Privacy · State Consumer Privacy Laws · Chicago

U.S. State Data Privacy Compliance for Chicago and Illinois Businesses

For companies that sell to, market to, or hold data about residents of other states. We determine which state consumer privacy laws reach you and build one program that satisfies them.

An Illinois company can become subject to another state’s privacy law without opening an office there. As of this writing, Congress has not enacted a general consumer privacy statute, so the rules come from sector laws such as HIPAA and from the states. A number of states have passed comprehensive consumer privacy laws that apply according to whose data you handle, not where your headquarters sits. The first question is never how to comply. It is which of these laws reach you, and that answer depends on your numbers and on the residents whose data you hold.

What the state consumer privacy laws have in common

The statutes we reviewed for this page are the Colorado Privacy Act (C.R.S. 6-1-1301 et seq.), the Virginia Consumer Data Protection Act (Va. Code 59.1-575 et seq.), the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541), the Connecticut Data Privacy Act (Conn. Gen. Stat. 42-515 et seq.), and the California Consumer Privacy Act (Cal. Civ. Code 1798.100 et seq.). Other states have laws of the same type, and we read the current text of each one before advising on it. Most follow a shared structure:

• Two roles. A controller decides why and how personal data is processed. A processor handles it on the controller’s behalf under a contract. California uses the terms business, service provider and contractor.
• Consumer rights to confirm processing and access data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and certain profiling (Va. Code 59.1-577).
• Controller duties: a privacy notice, limits on collection to what is adequate, relevant and reasonably necessary, and consent before processing sensitive data (Va. Code 59.1-578).
• Documented data protection assessments for higher-risk processing, and written contracts with every processor (Va. Code 59.1-579, 59.1-580).
• Enforcement by the state attorney general, not by private lawsuits, with California’s limited exception for certain data breaches.

Whether a law applies: thresholds and exemptions

Each statute has its own applicability test, and the tests do not match. Virginia’s act applies to persons that do business in the state or target its residents and that control or process the personal data of at least 100,000 consumers in a year, or of at least 25,000 consumers where more than 50 percent of gross revenue comes from selling personal data (Va. Code 59.1-576). The Colorado Attorney General describes that state’s act with similar thresholds. Texas does not use a consumer count. Its Attorney General describes the act as applying to companies that do business in Texas or produce goods or services consumed by its residents and that process personal data, with a general exemption for small businesses as the federal Small Business Administration defines them, except when they sell sensitive data. California adds a revenue test, which we explain on our CCPA and CPRA compliance page.

Exemptions matter as much as thresholds. Virginia exempts covered entities and business associates governed by HIPAA, financial institutions subject to the Gramm-Leach-Bliley Act, nonprofit organizations and institutions of higher education at the entity level (Va. Code 59.1-576). California exempts certain data, including protected health information under HIPAA, but not the whole business (Cal. Civ. Code 1798.145). For a healthcare practice or a management services organization, that difference decides whether marketing, website and employee data sit inside a state privacy program. Legislatures also amend these tests, so the conclusion is checked again when your numbers or the law change.

Consumer requests and the 45-day clock

The basic deadline is the same across the statutes we reviewed. In Virginia a controller must respond without undue delay and in all cases within 45 days of the request, with one 45-day extension when reasonably necessary, and must offer an appeal process and report its decision in writing within 60 days of the appeal (Va. Code 59.1-577). California sets 45 days with one 45-day extension (Cal. Civ. Code 1798.130), and the Colorado Attorney General describes a 45-day response period. A single internal procedure can satisfy all of them if it records the date of receipt, verifies the requester’s identity, locates the data in each system and with each vendor, and documents the response.

Sensitive data, targeted advertising and opt-out signals

This is where the statutes part ways. Virginia bars processing sensitive data without the consumer’s consent (Va. Code 59.1-578), and the Attorneys General of Colorado, Texas and Connecticut describe the same opt-in consent requirement in their acts. California follows a different model: the consumer may direct the business to limit its use of sensitive personal information (Cal. Civ. Code 1798.121). Notice and consent are not the same tool. A notice explains what is happening. Consent asks the consumer to make a choice, and a form designed for one state may not be enough in another.

