HB4538ham001 104TH GENERAL ASSEMBLY

Rep. Rita Mayfield

Filed: 3/18/2026

10400HB4538ham001 LRB104 17029 SPS 35660 a

AMENDMENT TO HOUSE BILL 4538

AMENDMENT NO. ______. Amend House Bill 4538 by replacing everything after the enacting clause with the following:

"Section 1. Short title. This Act may be cited as the Identity Verification for Consumer Services Act.

Section 5. Purpose. The purpose of this Act is to protect Illinois residents from identity theft by establishing mandatory identity verification standards before allowing the issuance of services that involve personal identifying information, including credit services, telecommunications, utilities, online platforms, healthcare access, and government benefit systems.

Section 10. Definitions. As used in this Act:

"Covered service" means any utility, telecommunications, credit account, online financial account, government benefit, or other service that uses personal identifying information to authorize access or extend service. "Covered service" includes any service that involves a high-risk transaction. "Covered service" does not include any public utility as defined in Section 3-105 of the Public Utilities Act, alternative retail electric supplier as defined in Section 16-102 of the Public Utilities Act, or alternative gas supplier as defined in Section 19-105 of the Public Utilities Act.

"High-risk transaction" means any transaction involving the transfer of funds, issuance of credit, remote access to financial records, or any financial service activation that may expose personal identifying information.

"Identity theft" means the unauthorized acquisition and use of personal identifying information to fraudulently obtain credit, benefits, or services.

"Identity verification" means the process of verifying a person's identity using 2 of the following forms of authentication:

(1) valid, government-issued photo identification;

(2) proof of address, such as a recent utility bill, bank statement, or rental lease;

(3) biometric data, such as a fingerprint or facial scan;

(4) secure digital verification through multi-factor authentication; or

(5) knowledge-based authentication.

"Personal identifying information" includes, but is not limited to, full name, date of birth, social security number, driver's license or State identification card number, passport number, biometric identifiers, physical address, email address, telephone number, financial account numbers, insurance policy numbers, and medical or health-related information.

Section 15. Identity verification requirements. An entity that engages in a high-risk transaction involving a covered service shall use identity verification to verify a person's identity before initiating or modifying an agreement to provide the covered service.

Section 20. Recordkeeping. An entity that provides a covered service shall securely retain a record of the documentation collected under the identity verification process required under Section 15 for 3 years after the identity verification or as long as needed for identity verification purposes.

Section 25. Exemptions. The following are exempt from the requirements of this Act:

(1) services exclusively performed using in-person physical identification checks;

(2) services for individuals under the age of 13 with verified parental consent, as required under State and federal law; and

(3) entities that are already subject to more stringent federal identity verification regulations.

Section 30. Enforcement. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General for the enforcement of this Act.

Section 35. Whistleblower protections. Any employee or agent of an entity that provides a covered service in this State who reports in good faith the entity's noncompliance with this Act shall be protected under the Whistleblower Act.

Section 40. Home rule. A home rule unit may not regulate identity verification in a manner inconsistent with the regulation by the State of identity verification under this Act. This Section is a limitation under subsection (i) of Section 6 of Article VII of the Illinois Constitution on the concurrent exercise by home rule units of powers and functions exercised by the State.

Section 90. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMM as follows:

(815 ILCS 505/2MMMM new)

Sec. 2MMMM. Violations of the Identity Verification for Consumer Services Act. Any person who violates the Identity Verification for Consumer Services Act commits an unlawful practice within the meaning of this Act.

Section 99. Effective date. This Act takes effect January 1, 2027.".