SB3551 104TH GENERAL ASSEMBLY

LRB104 17473 BDA 30899 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB3551

Introduced 2/5/2026, by Sen. Michael E. Hastings

SYNOPSIS AS INTRODUCED:

New Act

Creates the Government Communications Transparency and Security Act. Prohibits a government entity, government officer, or government employee from downloading, installing, accessing, activating, or using an end-to-end encryption platform with autodeletion on a government communication device. Prohibits an Internet service provider, telecommunications carrier, server operator, mobile application marketplace, or digital platform doing business in the State from enabling the download, installation, activation, or operation of an end-to-end encryption platform with autodeletion on a government communication device. Requires Internet service providers, telecommunications carriers, and digital platforms to implement reasonable technological measures to block access to, installation of, or operation of end-to-end encryption platforms with autodeletion on government communication devices. Establishes penalties for violations. Authorizes the Attorney General or an Illinois taxpayer to bring suit to enforce the Act, with recovery of attorney's fees and costs. Requires the Department of Innovation and Technology to adopt rules. Defines terms. Effective January 1, 2027.

A BILL FOR

AN ACT concerning government.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Government Communications Transparency and Security Act.

Section 5. Definitions. In this Act:

"Enable" includes to host, list, distribute, provision, facilitate, or otherwise make technically available for download, installation, activation, or use.

"End-to-end encryption platform with autodeletion" means any application, software, service, or feature set that (i) provides end-to-end encryption such that only the sender and intended recipient can access message content; and (ii) includes any autodeletion capability, including, but not limited to, ephemeral or disappearing messages, timed deletion, auto-expiring threads, remote wipe of message content, or automatic redaction of message bodies or attachments.

"Government communication device" means any phone, computer, tablet, server, or other electronic communication device purchased, leased, issued, or reimbursed by a government entity for official use.

"Government employee" means an employee of a government entity.

"Government entity" means the State of Illinois, any State constitutional officer, State agency, State board, State commission, State university, school district, or unit of local government, including municipalities, counties, and special districts.

"Government officer" means an officer of a government entity.

Section 10. Prohibition.

(a) No government entity, government officer, or government employee shall download, install, access, activate, or use an end-to-end encryption platform with autodeletion on a government communication device.

(b) No Internet service provider, telecommunications carrier, server operator, mobile application marketplace, or digital platform doing business in the State shall enable the download, installation, activation, or operation of an end-to-end encryption platform with autodeletion on a government communication device.

(c) Internet service providers, telecommunications carriers, and digital platforms shall implement reasonable technological measures to block access to, installation of, or operation of end-to-end encryption platforms with autodeletion on government communication devices.

(d) A platform that allows administrator-level configuration to disable end-to-end encryption or autodeletion features shall not be considered prohibited under this Section if those features are verifiably disabled and cannot be reenabled by an end user on the government communication device.

Section 15. Enforcement and penalties.

(a) A violation of subsection (a) of Section 10 by a government officer or government employee, if committed knowingly and with knowledge that the act is prohibited by law, constitutes official misconduct under paragraph (2) of subsection (a) of Section 33-3 of the Criminal Code of 2012.

(b) Any Internet service provider, telecommunications carrier, server operator, mobile application marketplace, or digital platform that knowingly violates subsection (b) or (c) of Section 10 is subject to a civil penalty of not less than $50,000 for each violation.

(c) The Attorney General may bring a civil action to enforce this Act, including for injunctive relief, civil penalties, and recovery of attorney's fees and costs.

(d) Any Illinois taxpayer may bring an action in the name of the People of the State of Illinois to enjoin a continuing violation of subsection (b) or (c) of Section 10. Prevailing taxpayers shall be entitled to reasonable attorney's fees and costs.

Section 20. Rulemaking. The Department of Innovation and Technology shall adopt rules as necessary to implement this Act, including standards for verifying government communication devices and procedures for compliance by telecommunications providers and platforms.

Section 99. Effective date. This Act takes effect January 1, 2027.