ENCRYPT Act of 2025
- Sponsor
- Rep. Lieu, Ted [D-CA-36]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Mar 31, 2025
Bottom line
This bill establishes a federal standard for encryption policy, preventing states from enacting laws that could weaken encryption or ban encrypted products.
What it actually does
H.R. 2508, the ENCRYPT Act of 2025, preempts state and local governments from mandating or requesting that technology companies design "backdoors" into their products or services for surveillance purposes, or from requiring them to have the ability to decrypt user information. It also prevents states from prohibiting products or services solely because they use encryption.
Proponents argue
Supporters argue that a federal preemption is necessary to prevent a fragmented regulatory landscape where different states could impose conflicting or burdensome requirements on technology companies. They contend that weakening encryption, even at a state level, creates vulnerabilities that could be exploited by malicious actors globally, undermining national security and individual privacy.
Opponents contend
Opponents, typically from law enforcement, argue that such preemption could hinder their ability to investigate crimes, particularly those involving digital evidence, by preventing them from obtaining access to encrypted communications or devices under state legal processes. They might argue it prioritizes corporate interests over public safety.
The bill is very short and clear, allowing for a quick and thorough understanding of its core provisions.
Section 2(a)
Preemption of State Data Security Vulnerability Mandates and Decryption Requirements
This core provision prohibits states and their political subdivisions from requiring or requesting that manufacturers, developers, sellers, or providers of covered products or services (computer hardware, software, electronic devices, online services) design their security functions to allow surveillance or physical search by government agencies. It also prevents states from mandating that these entities have the ability to decrypt or render intelligible encrypted information from their products or services.
Supporters argue
Supporters argue this provision protects the integrity of encryption, which is vital for cybersecurity, economic security, and individual privacy. They contend that state-level mandates for backdoors would create vulnerabilities that could be exploited by criminals and foreign adversaries, making everyone less secure.
Critics contend
Critics, particularly from law enforcement, argue that this provision could create "warrant-proof" spaces, hindering legitimate investigations into serious crimes by preventing access to crucial digital evidence, even with a court order. They may argue it ties the hands of local authorities.
Tradeoffs
The provision navigates the tension between strong encryption for privacy and cybersecurity versus law enforcement's desire for access to digital evidence. It prioritizes a uniform national cybersecurity posture and individual privacy over localized law enforcement access.
Section 2(a)(2)
Prohibition on Banning Encrypted Products/Services
This provision explicitly prohibits states or political subdivisions from banning the manufacture, sale, lease, or provision to the general public of a covered product or service simply because it uses encryption or a similar security function.