Gov. JB Pritzker signed the Children's Social Media Safety Act (HB5511) on July 31, 2026, after it passed the Illinois legislature without a single dissenting vote. The law, effective January 1, 2028, gives the Illinois Attorney General authority to seek civil penalties of up to $50,000 per violation against covered platforms — Instagram, TikTok, Snapchat, Facebook, X, Roblox and similar services — that fail to default minors into chronological feeds, disable algorithmic push notifications between 10 p.m. and 7 a.m., and lock down privacy and stranger-contact settings for under-18 users (Illinois Governor's press release).
The case for the law
The strongest argument for HB5511 is that legislators aren't inventing a problem. Platforms have themselves acknowledged, in congressional testimony and internal research made public through litigation, that engagement-optimized feeds and late-night notifications correlate with compulsive use and sleep disruption among teenagers. As bill sponsor State Sen. Willie Preston put it, "innovation and child safety are not competing interests" — a fair rebuttal to industry's default posture that any design mandate is inherently anti-innovation. A chronological-feed default and an overnight notification curfew are modest asks compared to outright access bans, and unanimous, bipartisan passage reflects a genuine cross-partisan judgment that the status quo isn't working.
Illinois also deserves credit for its verification architecture. Rather than forcing every app to collect government IDs or run facial-age-estimation scans — the model that has generated the ugliest privacy failures in this space — HB5511 requires device and operating-system makers to pass along an age-bracket signal at setup. That is a meaningfully less invasive design than per-app verification.
Illinois isn't actually first — and that undercuts the press release
The "nation-leading" framing in Springfield's announcement overstates things. Utah's App Store Accountability Act (SB 142), signed March 26, 2025, was the first state law to push age verification to the app-store layer. More directly on point, California's Digital Age Assurance Act (AB 1043) — signed October 13, 2025 and effective January 1, 2027, a full year before Illinois's law — already requires "operating system providers" to collect age information at device setup and transmit an age-bracket signal to app developers (AB 1043 text). Illinois is adopting an architecture California pioneered, not creating one. That's not a criticism of the policy — a converging technical standard across states is genuinely good for compliance costs — but it is a reason to discount the self-congratulatory rhetoric coming out of the signing ceremony.
Where HB5511 goes further, and where it gets legally exposed
The age-signal piece is the least constitutionally fraught part of the law: it's a data-plumbing requirement, not a speech restriction. The chronological-feed mandate and notification curfew are a different matter, because they dictate how a platform must sequence and surface content — precisely the kind of editorial choice the Supreme Court addressed in Moody v. NetChoice (2024). The Court held that the First Amendment protects platforms' "choices about whether — and if so how" to display content and "how the display will be ordered and organized," and that algorithmic automation doesn't strip that protection away (DWT summary of the ruling).
That doctrine has already cost other states in court. A federal judge blocked Nebraska's LB 383 age-verification and parental-consent provisions on June 28, 2026, calling them a "content-based restriction" that fails First Amendment scrutiny (NetChoice v. Hilgers summary). A Virginia injunction against that state's age-and-time-limit law was upheld on similar grounds in March 2026, and Mississippi's law remains tied up in NetChoice v. Fitch on appeal. None of those laws mandated feed architecture as explicitly as HB5511 does — which means Illinois's law, however well-intentioned, hands NetChoice a cleaner target than the laws that have already lost.
The proportionate path
The Taxpayers Protection Alliance's objection that HB5511 is "a step toward age verification and allowing the government to police speech" overstates the age-signal piece but correctly flags the feed mandate. The Electronic Frontier Foundation's broader point is also worth taking seriously: age-assurance infrastructure of any kind creates a new surveillance layer, and more than 400 security researchers called for a moratorium on age-check mandates in March 2026 pending independent evaluation of these systems' privacy risks (EFF 2025 year in review).
Illinois would strengthen its own law, not weaken it, by writing an explicit severability clause isolating the device-signal and privacy-default provisions — which are likely to survive challenge — from the chronological-feed and notification mandates, which are not. Lawmakers in the roughly three dozen states now drafting similar bills should copy the California/Illinois age-signal model and its stranger-contact defaults. They should leave algorithmic sequencing to platforms' own risk calculus, or invite the same injunction that has already met bolder — and more legally exposed — versions of this law elsewhere.