Illinois Passes a Frontier AI Law, Plus On-Device Age Checks (07/18/2026)

Illinois just told the largest AI companies they will answer to an outside auditor, which is a rare case of a rule arriving with teeth before the harm does. The rest of today is about the quieter negotiations over your face and your voice: an age-check method that promises to keep your biometrics on your own phone, a face-scanning lock people are starting to like, and a meeting culture where recording is the default and opting out is the hack. The question underneath all of it is who holds the sensor, and who they answer to.

Top 5 Critical Privacy Alerts

1. Illinois Enacts a Frontier AI Safety Law

Governor Pritzker signed the Artificial Intelligence Safety Measures Act (SB 315), making Illinois the third state to set rules for frontier AI models, after New York’s RAISE Act and California’s SB 53 (PogoWasRight, Capitol News Illinois). The law targets developers of the largest models, those above $500 million in revenue trained on massive compute, and from 2028 it requires them to hire outside auditors to check their safety work every year, the first such mandate in the country. It also protects employees who speak up about unsafe AI.

Operator Note: Three states now cover roughly 40% of the US AI market, which makes this a de facto national standard. If you build or deploy large models, the annual independent audit is the obligation to start preparing for now, not in 2028.

2. On-Device Age Verification Keeps Your Face on Your Phone

As age verification laws spread, vendors are pitching on-device age estimation that checks a user’s age locally so the biometric never leaves the device (BleepingComputer). Most age verification schemes solve a law by creating a new database of faces and IDs for someone to lose. Doing the check on the phone and keeping the raw biometric there is the version that actually respects the person, and it is worth holding up as the bar the others should meet.

3. Facial Recognition Smart Locks Are Getting Good

Reviewers are now calling facial recognition smart locks genuinely good, with the door unlocking as you walk up to it (The Verge). Convenience is how surveillance technology gets in the door, literally here. A face scanner people like is a face scanner people stop noticing, and the habit of pointing a camera at every face at every threshold is the thing that outlives the novelty.

4. Ambient Recording Makes Opting Out the Hard Part

The spread of automatic meeting transcription has reached the point where people are hunting for ways to signal “don’t record me,” because recording has quietly become the default (TechCrunch). When a conversation is captured, transcribed, and summarized by default, the burden has flipped, and the person who wants a moment off the record now has to do the work to get it. That default is a design choice, and it is worth asking who chose it.

5. Illinois Draws a Line at Catastrophic Risk

Inside SB 315, Illinois defines a catastrophic AI risk as an incident that could cause more than 50 deaths or serious injuries, or over $1 billion in damage (Capitol News Illinois). Putting a number on catastrophe is how you move a debate out of vibes and into obligations, and whatever you think of the threshold, it forces the companies to plan against a defined line rather than a feeling.

Additional Privacy Alerts

Data Minimization & User Consent

• Universities Scramble to Police AI in Exams: An academic accused the Australian National University of a “hysterical” response to students using AI, as institutions rush to surveil and secure assessments rather than redesign them. The Guardian

Privacy Laws & Regulations

• CJEU Clarifies Streaming Withdrawal Rights: The Court of Justice of the European Union ruled on when a streaming subscription counts as digital content subject to the consumer right of withdrawal. Inside Privacy

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.