Bill Text: IL SB3603 | 2025-2026 | 104th General Assembly | Introduced

---

Bill Title: Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that a consumer may opt out of the processing of personal data for the purpose of targeted advertising by submitting a request using the methods specified in a data processing controller's privacy notice. Sets forth the requirements of a controller's privacy notice. Provides that, if a controller processes personal data for purposes of targeted advertising or sells personal data to third parties for targeted advertising, the controller shall disclose the processing or sale in a privacy notice and provide access to a clear and conspicuous method outside the privacy notice for a consumer to opt out of the processing or sale. Makes other changes. Effective January 1, 2028.

Sponsorship: Partisan Bill (Democrat 1)

Status: (Introduced - Dead) 2026-05-22 - Rule 3-9(a) / Re-referred to Assignments [SB3603 Detail]

Download: Illinois-2025-SB3603-Introduced.html

---

104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026SB3603 Introduced 2/5/2026, by Sen. Steve Stadelman SYNOPSIS AS INTRODUCED:
815 ILCS 505/2MMMM new
Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that a consumer may opt out of the processing of personal data for the purpose of targeted advertising by submitting a request using the methods specified in a data processing controller's privacy notice. Sets forth the requirements of a controller's privacy notice. Provides that, if a controller processes personal data for purposes of targeted advertising or sells personal data to third parties for targeted advertising, the controller shall disclose the processing or sale in a privacy notice and provide access to a clear and conspicuous method outside the privacy notice for a consumer to opt out of the processing or sale. Makes other changes. Effective January 1, 2028.
LRB104 19802 SPS 33252 b
A BILL FOR
SB3603 LRB104 19802 SPS 33252 b
AN ACT concerning business.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 5. The Consumer Fraud and Deceptive Business
Practices Act is amended by adding Section 2MMMM as follows:
(815 ILCS 505/2MMMM new)
Sec. 2MMMM. Data processing.
(a) Definitions. As used in this Section:
"Controller" means the natural or legal person who, alone
or jointly with others, determines the purposes and means of
the processing of personal data.
"Deidentified data" means data that cannot reasonably be
used to infer information about, or otherwise be linked to, an
identified or identifiable individual, or a device linked to
such an individual.
"Identified or identifiable individual" means a natural
person who can be readily identified, directly or indirectly,
based on personal data.
"Personal data" means any information that is linked or
reasonably linkable to an identified or identifiable
individual. "Personal data" does not include deidentified data
or publicly available information.
"Process" means any operation or set of operations

SB3603 - 2 - LRB104 19802 SPS 33252 b
performed, whether by manual or automated means, on personal
data or on sets of personal data, including, but not limited
to, the collection, use, storage, disclosure, analysis,
deletion, or modification of personal data.
"Processor" means a natural or legal person who processes
personal data on behalf of a controller.
"Targeted advertising" means displaying advertisements to
a consumer where the advertisement is selected based on
personal data obtained or inferred from that consumer's
activities over time and across nonaffiliated websites or
online applications to predict the consumer's preferences or
interests. "Targeted advertising" does not include:
(1) advertising based on activities within a
controller's own websites or online applications;
(2) advertising based on the context of a consumer's
current search query or visit to a website or online
application;
(3) advertising directed to a consumer in response to
the consumer's request for information or feedback; or
(4) processing personal data solely for measuring or
reporting advertising performance, reach, or frequency.
(b) A consumer may opt out of the processing of personal
data for the purpose of targeted advertising by submitting a
request using the methods specified in the controller's
privacy notice. A consumer may submit a request to a
controller under this subsection at any time.

SB3603 - 3 - LRB104 19802 SPS 33252 b
(c) A controller that processes personal data for purposes
of targeted advertising shall provide a clear and conspicuous
method for a consumer to opt out of the processing of personal
data for the purpose of targeted advertising. A controller
shall establish one or more secure and reliable means for
consumers to submit a request to opt out of the processing of
personal data for the purpose of targeted advertising, taking
into account the ways in which consumers normally interact
with the controller, the need for secure and reliable
communication of the requests, and the ability of the
controller to verify the identity of the consumer making the
request.
(d) A consumer may authorize another person, acting on the
consumer's behalf, to opt out of the processing of the
consumer's personal data for purposes of targeted advertising.
A consumer may designate an authorized agent through a
technology, including, but not limited to, an Internet link or
a browser setting, browser extension, or global device
setting, indicating the consumer's intent to opt out of the
processing.
A controller shall comply with an opt-out request received
from a person authorized by the consumer to act on the
consumer's behalf if the controller is able to authenticate,
with commercially reasonable effort, the identity of the
consumer and the authorized agent's authority to act on the
consumer's behalf.

SB3603 - 4 - LRB104 19802 SPS 33252 b
(e) If a controller is processing personal data for
purposes of targeted advertising of a known child, the parent
or legal guardian may opt the child out of the processing of
personal data for the purpose of targeted advertising. If a
controller is processing the personal data for purposes of
targeted advertising of a consumer subject to a guardianship,
conservatorship, or other protective arrangement, the guardian
or the conservator of the consumer may opt the consumer out of
the processing of personal data for the purpose of targeted
advertising.
(f) A controller shall allow consumers to exercise the
right to opt out of the processing of personal data for
purposes of targeted advertising through a user-selected,
universal opt-out mechanism, including by an opt-out
preference signal sent, with the consumer's consent, by a
platform, technology, or mechanism to the controller
indicating the consumer's intent to opt out of the processing.
(g) If a controller processes personal data for purposes
of targeted advertising or sells personal data to third
parties for targeted advertising, the controller shall
disclose the processing or sale in a privacy notice and
provide access to a clear and conspicuous method outside the
privacy notice for a consumer to opt out of the sale or
processing. This method may include, but is not limited to, an
Internet hyperlink clearly labeled "Your Opt-Out Rights" or
"Your Privacy Rights" that directly effectuates the opt-out

SB3603 - 5 - LRB104 19802 SPS 33252 b
request or takes consumers to a web page where the consumer can
make the opt-out request.
The privacy notice shall be posted online through a
conspicuous hyperlink using the word "privacy" on the
controller's website home page or on a mobile application's
store page or download page. A controller that maintains an
application on a mobile or other device shall also include a
hyperlink to the privacy notice in the application's settings
menu or in a similarly conspicuous and accessible location. A
controller that does not operate a website shall make the
privacy notice conspicuously available to consumers through a
medium regularly used by the controller to interact with
consumers.
(h) This Section applies to legal entities that conduct
business in this State or produce products or services that
are targeted to residents of this State, and that:
(1) during a calendar year, control or process
personal data of 100,000 consumers or more, excluding
personal data controlled or processed solely for the
purpose of completing a payment transaction; or
(2) derive over 25% of gross revenue from the sale of
personal data and process or control personal data of
25,000 consumers or more.
(i) A violation of this Section constitutes an unlawful
practice within the meaning of this Act.
Section 99. Effective date. This Act takes effect January

SB3603 - 6 - LRB104 19802 SPS 33252 b
1, 2028.