IL HB 5511
Illinois Children's Online Safety Act (HB 5511, Public Act 104-0664)
Requires covered operators of online platforms to apply protective default settings to users they know to be minors, including limits on algorithmic feeds, a 10 p.m. to 7 a.m. notification curfew and no autoplay by default on addictive social media platforms, and establishes a device-level age-bracket signal that Internet-enabled device manufacturers must provide and operators must request. Announced by the Governor as the Children's Social Media Safety Act, the title of the bill as introduced. Enforced by the Attorney General.
Jurisdiction
Illinois
Enacted
Jul 31, 2026
Effective
Jan 1, 2028
Enforcement
Illinois Attorney General
Passed both chambers unanimously in the spring 2026 session and signed by Governor JB Pritzker on July 31, 2026 as Public Act 104-0664. Effective January 1, 2028; the duty on covered operators to request a device age-bracket signal runs from July 1, 2028.
Office of Governor JB Pritzker: signing announcement for HB 5511 (July 31, 2026)Why It Matters
Pairs a device-level age-bracket signal with a mandatory operator request, a design similar to California's Digital Age Assurance Act, and relies on protective defaults rather than content restrictions. It is the first state law to make an operating-system age signal an authoritative source of actual knowledge for platform duties.
Recent Developments
Signed July 31, 2026; recorded by the Illinois General Assembly as Public Act 104-0664 in its synopsis of legislation passed both houses (report through August 7, 2026). The enacted text is the Senate Floor Amendment No. 2 version, which moved the effective date from January 1, 2027 in the introduced bill to January 1, 2028 and added the July 1, 2028 signal-request duty. Passed with unanimous support in both chambers.
At a Glance
Applies to
Harms addressed
Requires
Who Must Comply
- Covered operators of websites, online services, online applications and mobile applications offered in Illinois, including addictive social media platforms
- Covered manufacturers and operating-system providers of Internet-enabled devices with account-setup features
- Covered developers that request the age-bracket signal
Obligations fall on:
Applicability thresholds:
Safety Provisions
- Covered manufacturers with an account-setup feature on Internet-enabled devices must collect the primary user's birth date or age at setup and make an age-bracket signal available to covered developers through a reasonably consistent API, sending only the minimum information necessary and not sharing it with third parties
- By July 1, 2028, covered operators must request the age-bracket signal when a user downloads or launches a covered platform; an under-18 signal is an authoritative indicator and gives the operator actual knowledge that the user is a covered minor on that device
- Default settings for known covered minors: feeds limited to content the user requests or searches for or that is posted by creators or friends they follow, restricted profile visibility and stranger contact, shielded precise location and limits on digital currency transactions
- No notifications to covered minors between 10 p.m. and 7 a.m.
- Addictive social media platforms may not enable autoplay of media for covered minors by default
- A parent may override the default privacy settings for a minor under 16; a minor determined to be over 16 may override their own
- A covered operator of an addictive social media platform may choose not to provide services to minors under specified conditions
- Privacy protections for age-assurance data, with use limited to specified purposes
- Entities whose primary purpose is news media are excluded
Exemptions
News media exclusion
Entities whose primary purpose is news media and whose workforce is mostly engaged in news media are excluded
- • Primary purpose is news media
- • Majority of workforce engaged in news media
Compliance & Enforcement
Key Dates
Jan 1, 2028
Act takes effect: protective default settings for known covered minors, overnight notification limits and no autoplay by default on addictive social media platforms
Jul 1, 2028
Covered operators must request the age-bracket signal from the device manufacturer when a user downloads or launches a covered platform
Penalties
$50K/violation
View on map
Illinois
Focus Areas
Cite This
APA
Illinois. (2026). Illinois Children's Online Safety Act (HB 5511, Public Act 104-0664).
Related Regulations
NJ Kids Code
Codifies a New Jersey Age-Appropriate Design Code requiring covered online service providers to design services likely to be accessed by minors around minors' safety and wellbeing, including high-privacy defaults, limits on engagement-maximising design features, and data protection impact assessments. Enforced by the Attorney General with a private right of action for minors and their parents.
IL WOPR Act
Illinois law prohibiting licensed professionals from using AI systems to make independent therapeutic decisions, directly interact with clients in therapeutic communication, or detect emotions/mental states. AI limited to administrative and supplementary support with licensed professional oversight.
MA S.3164
Would create General Laws chapter 93M requiring covered operators of social media platforms to apply protective default settings to users they determine to be minors, including disabling addictive algorithmic feeds, overnight notifications, autoplay and infinite scroll, and limiting precise geolocation sharing and account visibility. The Attorney General would set age-assurance regulations and hold exclusive enforcement authority.
CA SB 867
Proposes a 4-year moratorium on the sale and manufacturing of toys with AI chatbot capabilities for children under 12. During the moratorium, a task force would develop safety standards with input from technologists, parents, and ethicists.
IL SB 315
Frontier-model AI safety law requiring large AI developers to publish and annually update catastrophic-risk frameworks, undergo independent third-party safety audits, report safety incidents to the state, and protect whistleblowers. Would be the first US law mandating independent third-party audits of frontier AI developers.
IA SF 2417
Establishes requirements and guidelines for conversational AI services including AI disclosure to minors, prohibition on sexually explicit content for minors, prevention of deceptive human-like interactions, and parental controls for children under 13.
Last updated September 6, 2026. Verify against primary sources before relying on this information.