Illinois Privacy Policy
Illinois has not enacted a comprehensive privacy law as of November 2026. A privacy policy that reaches Illinois residents still has to account for the Biometric Information Privacy Act, the Personal Information Protection Act and the Consumer Fraud and Deceptive Business Practices Act. Of the three, the biometric statute carries a private right of action with liquidated damages.
What Illinois law does to this document
No comprehensive privacy law yet
Senate Bill 340, as amended in the Senate, would create an Illinois Consumer Data Privacy Act. The Senate passed it 54 to 3 on May 21, 2026. The House re-referred it to the Rules Committee on May 31, 2026, and it has not become law.
Senate Bill 340, 104th General Assembly (not enacted)Biometric data needs its own public policy
A private entity that holds biometric identifiers or biometric information must have a written policy, available to the public, with a retention schedule and destruction guidelines. The data must be destroyed when the purpose for collecting it has been satisfied or within 3 years of the individual's last interaction with the entity, whichever comes first.
740 ILCS 14/15(a)Notice and a written release before collection
Before collecting a biometric identifier, a private entity must inform the person in writing that it is being collected or stored and state the specific purpose and length of time. It must also receive a written release, which since August 2, 2024 may be an electronic signature. The entity may not sell, lease or trade the data, or otherwise profit from it.
740 ILCS 14/10 and 14/15(b) and (c)Damages under the biometric statute
An aggrieved person may sue and recover liquidated damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys' fees. Under a 2024 amendment, repeated collection of the same identifier from the same person by the same method is a single violation with at most one recovery.
740 ILCS 14/20Breach notice and reasonable security
A data collector that owns or licenses personal information about an Illinois resident must notify the resident of a security breach in the most expedient time possible and without unreasonable delay. If more than 500 Illinois residents must be notified, the collector must also notify the Attorney General. The Act requires reasonable security measures, and a violation is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.
815 ILCS 530/10, 530/20 and 530/45A policy that misstates practices
The Consumer Fraud and Deceptive Business Practices Act makes deceptive acts in trade or commerce unlawful, including misrepresentation or the omission of a material fact with intent that others rely on it. Courts construing the section are directed to consider Federal Trade Commission and federal court interpretations of Section 5(a) of the FTC Act. A privacy policy is a public statement of practice, so it should describe what the business does in fact.
815 ILCS 505/2Where people go wrong in Illinois
- Treating the website privacy policy, or the generator's optional Illinois biometric notice, as full compliance, when the biometric statute calls for a public retention schedule and a written release obtained before collection, neither of which the generator produces.
- Reading the absence of an Illinois comprehensive privacy law as the absence of Illinois obligations, despite the breach, security and biometric statutes already in force.
- Describing security or sharing practices the business does not follow, which turns the policy into a possible deceptive practice.
How the generator works
A single privacy policy that covers the ~20-state U.S. privacy patchwork, adds CCPA/CPRA specifics, and can extend to EU/UK visitors. Answer a short interview and the draft assembles as you go, with Illinois already set as the governing state. Download it as PDF or Word. No fee. No account.