SB 3890

Any company collecting personal data from Illinois residents would face new consent, disclosure, and data minimization requirements, regardless of where the company is headquartered.

Companies using AI tools that ingest consumer data (ad targeting, recommendation engines, predictive analytics, generative AI trained on customer interactions) would likely need to update privacy notices and obtain clearer user permissions.

Mid-size and large companies are typically the focus of state privacy laws like this, with thresholds often based on revenue, number of consumers, or volume of data processed (specific thresholds in SB 3890 are not yet public).

Retailers, ad-tech firms, SaaS providers, healthcare platforms, and financial services companies serving Illinois consumers would carry the heaviest compliance lift.

Penalties under Illinois privacy laws have historically been steep (BIPA generated billion-dollar settlements), so non-compliance risk could be material even if enforcement details are still being shaped.

The bill is stuck in committee assignment, so immediate compliance action is not required, but the direction of travel matches CCPA, CPA, and other state privacy regimes.

Small businesses and certain regulated entities (HIPAA-covered, GLBA-covered) are commonly exempted in similar laws, though SB 3890's exemptions are not yet confirmed.