Bill Text: IL HB2913 | 2025-2026 | 104th General Assembly | Introduced

---

Bill Title: Creates the Data Broker Registration and Accessible Deletion Mechanism Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund. Provides that, no later than January 1, 2027, the Attorney General shall establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker. Amends the State Finance Act and the Consumer Fraud and Deceptive Business Practices Act to make conforming changes.

Sponsorship: Partisan Bill (Democrat 1)

Status: (Introduced - Dead) 2025-03-21 - Rule 19(a) / Re-referred to Rules Committee [HB2913 Detail]

Download: Illinois-2025-HB2913-Introduced.html

---

104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026 HB2913 Introduced , by Rep. Daniel Didech SYNOPSIS AS INTRODUCED:
New Act
30 ILCS 105/5.1030 new
815 ILCS 505/2HHHH new
Creates the Data Broker Registration and Accessible Deletion Mechanism Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund. Provides that, no later than January 1, 2027, the Attorney General shall establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker. Amends the State Finance Act and the Consumer Fraud and Deceptive Business Practices Act to make conforming changes.
LRB104 10750 SPS 20829 b
A BILL FOR
HB2913 LRB104 10750 SPS 20829 b
AN ACT concerning business.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 1. Short title. This Act may be cited as the Data
Broker Registration and Accessible Deletion Mechanism Act.
Section 5. Definition. As used in this Act, "data broker"
means a business that knowingly collects and sells or licenses
to third parties the brokered personal information of an
individual with whom the business does not have a direct
relationship. "Data broker" does not include a business that
conducts the following activities and the collection, sale, or
licensing of brokered personal information incidental to
conducting the activities:
(1) developing or maintaining third-party e-commerce
or application platforms;
(2) providing 411 directory assistance or directory
information services, including name, address, and
telephone number, on behalf of or as a function of a
telecommunications carrier;
(3) collecting or transmitting information to be
submitted to a State or federal agency for the purpose of
performing a lawful check of criminal history record
information using fingerprints or receiving the results of

HB2913 - 2 - LRB104 10750 SPS 20829 b
that check;
(4) collecting, maintaining, disclosing, selling,
communicating, or using any personal information bearing
on a consumer's credit worthiness, credit standing, credit
capacity, character, general reputation, personal
characteristics, or mode of living by a consumer reporting
agency, furnisher, or user that provides information for
use in a consumer report, and by a user of a consumer
report, but only to the extent that the activity is
regulated by and authorized under the Fair Credit
Reporting Act, 15 U.S.C. 1681 et seq.
Section 10. Annual registration.
(a) Annually, on or before January 31, a data broker
operating in this State shall register with the Attorney
General.
(b) In registering with the Attorney General, a data
broker shall pay a registration fee in an amount determined by
the Attorney General, not to exceed the reasonable costs of
establishing and maintaining the informational website
described in Section 60. A data broker shall also provide the
following information:
(1) the name of the data broker and its primary
physical, email, and website addresses;
(2) whether the data broker collects the personal
information of minors;

HB2913 - 3 - LRB104 10750 SPS 20829 b
(3) whether the data broker collects consumers'
precise geolocation;
(4) whether the data broker collects consumers'
reproductive health care data;
(5) a link to a page on the data broker's website that
does not make use of any dark patterns;
(6) whether, and to what extent, the data broker or
any of its subsidiaries is regulated by any of the
following:
(A) the federal Fair Credit Reporting Act (15
U.S.C. 1681 et seq.); and
(B) the Gramm-Leach-Bliley Act (Public Law
106-102) and its implementing regulations; and
(7) any additional information or explanation the data
broker chooses to provide concerning its data collection
practices.
(d) The Attorney General shall create a page on its
website where the registration information provided in
subsection (c) shall be made accessible to the public.
(e) A data broker that fails to register as required by
this Section shall be liable for civil penalties and costs in
an action brought by the Attorney General as follows:
(1) a civil penalty of $200 for each day the data
broker fails to register as required by this Section;
(2) an amount equal to the fees that were due during
the period it failed to register; and

HB2913 - 4 - LRB104 10750 SPS 20829 b
(3) expenses incurred by the Attorney General in the
investigation and administration of the action as the
court deems appropriate.
(f) All moneys received by the Attorney General under this
Section shall be deposited into the Data Broker Registry Fund,
a special fund created in the State treasury, and shall be used
to administer and enforce this Act.
Section 15. Accessible deletion mechanism.
(a) No later than January 1, 2027, the Attorney General
shall establish an accessible deletion mechanism that does the
following:
(1) implements and maintains reasonable security
procedures and practices, including, but not limited to,
administrative, physical, and technical safeguards
appropriate to the nature of the information and the
purposes for which the personal information will be used
and to protect consumers' personal information from
unauthorized use, disclosure, access, destruction, or
modification;
(2) allows a consumer, through a single verifiable
consumer request, to request that every data broker that
maintains any personal information delete any personal
information related to that consumer held by the data
broker or associated service provider or contractor;
(3) allows a consumer to selectively exclude specific

