WeVote
Log In

Bill

Bill

HB 2913

Revenue and taxation; Withholding Tax Technical Amendments Act of 2025; effective date.

2025 Regular Session Introduced by Tammy Townley

Requires annual data broker registration and creates a central, free deletion mechanism so consumers can delete their info from all registered brokers with one verified request.

Second Reading referred to Rules
0
WeVote Research Nonpartisan
Bill Summary · HB 2913

Summary — HB 2913: Data Broker Registration and Accessible Deletion Mechanism Act

Note: The materials provided include two different HB 2913 texts (an Arizona higher‑education Hazlewood tuition waiver bill and an Illinois data‑broker bill). This summary focuses on the Illinois measure titled “Data Broker Registration and Accessible Deletion Mechanism Act,” which matches the bill title and the sponsor information (Rep. Daniel Didech).

Purpose

Establish state oversight and consumer control over commercial “data brokers” by (1) requiring annual registration and public disclosure of registrant information and (2) directing the Attorney General (AG) to create a central, accessible deletion mechanism that lets consumers send a single verifiable request to have their personal information deleted by all registered data brokers.

Key provisions

  • Definition

    • “Data broker” = business that knowingly collects and sells or licenses brokered personal information about individuals with whom it has no direct relationship.
    • Several exclusions (examples): consumer reporting agencies regulated by FCRA, certain telephony/directory services, entities that collect personal information only incidentally to specified platform or credit‑reporting activities.

  • Annual registration (with Attorney General)

    • Deadline: annually on or before January 31 for data brokers operating in the State.
    • Fee: amount set by the AG (not to exceed reasonable costs of establishing/administration).
    • Required disclosures include: business name and contact info, whether the broker collects minors’ data, reproductive health data, precise geolocation, a link to a non‑dark‑pattern page on the broker’s site, whether regulated by FCRA or GLBA, and any other optional explanatory info.
    • The AG must publish a public web page with the registration data.
    • Funds collected deposited into a new Data Broker Registry Fund to support administration.

  • Accessible deletion mechanism (AG responsibility)

    • Deadline: no later than January 1, 2027 to establish.
    • Must allow consumers, via a single verifiable consumer request, to request deletion of all personal information related to them from every registered data broker and associated service providers/contractors.
    • Features required:
    • Reasonable security and administrative/technical safeguards.
    • Ability for consumers to exclude selected data brokers from a deletion request.
    • Ability to modify a prior request after 45 days.
    • Multiple secure, privacy‑protecting submission methods (including an AG‑operated Internet service).
    • Free to consumers and available in languages relevant to affected consumers.
    • Mechanism for data brokers to verify and act on verifiable requests while minimizing disclosure of additional personal information.

  • Enforcement and penalties

    • Failure to register = civil penalties: $200 per day for non‑registration, payment of fees due for the delinquent period, and Attorney General’s investigation/administration expenses as the court deems appropriate.
    • AG enforcement authority to ensure compliance.

Who is affected

  • Directly: data brokers operating in the State (wide compliance, reporting, and technical integration obligations).
  • Indirectly: consumers gain privacy controls through a central deletion mechanism; organizations contracting with data brokers may see downstream effects.
  • Exemptions: entities already regulated under certain federal laws (e.g., FCRA) or limited‑scope directory/agency activities.

Timeline and procedural status (as provided)

  • Introduced: Feb 6, 2025 (Rep. Daniel Didech).
  • Early procedural steps: referred to Rules Committee and other committees (dates in Feb–Mar 2025).
  • Key statutory deadlines if enacted: annual registration by Jan 31 each year; AG must implement deletion mechanism by Jan 1, 2027.

Potential impacts and considerations

  • Consumer benefit: centralized, stronger ability to purge personal data from many brokers with a single request.
  • Administrative burden: costs and technical work for the AG to build/operate the mechanism and for brokers to respond to verifiable bulk deletion requests.
  • Compliance complexity: interplay with federal statutes (FCRA, GLBA) and carveouts will require careful legal alignment; brokers may contest scope or verification requirements.
  • Enforcement funding: registration fees and penalties fund the registry but actual operational costs and effectiveness will depend on implementation details and AG resources.

If you want, I can:
- Produce a parallel short summary of the Arizona Hazlewood tuition waiver bill that was included in the materials;
- Extract the precise list of registration fields and deletion‑mechanism technical requirements into a compliance checklist for data brokers.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.