Illinois has no comprehensive consumer privacy law in 2026, so you opt out of data brokers site by site. What Illinois does give you is BIPA — the only state biometric law with a private right of action — plus PIPA and the Right to Know Act. Start with the national people-search sites, then use BIPA for biometric data.
Does Illinois Have a Data Privacy Law in 2026?
Not a comprehensive one. As of October 2026, Illinois has not enacted a broad consumer data privacy law comparable to California's CCPA. That means there is no Illinois statute giving you a blanket right to access, correct, delete, or port your personal data, and no state-law right to opt out of its sale.
What Illinois does have is a set of narrower laws that are unusually powerful in their own lanes:
- Biometric Information Privacy Act (BIPA) — the most aggressive biometric privacy law in the country, and the only one with a private right of action. You can sue a company directly for mishandling your fingerprints, face scans, voiceprints, or iris scans without waiting on the Attorney General.
- Personal Information Protection Act (PIPA) — requires businesses to notify you after certain breaches and to take reasonable steps to protect personal information.
- Right to Know Act — requires covered entities to disclose what categories of personal information they collect and who they share it with.
Bills to Watch (None Enacted Yet)
- SB 2875 — introduced January 16, 2026 by Sen. Laura Murphy, this is the main comprehensive-privacy vehicle. It would apply to businesses meeting volume thresholds in Illinois. Its most recent action was a re-referral to Assignments, which in practice means stalled.
- SB 3890 — would require data brokers operating in Illinois to register annually with the Attorney General by January 31 and would create a public deletion mechanism covering every registered broker, similar in spirit to California's DROP. Not enacted.
- SB 3548 — would establish a Consumer Privacy Fund administered by the Attorney General.
- HB 5221 — would preempt home-rule local regulation of data privacy.
No State Law Does Not Mean No Leverage
Almost every major data broker runs a single nationwide opt-out process, because maintaining separate workflows for California, Colorado, Texas and Connecticut residents costs more than honoring everyone. Illinoisans in practice get the benefit of laws Springfield never passed. The difference is enforcement: if a broker ignores you, Illinois has no comprehensive privacy statute to fine them under.
Step 1: Find Out Which Brokers Have Your Data
Search your full name with your city attached — "Jane Doe Chicago," "Jane Doe Naperville IL" — on Google, Bing, and DuckDuckGo. Screenshot every result that shows your information and keep a running list with the exact profile URLs. You will need those URLs for most opt-out forms. Brokers that commonly list Illinois residents include:
- Spokeo
- BeenVerified
- Whitepages
- Radaris
- Intelius
- TruePeopleSearch
- FastPeopleSearch
- PeopleFinders
- MyLife
- USPhoneBook
- Nuwber
- CyberBackgroundChecks
One Request Can Clear Four Sites
Intelius, US Search, TruthFinder, and Instant Checkmate are all PeopleConnect properties sharing a single suppression portal at suppression.peopleconnect.us. Filing once there covers all four — the highest-value ten minutes on this entire list.
Step 2: Submit Opt-Out Requests Site by Site
Every broker runs its own process, and the friction is deliberate. For each site on your list:
- Find your listing and copy the exact profile URL
- Locate the opt-out page — usually a footer link reading "Do Not Sell My Info," "Opt Out," or buried in the privacy policy
- Submit only what the form requires — never volunteer extra identifiers to a company whose business is publishing them
- Complete verification — most brokers send a confirmation email you must click; some place an automated call
- Wait the stated window — typically 7 to 45 days
- Re-check and screenshot the result so you have evidence if you need to escalate
Use a Disposable Email
Use a privacy alias — SimpleLogin, Firefox Relay, or Apple's Hide My Email — not your primary inbox. Brokers have been known to add opt-out contact details to fresh marketing files, which is precisely the outcome you were trying to avoid.
Step 3: Use BIPA for Biometric Data
If a company collected your fingerprints, face geometry, voiceprint, or iris scan without informed written consent, BIPA is the strongest tool any American consumer has:
- Demand disclosure of what biometric identifiers they hold and their written retention schedule — BIPA requires covered entities to publish one
- Demand destruction — biometric data must be permanently destroyed when the collection purpose is satisfied or within three years of your last interaction, whichever comes first
- Sue directly if they refuse. Statutory damages run $1,000 per negligent violation and $5,000 per intentional or reckless violation
Two 2026 developments matter. A 2024 amendment narrowed exposure so that repeated collection of the same identifier from the same person by the same method counts as a single violation rather than one per scan. Then in April 2026, the Seventh Circuit held in Clay v. Union Pacific that the amendment is remedial, meaning it applies to cases already pending in federal court. Core duties did not change: written notice, written consent, a published retention policy, and an absolute bar on selling biometric data.