Browser opt-out signals are the second difference. According to the Colorado Attorney General, since July 1, 2024 controllers must accept opt-out requests sent through a recognized universal opt-out mechanism, and that office recognizes the Global Privacy Control (rules at 4 CCR 904-3). The Connecticut Attorney General states that since January 1, 2025 controllers subject to the act must honor opt-out preference signals. The California Attorney General states that the Global Privacy Control must be honored as a valid request. The Virginia text we read contains no signal provision.

Data protection assessments and processor contracts

Virginia requires a documented data protection assessment for targeted advertising, the sale of personal data, certain profiling, the processing of sensitive data, and any processing that presents a heightened risk of harm. The assessment weighs the benefits against the risks to the consumer (Va. Code 59.1-580). California has its own risk assessment requirement, in effect since January 1, 2026. We prepare one assessment for each activity that covers the elements each applicable state asks for.

Vendor contracts are part of compliance. A processor contract must set out the processing instructions, the nature and purpose of the processing, the type of data and the duration, bind each person handling the data to confidentiality, require deletion or return when the service ends, make available the information the controller needs to show compliance, allow assessments, and pass the same obligations down to subcontractors (Va. Code 59.1-579). A vendor’s privacy policy does not replace those terms. What counts is whether the signed contract gives your company the rights and information it needs to answer a consumer or a regulator.

Enforcement and cure periods

In Virginia the Attorney General has exclusive authority to enforce the act, must give 30 days’ written notice identifying the provisions violated, and may seek civil penalties of up to $7,500 for each violation. The act creates no private right of action (Va. Code 59.1-584). The Texas Attorney General describes its act in the same terms: exclusive enforcement, a 30-day cure period, and civil penalties of up to $7,500 per violation. In Colorado the Attorney General and district attorneys enforce the act, and the Attorney General states that the 60-day cure period applied only through January 1, 2025. Do not assume a grace period is available, because it depends on the state and the date.

Illinois law beside the state privacy acts

As of this writing, Illinois has not enacted a comprehensive consumer privacy statute of this type. Its obligations come from specific statutes, including the Biometric Information Privacy Act (740 ILCS 14), which does allow private lawsuits, and the Personal Information Protection Act (815 ILCS 530), which governs breach notification. A multistate program for an Illinois company starts with those statutes and adds the other states’ laws. We explain them on our pages on Illinois data privacy compliance and AI governance and privacy.

How a multistate privacy engagement works

Lincoln Square Law advises Chicago and Illinois companies on state data privacy compliance. The firm’s founding attorney is licensed in Illinois and Missouri, has served as in-house general counsel and privacy officer for multi-site healthcare organizations, and holds the CIPP/US and AIGP certifications. The work follows this order:

• Data map. What personal data you collect, from whom, which states those people live in, which vendors and advertising platforms receive it, and how long it is kept.
• Written applicability analysis. Your company’s numbers compared with the current text of each statute, with the exemptions that apply to you.
• A common core. One privacy notice, one consumer request procedure, one opt-out mechanism and one set of vendor data terms, written to the most demanding requirement that applies to you.
• State differences. Sensitive data consent, assessments, appeals and opt-out signals, added only where a statute asks for something different.
• Monitoring. We tell you when a new law or an amendment changes what your company must do.

Common questions about state data privacy compliance

Can another state’s privacy law apply to a company with offices only in Illinois?

Yes. Virginia’s act, for example, reaches persons that do business in the state or target its residents and that meet its data thresholds (Va. Code 59.1-576). The location of the headquarters is not part of the test.

Do these laws exempt healthcare organizations covered by HIPAA?

It depends on the state. Virginia exempts covered entities and business associates governed by HIPAA (Va. Code 59.1-576). California exempts protected health information, but the business remains subject to the act for other personal information, such as website or employee data (Cal. Civ. Code 1798.145).

Do we need a separate privacy notice for each state?

Usually not. We recommend one notice written to the most demanding requirement that applies to you, with a short section for rights specific to one state, such as an appeal process or California’s right to limit the use of sensitive information.

Can consumers sue us under these laws?

The Virginia and Texas acts create no private right of action and are enforced by the attorney general. California allows a limited private lawsuit for certain data breaches (Cal. Civ. Code 1798.150). In Illinois, the biometric information statute does allow private lawsuits.

How often should the applicability analysis be revisited?

We recommend revisiting it once a year and whenever something material changes: a new product, an acquisition, a new advertising tool, or growth in the number of consumers in a state. We also revisit it when a legislature amends its thresholds.

Related resources

General information only; not legal advice and does not create an attorney-client relationship.