HB2913 - 5 - LRB104 10750 SPS 20829 b
data brokers from a request made under paragraph (2); and
(4) allows a consumer to make a request to alter a
previous request made under this subsection after at least
45 days have passed since the consumer last made a request
under this Section.
(b) The accessible deletion mechanism established under
subsection (a) shall meet the following requirements:
(1) allow a consumer to request the deletion of all
personal information related to that consumer through a
single deletion request;
(2) permit a consumer to securely submit information
in one or more privacy-protecting ways determined by the
Attorney General to aid in the deletion request;
(3) allow data brokers registered with the Attorney
General to determine whether an individual has submitted a
verifiable consumer request to delete the personal
information related to that consumer as described in
paragraph (1) and shall not allow the disclosure of any
additional personal information when the data broker
accesses the accessible deletion mechanism unless
otherwise specified in this Act;
(4) allow a consumer to make a request described in
paragraph (1) using an Internet service operated by the
Attorney General;
(5) be accessible free of charge for a consumer to
make a request described in paragraph (1);

HB2913 - 6 - LRB104 10750 SPS 20829 b
(6) allow a consumer to make a request described in
paragraph (1) in any language spoken by any consumer for
whom personal information has been collected by data
brokers;
(7) be readily accessible and usable by consumers with
disabilities;
(8) support the ability of a consumer's authorized
agents to aid in the deletion request;
(9) allow the consumer, or their authorized agent, to
verify the status of the consumer's deletion request; and
(10) provide a description of the following:
(A) the deletion permitted by this Section;
(B) the process for submitting a deletion request
under this Section; and
(C) examples of the types of information that may
be deleted.
(c) Beginning on August 1, 2027, a data broker shall
access the accessible deletion mechanism established under
subsection (a) at least once every 45 days and do the
following:
(1) within 45 days after receiving a request made
under this Section, process all deletion requests made
under this Section and delete all personal information
related to the consumers making the requests consistent
with the requirements of this Section;
(2) in cases where a data broker denies a consumer

HB2913 - 7 - LRB104 10750 SPS 20829 b
request to delete under this title because the request
cannot be verified, process the request as an opt-out of
the sale or sharing of the consumer's personal
information;
(3) direct all service providers or contractors
associated with the data broker to delete all personal
information in their possession related to the consumers
making the requests described in paragraph (1); and
(4) direct all service providers or contractors
associated with the data broker to process a request
described by paragraph (2) as an opt-out of the sale or
sharing of the consumer's personal information.
(d) Beginning on August 1, 2027, after a consumer has
submitted a deletion request and a data broker has deleted the
consumer's data as described in subsection (c), the data
broker shall delete all personal information of the consumer
at least once every 45 days unless the consumer requests
otherwise or the deletion is not required.
(e) Beginning on August 1, 2027, after a consumer has
submitted a deletion request and a data broker has deleted the
consumer's data as described in subsection (c), the data
broker shall not sell or share new personal information of the
consumer unless the consumer requests otherwise or selling or
sharing the personal information is permitted.
(e) Beginning on January 1, 2029, and every 3 years
thereafter, a data broker shall undergo an audit by an

HB2913 - 8 - LRB104 10750 SPS 20829 b
independent third party to determine compliance with this
Section. The data broker shall submit a report resulting from
the audit and any related materials to the Attorney General
within 5 business days after receiving a written request from
the Attorney General. A data broker shall maintain the report
resulting from the audit for at least 6 years.
(f) The Attorney General may charge an access fee to a data
broker when the data broker accesses the accessible deletion
mechanism that does not exceed the reasonable costs of
providing that access to the accessible deletion mechanism.
Section 20. Enforcement. A violation of Section 15 of this
Act constitutes an unlawful practice under the Consumer Fraud
and Deceptive Business Practices Act. All remedies, penalties,
and authority granted to the Attorney General by the Consumer
Fraud and Deceptive Business Practices Act shall be available
to him or her for the enforcement of this Act.
Section 25. Enforcement. The Attorney General may adopt
rules to implement and administer this Act.
Section 90. The State Finance Act is amended by adding
Section 5.1030 as follows:
(30 ILCS 105/5.1030 new)
Sec. 5.1030. The Data Broker Registry Fund.

HB2913 - 9 - LRB104 10750 SPS 20829 b
Section 95. The Consumer Fraud and Deceptive Business
Practices Act is amended by adding Section 2HHHH as follows:
(815 ILCS 505/2HHHH new)
Sec. 2HHHH. Violations of the Data Broker Registration and
Accessible Deletion Mechanism Act. A person who violates
Section 15 of the Data Broker Registration and Accessible
Deletion Mechanism Act commits an unlawful practice within the
meaning of this Act.