325 ILCS 66/10: Age assurance requirements.

(This Section may contain text from a Public Act with a delayed effective date)

(a) No later than January 1, 2028, a covered manufacturer that offers an account setup feature for an Internet-enabled device shall:

(1) provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the primary user of that device for purposes of providing a signal regarding the primary user's age bracket to covered operators;

(2) upon receiving separate prior consent of the user to share the user's age bracket data with a specific covered operator, provide the covered operator with the technical ability to call a digital signal that contains the user's age bracket data by a reasonably consistent application programming interface; and

(3) send only the minimum amount of information necessary to comply with this Act and not share the digital signal information, or any information that conveys the user's age bracket data, with a third party for a purpose not required by this Act, except where legally required.

For a device on which account setup was completed before January 1, 2028, a covered manufacturer shall, before July 1, 2028, provide an accessible interface that allows an account holder to indicate the birth date, age, or both, of the primary user of that device for the purpose of providing a signal regarding the primary user's age bracket to covered operators.

(b) By July 1, 2028, a covered operator shall request from a covered manufacturer an age bracket signal for the primary user of an Internet-enabled device when the user downloads or launches a covered platform. If the signal indicates that a user is under 18, then the covered operator shall treat the signal as an authoritative indicator of the user's age bracket and the covered operator shall be deemed to have actual knowledge that a user is a covered minor only with respect to that specific device; provided, however, that a covered operator shall not willfully disregard clear and convincing information otherwise available to the covered operator that indicates a user's age is different than that indicated by the age bracket signal provided by a covered manufacturer.

(c) A covered operator that receives a signal in accordance with this Section shall not:

(1) request more information from a covered manufacturer than the minimum amount of information necessary to determine the user's age bracket;

(2) request a signal from a covered manufacturer more than once each year, unless in response to a request by the user to update the person's age bracket;

(3) use any personal data of a user collected for age assurance for any purpose except to comply with this Act or to provide age-based settings and features; or

(4) disclose the age bracket data of a user to a third party for a purpose not required by this Section.

(d) All digital signals transmitted in accordance with this Section shall be encrypted to ensure data integrity and security.

(e) A covered manufacturer that makes a good faith effort to comply with this Section, taking into consideration available technology and reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user's age bracket data or any conduct by a covered operator that receives a signal indicating a user's age bracket data.

(f) A covered manufacturer shall comply with this Act in a nondiscriminatory manner, including, but not limited to, by complying with the following:

(1) A covered manufacturer shall impose at least the same restrictions and obligations on its own websites, applications, and online services as it does on third-party websites, applications, and online services.

(2) A covered manufacturer shall not use non-publicly available data collected from a third party in the course of compliance with this Act to compete against that third party, give the covered manufacturer's services preference relative to those of a third party, or to otherwise use this non-publicly available data in a manner unavailable to that third party.

(g) This Section does not impose liability on a covered manufacturer or covered operator that arises from the use of a device or application by a person who is not the user to whom a signal pertains.