Encryption laws in the United States impose no restrictions on your right to use strong encryption. You can secure your phone, your emails, and your business records with the strongest commercially available tools without violating any federal statute, and no law requires companies to build government access into their products. What the law does regulate is narrower: certain industries must encrypt sensitive data, courts sometimes order suspects or companies to help unlock protected information, and sending encryption technology abroad triggers its own set of federal rules.
Is Encryption Legal to Use in the United States
Yes. No federal statute bans or restricts the domestic use of strong encryption. Companies can implement end-to-end encryption where only the sender and receiver hold the keys, and individuals can secure personal devices at any level of protection they choose. Proposals to require built-in government access have surfaced repeatedly in Congress, but none have become law.
The FBI has publicly stated that it supports “strong, responsibly managed encryption” while also calling on tech companies to “maintain the ability to access readable content” in response to court orders. That is an advocacy position, not a legal mandate. Federal policy on the whole treats encryption as a cybersecurity tool: the National Institute of Standards and Technology publishes recommended encryption standards, and several federal regulations require certain industries to use encryption to protect sensitive data.
When the Law Requires You to Use Encryption
Federal Agencies and Contractors
Every federal agency that handles sensitive information through computer or telecommunications systems must use cryptographic modules validated under FIPS 140-3, the standard published by NIST. The requirement extends to systems operated by contractors on behalf of federal departments. If you build systems that touch sensitive federal data, your encryption must be FIPS-validated, not merely strong in a general sense.
Health Care
The HIPAA Security Rule classifies encryption of electronic protected health information as an “addressable” implementation specification. That word confuses people. Addressable does not mean optional. A covered entity must either implement encryption or document in writing why it chose an equivalent alternative and why encryption was unreasonable given the entity’s size, complexity, and risk profile. Most health care organizations simply encrypt patient data because documenting a legitimate exception costs more than encryption itself. A proposed rule from December 2024 would have made encryption flatly mandatory, but as of early 2026 that proposal remains on hold.
Financial Services
Financial institutions subject to the FTC Safeguards Rule must maintain a written information security program with technical safeguards “appropriate to the size and complexity” of the business and the sensitivity of the data. The rule names no specific algorithm, but the expectation that customer records be protected against unauthorized access effectively makes encryption a baseline for any institution handling that data electronically.
The SEC’s 2024 amendments to Regulation S-P similarly require broker-dealers, registered investment advisers, and investment companies to adopt written policies for detecting, responding to, and recovering from unauthorized access to customer information. The compliance deadline for smaller entities is June 3, 2026.
Encryption as a Data Breach Safe Harbor
All 50 states have enacted breach notification laws requiring companies to tell consumers when personal information is compromised. Most of those laws include a safe harbor: if the stolen data was encrypted and the encryption key was not also compromised, you generally don’t have to notify anyone. The logic is that encrypted data an attacker cannot read does not put anyone at risk, and requiring notification for every breach regardless of encryption would create “notification fatigue” that makes consumers ignore alerts that matter.
The structure of these safe harbors varies. Some states grant an automatic exemption the moment the data was encrypted. Others create a rebuttable presumption that notification is not required unless someone proves otherwise. A few use a factor-based analysis that weighs the circumstances of the breach against the strength of the encryption. The precondition is consistent across states: the data acquired without authorization must have been encrypted at the time of the breach, and the key must remain secure. Companies that encrypt data at rest and in transit have a meaningful shield against the cost and reputational damage of mass notification.
When You Can Be Forced to Unlock a Device
The hardest questions in US encryption law arise in criminal investigations, where officers want inside a locked device and the suspect refuses to help. The Fifth Amendment protects people from being compelled to incriminate themselves, and courts have spent years working out how that protection applies to passcodes, fingerprints, and face scans.
Passcodes
Most courts agree that compelling someone to reveal a passcode is a “testimonial” act because it requires the person to disclose the contents of their mind. Typing in a password implicitly communicates that you know the code, that you control the device, and that you can access its contents. Those facts can be used against you, which is exactly what the Fifth Amendment protects against. The Supreme Court has not yet ruled directly on compelled decryption, and lower courts split on the details, but the general principle that passcodes receive Fifth Amendment protection is widely accepted.
Fingerprints and Face Scans
Biometric unlocks occupy a different legal category. Courts have traditionally treated physical characteristics like fingerprints, blood samples, and voice patterns as non-testimonial because producing them requires no mental effort or communication of knowledge. Several courts have extended that reasoning to biometric phone unlocks, holding that pressing a finger to a sensor is closer to giving a blood sample than to revealing a secret. Other courts recognize that a biometric unlock communicates the same things a passcode does: ownership, control, and access to potentially incriminating files. This area of law is genuinely unsettled, and the outcome can depend on which court hears the case.
The Foregone Conclusion Doctrine
Even when decryption would normally be protected, the government has an exception available through the “foregone conclusion” doctrine. If the government already knows what is on the device and can prove it, forcing you to unlock the device arguably reveals nothing new, and the act is not treated as testimonial.
Courts disagree about what the government must already know. Some hold that the government only needs to prove the suspect knows the passcode and can access the device. Others require the government to demonstrate with “reasonable particularity” that specific files or data exist on the device. Under the first approach, investigators need only evidence that you used the phone. Under the second, they essentially need to know what they are looking for before they can make you help them find it.
