Illinois
AI Policy Overview
Illinois lawmakers have taken a leading role in establishing artificial intelligence policies. In 2008, Illinois enacted the first-in-the-nation Biometric Information Privacy Act which established notice requirements for companies collecting biometric information from individuals and prohibited selling biometric information. More recently, in 2023 Illinois enacted two laws addressing sexual deepfakes, one of which (IL HB 2123) established a cause of actions of individuals who used their image without their consent.
Additionally, in 2023 Illinois lawmakers enacted legislation (IL HB 3563) establishing the Generative AI and Natural Language Processing Task Force with a scope that includes protecting consumer information with generative AI, the use of AI in classrooms, assessing the use of generative AI to improve public services, protecting civil liberties, the impact of generative AI on the workforce, and challenges with AI and cybersecurity. The Task Force will hold at least five public meetings leading to a report due by the end of 2024.
Deepfakes
In 2023, Illinois enacted two laws addressing sexual deepfakes. The first (IL HB 2123) established a cause of action for individuals who had their image used in a sexual deepfake without their consent. The second (IL HB 382) added the term "digitally altered sexual image" to the Illinois Nonconsensual Dissemination of Private Sexual Images Act. Illinois defines this term as any visual media, including any photograph, film, videotape digital recording, or other similar medium, that is created or substantially altered so that it would falsely appear to a reasonable person to be an authentic depiction of the appearance or conduct, or the absence of the appearance or conduct, of an individual depicted in the media.
Facial Recognition
Illinois enacted the Biometric Information Privacy Act (BIPA) in 2008 (740 ILCS 14). The definition of biometric identifiers in the law includes facial geometry in addition to fingerprints, voiceprints, and retina scans. Under Illinois’ BIPA, companies collecting biometric data from individuals (1) must publish a general notice about the company’s biometric data period; (2) must provide specific notice and obtain consent from anyone whose biometric information is collected; and (3) are prohibited from selling or trading the personal biometric information for profit.
Critically, BIPA provides a private right of action for anyone whose biometric information is violated under the law. And this has led to a flood of class action lawsuits. In 2023, the Illinois Supreme Court clarified that a company is in violation every time a biometric scan takes place, even if the same scan is repeated over time, and that claims can reach back as far as five years from the BIPA claim filing.
Legislative & Regulatory History
2023 - Illinois enacted IL HB 382, which added the term “digitally altered sexual image” to the Illinois Nonconsensual Dissemination of Private Sexual Images Act.
2023 - Illinois enacted IL HB 2123, which established a cause of action for distributing a sexual deepfake without the consent of the individual depicted.
2023 - Illinois enacted IL HB 3563, which established the Generative AI and Natural Language Processing Task Force to study and report on generative AI software.
2008 - Illinois enacted IL SB 2400, the Biometric Information Privacy Act, which established notice consent for companies that collect biometric information.