HB4538 104TH GENERAL ASSEMBLY

LRB104 17029 SPS 30444 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
HB4538

Introduced 1/30/2026, by Rep. Rita Mayfield

SYNOPSIS AS INTRODUCED:

New Act
815 ILCS 505/2MMMMM new

Creates the Identity Verification for Consumer Services Act. Requires an entity that provides specified services to use identity verification to verify a person's identity before initiating or modifying an agreement to provide the service. Provides that an entity that provides a specified service that becomes aware of an attempted or confirmed identity theft through its compliance with the Act shall report the attempted or confirmed identity theft to the Attorney General. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Limits home rule. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Identity Verification for Consumer Services Act.

Section 5. Purpose. The purpose of this Act is to protect Illinois residents from identity theft by establishing mandatory identity verification standards before allowing the issuance of services that involve personal identifying information, including credit services, telecommunications, utilities, online platforms, healthcare access, and government benefit systems.

Section 10. Definitions. As used in this Act:

"Covered service" means any utility, telecommunications, mobile account, credit account, online financial account, government benefit, health insurance, or other service that uses personal identifying information to authorize access or extend service. "Covered service" includes any service that involves a high-risk transaction.

"High-risk transaction" means any transaction involving the transfer of funds, issuance of credit, remote access to financial records, or any service activation that may expose sensitive personal data.

"Identity theft" means the unauthorized acquisition and use of personal identifying information to fraudulently obtain credit, benefits, or services.

"Identity verification" means the process of verifying a person's identity using a valid, government-issued photo identification and one additional form of authentication, including:

(1) proof of address, such as a recent utility bill, bank statement, or rental lease;

(2) biometric data, such as a fingerprint or facial scan;

(3) secure digital verification through multi-factor authentication; or

(4) knowledge-based authentication.

"Personal identifying information" includes, but is not limited to, full name, date of birth, social security number, driver's license or State identification card number, passport number, biometric identifiers, physical address, email address, telephone number, financial account numbers, insurance policy numbers, and medical or health-related information.

Section 15. Identity verification requirements. An entity that provides a covered service shall use identity verification to verify a person's identity before initiating or modifying an agreement to provide the covered service.

Section 20. Reporting requirements. An entity that provides a covered service that becomes aware of an attempted or confirmed identity theft through its compliance with this Act shall report the attempted or confirmed identity theft to the Attorney General no later than 10 business days after the entity becomes aware of the attempted or confirmed identity theft.

Section 25. Recordkeeping. An entity that provides a covered service shall securely retain all records collected under the identity verification process required under Section 15 for at least 3 years after the identity verification.

Section 30. Exemptions. The following are exempt from the requirements of this Act:

(1) services exclusively performed using in-person physical identification checks;

(2) services for individuals under the age of 13 with verified parental consent, as required under State and federal law; and

(3) entities that are already subject to more stringent federal identity verification regulations.

Section 35. Enforcement. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General for the enforcement of this Act.

Section 40. Whistleblower protections. Any employee or agent of an entity that provides a covered service in this State who reports in good faith the entity's noncompliance with this Act shall be protected under the Whistleblower Act.

Section 45. Home rule. A home rule unit may not regulate identity verification in a manner inconsistent with the regulation by the State of identity verification under this Act. This Section is a limitation under subsection (i) of Section 6 of Article VII of the Illinois Constitution on the concurrent exercise by home rule units of powers and functions exercised by the State.

Section 90. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMMM as follows:

(815 ILCS 505/2MMMMM new)

Sec. 2MMMMM. Violations of the Identity Verification for Consumer Services Act. Any person who violates the Identity Verification for Consumer Services Act commits an unlawful practice within the meaning of this Act.

Section 99. Effective date. This Act takes effect January 1, 2027.