Step 4: Cut Off the Public-Records Supply
Brokers rebuild your profile from public records, so reducing supply slows re-listing:
- Property records: Illinois county recorder and assessor sites publish ownership and address. Holding property through a trust or LLC can keep your personal name off new filings — talk to an attorney first.
- Court records: Illinois courts can seal or impound certain records, and survivors of domestic violence or stalking have specific protections worth asking about.
- Voter registration: Illinois treats most voter data as public. Contact your county clerk or election authority to confirm which fields are released and whether any confidential designation fits your circumstances.
- Professional licenses: IDFPR and other boards publish licensee records. Ask to substitute a business address for your home address.
Step 5: Escalate When a Broker Ignores You
- Illinois Attorney General Consumer Fraud Bureau — file at illinoisattorneygeneral.gov. Without a comprehensive privacy law, the hook is the Consumer Fraud and Deceptive Business Practices Act, which still applies when a broker promises a removal process and does not honor it.
- Federal Trade Commission — report at reportfraud.ftc.gov.
- Consumer Financial Protection Bureau — if the broker functions as a consumer reporting agency, file at consumerfinance.gov.
- Private BIPA suit — for biometric violations, consult an Illinois plaintiffs' attorney. BIPA cases are routinely taken on contingency.
The California DROP Angle
California's Delete Request and Opt-out Platform lets a resident file one request that every registered broker must honor — brokers became required to begin responding to DROP deletion requests on August 1, 2026. It is for California residents, so it is not an Illinois tool. But if you have a genuine California connection, such as a current or former California address on file, it is worth checking your eligibility. Illinois' SB 3890 would build something similar here; it has not passed.
Remove yourself from Data Brokers in Illinois — and 100+ sites like it
One opt-out won't stop them — brokers relist your data within months. PrivacyOn removes your info everywhere and keeps it removed.
Start your free scan★★★★★ 4.8/5 · Trusted by thousands of families
The Faster Alternative: Automate the Whole Cycle
Working through every broker by hand takes 40 to 80 hours up front, and it is not a one-time job. Brokers re-import public records continuously, so listings reappear within three to six months and the cycle restarts. Very few people sustain that.
PrivacyOn handles it end to end: we submit opt-out requests across 100+ data brokers and people-search sites, monitor 24/7 for re-listings, and resubmit the moment your data reappears — which is the part manual opt-outs almost always fail at. Plans start at $8.33/month, include dark web breach monitoring, and cover up to 5 family members on one subscription. Run a free scan to see which sites are exposing you right now.
Related guides
- Privacy Laws in Illinois: What You Need to Know in 2026
- How to Opt Out of Data Brokers in Maryland
- The Best Data Removal Services in 2026
Frequently Asked Questions
Does Illinois have a data privacy law in 2026?
Not a comprehensive one. Illinois has no CCPA-style statute granting broad access, deletion, or opt-out rights, and the main 2026 vehicle, SB 2875, stalled after being re-referred to Assignments. What Illinois does have is BIPA for biometric data, PIPA for breach notification, and the Right to Know Act for disclosure.
Can Illinois residents opt out of data brokers without a state privacy law?
Yes. Nearly every major broker operates one nationwide opt-out process rather than checking your state, so an Illinois request is typically honored the same as a Californian's. The practical difference is enforcement: if a broker refuses, Illinois has no comprehensive privacy statute to penalize them under, though the Attorney General can still act on deceptive business practices.
How much can I recover under BIPA?
BIPA provides statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorney's fees. A 2024 amendment counts repeated collection of the same identifier by the same method as a single violation, and the Seventh Circuit held in Clay v. Union Pacific in April 2026 that the amendment applies to pending federal cases.
Is there an Illinois data broker registry or one-click deletion portal?
No. SB 3890 would require data brokers to register annually with the Illinois Attorney General and would create a public deletion mechanism across all registered brokers, but it has not been enacted. Until it is, Illinoisans file with each broker individually or use an automated service.
How long does it take to remove yourself from data brokers in Illinois?
Individual removals take 24 hours to 45 days depending on the site. Covering the major brokers by hand realistically takes 40 to 80 hours spread over several weeks, and the cycle has to be repeated every three to six months because brokers re-import public records and relist you.
What is the easiest way for an Illinois resident to get removed from data brokers?
Use an automated service — PrivacyOn is our recommendation. It files removals across 100+ brokers and people-search sites, monitors continuously, and resubmits automatically when your data comes back. Plans start at $8.33/month with dark web monitoring and coverage for up to 5 family members. Start with a free scan.