States lose power to require encryption backdoors under new federal preemption
H.R. 2508 — ENCRYPT Act of 2025 · Filed by Ted Lieu (D-CA) · 1 cosponsor · Introduced Mar 31, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill prevents states and localities from requiring tech companies to weaken encryption, create backdoors for government surveillance, or decrypt user data. It also bars states from banning encrypted products. The bill preempts state law entirely—states cannot mandate surveillance capabilities or decryption access, and cannot prohibit the sale of encrypted products.
Why we flagged it
The bill's core function is to strip states of authority to regulate encryption and mandate backdoors, centralizing encryption policy at the federal level and protecting tech companies from fragmented state-by-state security requirements.
What the text implies
- Preempts state consumer-protection laws that might require disclosure of encryption weaknesses or security vulnerabilities, potentially limiting state-level transparency mandates.
- Prevents states from imposing encryption standards as a condition of doing business within their borders, eliminating a regulatory tool for state attorneys general.
- Creates a federal floor for encryption policy but does not establish affirmative federal encryption standards—states cannot go stronger, but federal government may not mandate anything either.
- May conflict with state law-enforcement requests for device access in criminal investigations, as states cannot require backdoors but federal law-enforcement may still seek them through other means.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Citizens retain access to strong encryption and are shielded from state-mandated backdoors that would weaken their privacy protections. However, this also prevents states from imposing their own security standards, which some may view as a loss of local democratic control over data security policy.
Who stands to gain
- technology companies and software developers (freed from state-by-state encryption compliance costs)
- online service providers (protected from state decryption mandates)
Named in the bill
States and political subdivisions, Technology manufacturers and developers, Online service providers, Federal government, State law enforcement
Where it stands
1 cosponsor: 1 Democrats.
- Mar 31, 2025 — Introduced · Congress.gov: “Introduced in House”
- Mar 31, 2025 — Referred to House Committee on Energy and Commerce and House Committee on the Judiciary · Congress.gov: “Referred to the Committee on the Judiciary, and in addition to the Committee on Energy and Commerce, for a…”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (1,978 characters) on Oct 26, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,580 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-26.
“States lose power to require encryption backdoors under new federal preemption” QuorumCivic. https://share.quorumcivic.app/bill/119/hr2508 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.