119-hr2508

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 2508 Introduced in House

    (IH) ]

<DOC>

119th CONGRESS
 1st Session
 H. R. 2508

 To preempt State data security vulnerability mandates and decryption 
 requirements.

_______________________________________________________________________

 IN THE HOUSE OF REPRESENTATIVES

 March 31, 2025

 Mr. Lieu (for himself and Ms. DelBene) introduced the following bill; 
 which was referred to the Committee on the Judiciary, and in addition 
 to the Committee on Energy and Commerce, for a period to be 
subsequently determined by the Speaker, in each case for consideration 
 of such provisions as fall within the jurisdiction of the committee 
 concerned

_______________________________________________________________________

 A BILL

 To preempt State data security vulnerability mandates and decryption 
 requirements.

 Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

 This Act may be cited as the ``Ensuring National Constitutional 
Rights for Your Private Telecommunications Act of 2025'' or the 
``ENCRYPT Act of 2025''.

SEC. 2. PREEMPTION OF STATE DATA SECURITY VULNERABILITY MANDATES AND 
 DECRYPTION REQUIREMENTS.

    (a) In General.--A State or political subdivision of a State may 
not--

    (1) mandate or request that a manufacturer, developer, 
 seller, or provider of covered products or services--
        (A) design or alter the security functions in its 
 product or service to allow the surveillance of any 
 user of such product or service, or to allow the 
 physical search of such product, by any agency or 
 instrumentality of a State, a political subdivision of 
 a State, or the United States; or
        (B) have the ability to decrypt or otherwise render 
 intelligible information that is encrypted or otherwise 
 rendered unintelligible using its product or service; 
 or

    (2) prohibit the manufacture, sale or lease, offering for 
 sale or lease, or provision to the general public of a covered 
 product or service because such product or service uses 
 encryption or a similar security function.

    (b) 

=== Definitions. ===
-In this section:

    (1) Covered product or service.--The term ``covered product 
 or service'' means any computer hardware, computer software, 
 electronic device, or online service that--
        (A) has traveled in interstate or foreign commerce 
 or otherwise affects interstate or foreign commerce; 
 and
        (B) is made available to the general public.

    (2) Online service.--The term ``online service'' means a 
 service provided over the internet that makes available to 
 users--
        (A) the ability to send or receive communications, 
 such as emails, text messages, photos, and audio and 
 video communications;
        (B) the ability to share data files with other 
 users; or
            (C) remote computer processing or storage.

    (3) State.--The term ``State'' means each of the several 
 States, the District of Columbia, each commonwealth, territory, 
 or possession of the United States, and each federally 
 recognized Indian Tribe.
 <all>