HB4538eng 104TH GENERAL ASSEMBLY

HB4538 Engrossed LRB104 17029 SPS 30444 b

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Identity Verification for Consumer Services Act.

Section 5. Purpose. The purpose of this Act is to protect Illinois residents from identity theft by establishing mandatory identity verification standards before allowing the issuance of services that involve personal identifying information, including credit services, telecommunications, utilities, online platforms, healthcare access, and government benefit systems.

Section 10. Definitions. As used in this Act:

"Covered service" means any utility, telecommunications, credit account, online financial account, government benefit, or other service that uses personal identifying information to authorize access or extend service to those accounts or benefits. "Covered service" includes any service that involves a high-risk transaction. "Covered service" does not include any public utility as defined in Section 3-105 of the Public Utilities Act, alternative retail electric supplier as defined in Section 16-102 of the Public Utilities Act, or alternative gas supplier as defined in Section 19-105 of the Public Utilities Act.

"High-risk transaction" means any transaction involving the transfer of funds, issuance of credit, remote access to financial records, or any financial service activation that may expose personal identifying information.

"Identity theft" means the unauthorized acquisition and use of personal identifying information to fraudulently obtain credit, benefits, or services.

"Identity verification" means the process of verifying a person's identity using 2 of the following forms of authentication:

(1) valid, government-issued photo identification;

(2) proof of address, such as a recent utility bill, bank statement, or rental lease;

(3) biometric data, such as a fingerprint or facial scan;

(4) secure digital verification through multi-factor authentication; or

(5) knowledge-based authentication.

"Personal identifying information" includes, but is not limited to, full name, date of birth, social security number, driver's license or State identification card number, passport number, biometric identifiers, physical address, email address, telephone number, financial account numbers, insurance policy numbers, and medical or health-related information.

Section 15. Identity verification requirements. An entity that engages in a high-risk transaction involving a covered service shall use identity verification to verify a person's identity before initiating or modifying an agreement to provide the covered service.

Section 20. Recordkeeping. An entity that provides a covered service shall securely retain a record of the documentation collected under the identity verification process required under Section 15 for 3 years after the identity verification or as long as needed for identity verification purposes.

Section 25. Exemptions. The following are exempt from the requirements of this Act:

(1) services exclusively performed using in-person physical identification checks;

(2) services for individuals under the age of 13 with verified parental consent, as required under State and federal law;

(3) entities that are already subject to more stringent federal identity verification regulations, including, but not limited to, the customer identification program regulations adopted by the Financial Crimes Enforcement Network of the United States Department of the Treasury;

(4) the Early Intervention Program when acting in accordance with 89 Ill. Adm. Code 500 and regulations adopted under Part C of the Individuals with Disabilities Education Act (34 CFR 303.112(b)) for the purpose of verifying identities; and

(5) the Child Care Assistance Program when acting in accordance with 89 Ill. Adm. Code 500 and regulations adopted under the Child Care and Development Block Grant Act (45 CFR 98.20(c)) for the purpose of verifying identities.

Section 30. Enforcement. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General for the enforcement of this Act.

Section 35. Whistleblower protections. Any employee or agent of an entity that provides a covered service in this State who reports in good faith the entity's noncompliance with this Act shall be protected under the Whistleblower Act.

Section 40. Home rule. A home rule unit may not regulate identity verification in a manner inconsistent with the regulation by the State of identity verification under this Act. This Section is a limitation under subsection (i) of Section 6 of Article VII of the Illinois Constitution on the concurrent exercise by home rule units of powers and functions exercised by the State.

Section 90. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMM as follows:

(815 ILCS 505/2MMMM new)

Sec. 2MMMM. Violations of the Identity Verification for Consumer Services Act. Any person who violates the Identity Verification for Consumer Services Act commits an unlawful practice within the meaning of this Act.

Section 99. Effective date. This Act takes effect January 1, 2027.