HB 3385
DATA PRIVACY AND PROTECTION
TL;DR
Illinois Rep. Abdelnasser Rashid introduced HB 3385, a broad data privacy and protection bill currently stalled in the Rules Committee. While the full text details aren't available, the bill appears to establish consumer data privacy rights similar to laws in California and other states, which would directly affect how businesses collect, store, and use personal data including data fed into AI systems.
How This Might Impact Your Business
Companies collecting personal data from Illinois residents would likely face new disclosure and consent requirements, similar to California's CCPA framework.
Businesses using AI systems trained on consumer data (marketing platforms, recommendation engines, customer analytics) would need to document data sources and provide opt-out mechanisms.
Retailers, financial services firms, healthcare providers, and ad-tech companies operating in Illinois face the highest exposure given their heavy reliance on personal data.
Bill is currently stuck in the Rules Committee (re-referred under Rule 19(a)), meaning it has stalled and is unlikely to advance in its current form without sponsor action.
No specific penalties, thresholds, or effective dates are confirmed in available details; businesses should monitor for substitute language if the bill is revived.
Illinois already has aggressive privacy enforcement under BIPA, so any new privacy law could compound existing litigation risk for companies using biometric or AI-driven identification.
Small businesses may or may not be exempt depending on revenue thresholds typically built into similar state privacy laws (often $25M revenue or 100K consumer records).
What Should You Do
Ask your legal and compliance teams to map what personal data your company collects from Illinois residents and how it flows into AI or analytics tools.
Track HB 3385's status monthly; bills stuck in Rules Committee can be revived with substitute amendments, so watch for new language.
If you do not already comply with CCPA or similar state privacy laws, start building a baseline privacy program now since Illinois is likely to pass something similar within the next two sessions.
Review vendor contracts with AI and data analytics providers to confirm they can support data subject access requests and deletion rights.
Coordinate Illinois privacy compliance planning with your existing BIPA compliance program to avoid duplicate workstreams.
Who It Affects
Sponsors
Status Timeline
committee
Rule 19(a) / Re-referred to Rules Committee
April 5, 2024