer data privacy framework, adding new rules around how businesses collect, use, and share personal data, including data processed by AI systems. It's currently stuck in committee after being re-referred to Assignments, so it hasn't advanced to active debate.
How This Might Impact Your Business
Companies operating in Illinois that collect consumer personal data would face expanded disclosure, consent, and data handling obligations similar to laws in California and Virginia.
Businesses using AI or automated decision-making tools on Illinois residents' data (think targeted ads, credit scoring, personalized pricing) would likely need to provide opt-out mechanisms and transparency notices.
Retailers, ad tech firms, fintech, healthtech, and HR tech companies are the most exposed, since they routinely process large volumes of consumer data through AI systems.
Mid-size and large businesses are typically covered under Illinois privacy frameworks; small businesses below certain revenue or data volume thresholds are usually exempt, though specific thresholds in SB 3220 are not yet detailed.
Non-compliance with Illinois privacy laws has historically carried steep penalties (BIPA class actions have produced settlements in the hundreds of millions), so litigation exposure is a real risk if this passes.
The bill is stalled in committee with no active sponsor momentum visible, meaning near-term passage is unlikely but the framework could resurface in future sessions.
What Should You Do
Ask your privacy or legal team to map which Illinois consumer data flows through your AI and automated decision systems.
Benchmark your current consent, opt-out, and disclosure practices against California (CCPA/CPRA) and Virginia (VCDPA) standards, since Illinois bills typically borrow from these.
Review your AI vendor contracts for data processing terms and indemnification, especially for tools touching Illinois consumers.
Assign someone to monitor SB 3220 and related Illinois privacy bills; track movement out of Assignments as the trigger for deeper compliance work.
If you faced BIPA exposure, treat this as a signal that Illinois is expanding its privacy enforcement surface and budget accordingly.
Who It Affects
Status Timeline
committee
Rule 3-9(a) / Re-referred to Assignments
May 22, 2026