What Happens If You Refuse
Refusing a court order to decrypt a device can result in a contempt finding, and judges have broad discretion over the consequences. In one notable case, a man was held in jail for more than four years for refusing to decrypt hard drives investigators believed contained illegal material. Contempt sanctions can theoretically continue indefinitely, though appellate courts have begun questioning whether prolonged imprisonment crosses the line from coercing compliance into punishing the refusal itself.
When Companies Can Be Ordered to Help
The All Writs Act
When investigators cannot crack encryption on their own, they sometimes turn to the companies that built the technology. The main legal tool is the All Writs Act, a 1789 statute giving federal courts authority to “issue all writs necessary or appropriate in aid of their respective jurisdictions.” The government has used it to argue that courts can order tech companies to write custom software that bypasses their own security features.
The most prominent example was the 2016 dispute between the FBI and Apple over an iPhone used by the San Bernardino shooter. A federal magistrate ordered Apple to provide “reasonable technical assistance,” including building a special version of its operating system that would disable the phone’s auto-erase function and allow rapid electronic passcode entry. Apple challenged the order, arguing the All Writs Act does not authorize the government to conscript a private company into creating tools that undermine its own products. The case never produced a judicial ruling. The FBI withdrew its request after a third party helped unlock the phone, leaving the legal boundaries unresolved.
Courts evaluating All Writs Act requests must balance the government’s investigative needs against the burden on the company. An order that would effectively require building a new surveillance tool, compromise security for millions of other users, or impose massive costs on the company might be struck down as unreasonable. The precise line remains unclear because no appellate court has squarely decided how far the Act reaches when applied to encryption.
The CALEA Gap
The Communications Assistance for Law Enforcement Act requires telecommunications carriers to build lawful intercept capabilities into their systems so that wiretap orders can be executed. Traditional phone companies and facilities-based broadband providers must comply. The FCC extended CALEA in 2005 to cover interconnected Voice over Internet Protocol services that can replace conventional telephone service.
The statute explicitly excludes “information services” from its requirements. That exclusion covers most modern messaging platforms and internet-based communication apps. If a service operates entirely over the internet without connecting to the traditional phone network, CALEA’s design mandates do not apply, and the company has no legal obligation to build in surveillance capabilities. This gap is a recurring source of frustration for law enforcement and a recurring topic in Congressional hearings, but closing it would require new legislation.
Export Controls on Encryption Products
Selling or distributing encryption technology outside the United States triggers a separate set of federal rules under the Export Administration Regulations, administered by the Bureau of Industry and Security within the Department of Commerce. These controls exist because the same tools that protect bank transactions and private messages can also shield hostile communications from intelligence agencies.
Classification and Licensing
Encryption products are classified under Category 5, Part 2 of the Commerce Control List, which covers information security items including cryptographic hardware, software, and the technology to build them. Not every encrypted product requires an individual export license. Most can be exported under License Exception ENC after the exporter completes applicable classification and reporting requirements. The exception covers items classified under ECCNs 5A002 and 5D002, along with related software and technology. Some categories, including network infrastructure equipment and digital forensics tools, require a 30-day classification review by BIS before shipping.
License Exception ENC does not authorize exports to countries in Country Groups E:1 or E:2, which include nations subject to comprehensive US sanctions and countries designated as state sponsors of terrorism. Exports to those destinations require individual licenses that are rarely granted.
Mass Market Products
Consumer-oriented encryption products can qualify for lighter treatment under the mass market classification. Items that would otherwise fall under 5A002 or 5D002 can be reclassified to 5A992.c or 5D992.c if they meet criteria focused on public availability, retail distribution, and the absence of customization for individual buyers. There is no single technical threshold like a minimum key length. BIS looks at factors like the quantity sold, price point, skill level needed to operate the product, and whether the seller restricts who can buy it. Consumer apps and devices with built-in encryption routinely qualify, which is why an encrypted messaging app can be downloaded anywhere in the world without an export license.
Penalties
Consequences for violating export controls on encryption are severe. Civil penalties reach $374,474 per violation or twice the value of the transaction, whichever is greater, and that figure is adjusted annually for inflation. Criminal penalties for willful violations include fines up to $1 million and imprisonment up to 20 years per violation. These apply equally to physical hardware shipments and digital software downloads across borders.
Bills That Could Change the Balance
Several bills introduced in recent Congressional sessions would shift the legal balance between encryption and law enforcement access, though none have become law. The EARN IT Act, introduced in multiple sessions, would strip tech companies of Section 230 liability protections for violations of child sexual exploitation laws. The bill explicitly states that offering encryption services would not independently create liability, but critics argue the practical effect would push companies to abandon end-to-end encryption because they cannot scan for illegal content without the ability to read messages.
The proposed STOP CSAM Act would apply a “recklessness” liability standard to interactive computer services. Digital rights organizations warn this would create significant incentives for platforms to stop offering encrypted messaging rather than risk lawsuits over content they cannot view. Both proposals reflect a recurring Congressional impulse to use civil liability as an indirect lever against encryption, even when the bills stop short of directly mandating backdoors. Whether any version ultimately passes remains open, but the pattern of repeated introduction suggests the pressure on encrypted services is not going away.