Website privacy law by state

Website privacy law in Illinois for medical practices

No comprehensive privacy law Illinois has no comprehensive consumer privacy law in effect. That does not mean a practice website in Illinois is unregulated: the state wiretapping statute, federal rules, and the law of every state your visitors sit in all still apply.

Attorney review pending. Every statute reference on this page is reproduced from its citation and has not been reviewed by counsel for Consential. It is a description of what exists, not advice about what to do, and it is not a legal opinion about your practice.

What actually applies: the recording and interception statute

This is the statute that most often reaches a website. Session recording, chat transcripts, form-field capture and analytics that replay a visit have all been argued as interception of a communication.

Citation: 720 ILCS 5/14-6 (Eavesdropping Act)
Consent regime: All-party consent
Private lawsuits: Yes. A private party can sue.
Damages named: Injunctive relief, actual and punitive damages
Observed filing volume: High

The eavesdropping statute names no figure, but Illinois' biometric statute does — see BIPA below.

Health data law in Illinois

Biometric Information Privacy Act (BIPA)

Citation: 740 ILCS 14/20
Private lawsuits: Yes
Damages named: $1,000 per negligent violation, $5,000 per reckless or intentional violation, per individual

An August 2024 amendment limits liability to a single violation per individual regardless of how many times the same collection occurred. Reaches a practice website only where biometric identifiers are collected — face-scan consultation tools, for example — not ordinary ad pixels.

Your state is not the only one that applies

Wiretap exposure follows the visitor, not the practice. A Illinois practice whose website is read by someone sitting in an all-party-consent state can be answering to that state's statute, not this one. Twenty states also have a comprehensive consumer privacy law in effect, and those reach your visitors from Illinois wherever your servers are.

Start with California, Colorado, Connecticut, Delaware, Florida, Indiana, or see the full list of jurisdictions.

The federal floor

HIPAA applies to a covered entity in every state. Civil money penalties were last adjusted January 28, 2026; the highest tier reaches $2,190,294 per violation with an annual cap of $2,190,294 for the same requirement.

Neighbouring states

Indiana · Iowa · Kentucky · Missouri · Wisconsin

Sources

Reporters Committee for Freedom of the Press — Reporter's Recording Guide, civil suits: https://www.rcfp.org/reporters-recording-sections/civil-suits/
DarrowEverett — Tracking Pixel Litigation Expands: A State-by-State Guide to Wiretapping Risk (2026): https://darroweverett.com/pixel-litigation-trends-by-state-compliance-legal-analysis/
Davis+Gilbert — New State Privacy Laws: Alabama, Louisiana, Oklahoma, and Vermont Join the Party (2026): https://www.dglaw.com/new-state-privacy-laws-alabama-louisiana-oklahoma-and-vermont-join-the-party/

Figures last reviewed July 25, 2026.

Scan your site free Talk to us