Illinois · verified through August 25, 2026

Illinois: law status and evidence context.

Law status, direct attached-library attribution, and public enforcement context are shown separately. A zero direct total does not mean no enforcement exists.

IL · 6 requirements mapped / control outcomes supported

Law status

No verified general comprehensive law

No comprehensive consumer privacy law verified (SB 340/SB 52 were bills). Illinois' Biometric Information Privacy Act was not fetched in this session.

Official name / citation
n.a.
Status / effective date
Bills only
Principal enforcer
Illinois Attorney General

Direct attached-library attribution

0 cases · $0

These totals are assigned solely by the attachment’s state heading. Shared multistate totals are not allocated in full to every state.

The attached library does not enumerate participant-level allocations for every multistate matter; shared settlement totals are presented once at the national level and are not duplicated into state totals.

Official law sources

Other generally applicable PII law

Personal Information Protection Act, 815 ILCS 530 - https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67

Public enforcement context

Tier 1

Blackbaud, Inc.

$49.5 million to the states; Illinois share stated as $2.28 million · October 5, 2023

Illinois joined the 50-jurisdiction Blackbaud settlement; the AG page enumerates all participants.

Legal basis: State consumer protection laws, breach-notification laws and HIPAA

Official case source (opens in a new tab)

Mapped control outcomes

1 personal data inventory/data map; 2 sensitive-data discovery; 3 downstream copy tracking; 8 breach blast-radius analysis; 9 retention/minimization; 10 regulator audit evidence

Kestryl can evidence where regulated personal data actually resides across structured stores and unstructured attachments/images, produce audit rows and evidence packs showing when each location was discovered and reviewed, and apply structured-data remediation modes (mask, vault, strip) to reduce exposure. It does not alter source attachments or documents, and its output is technical evidence supporting controls, not proof of legal compliance.