ENCRYPT Act of 2025

The ENCRYPT Act of 2025 would bar states and their subdivisions from imposing requirements that would weaken encryption or enable surveillance through backdoors. Specifically, it prohibits states from mandating or pressuring manufacturers, developers, sellers, or providers to design, alter, or enable security features that allow surveillance or the physical search of a product, or to decrypt information, and it also blocks states from prohibiting the sale or provision of encrypted products or services. The goal is to create a uniform national standard that protects encryption and user privacy by preventing state-level security vulnerabilities mandates or decryption requirements. To define its scope, the bill uses broad definitions: a “covered product or service” includes any hardware, software, electronic device, or online service that travels in interstate commerce and is publicly available; an “online service” covers services over the internet that let users send/receive communications, share data, or use remote processing/storage. The act also expressly covers states, the District of Columbia, territories, possessions, and federally recognized Indian Tribes. In short, it would preempt state laws that attempt to impose encryption backdoors or force decryption, aiming to ensure nationwide consistency in encryption policy.