Were subscription digital certificates and authentication services taxable as computer software in Illinois?

Plain-English summary

The GIL says digital certificates and authentication and resolution services generally were not subject to Illinois tax, but canned software or other tangible property provided with them could be taxable. The taxpayer sold subscription-based authentication intended to help users verify that they had reached the customer's real website.

The Department declined to issue the requested Private Letter Ruling. Its general explanation distinguished electronically transferred information or data from taxable canned software. Custom software prepared to special order could fall outside taxable retail sales, while merely assembling prewritten programs was not custom software unless the vendor made real and substantial changes or created interfacing logic.

The letter also described five conditions under which a software license was not a taxable retail sale. Under the 2011 rule described, clicking “accept” online did not satisfy the signed-written-agreement condition. Canned-software updates were taxable, and a maintenance agreement containing updates could be fully taxable if the update charges were not separately stated and taxed.

What this means for you

Separate the authentication service and digital certificate from any software or tangible deliverables. Review whether software is canned or genuinely customized, whether the license meets every current regulatory condition, and whether update charges are separately documented. Do not treat this nonbinding 2011 GIL as a current transaction-specific ruling.

Common questions

Q: Was a digital certificate itself treated as computer software?
A: No. The GIL says a digital signature or identification was not computer software.

Q: Could software used to create or read the certificate be taxable?
A: Yes. The letter says that software may be subject to tax.

Q: Did the Department issue the requested binding PLR?
A: No. It declined and responded with general information.

Subject

Computer Software

Source

• Landing page: https://taxarchive.illinois.gov/research/legal/letter-rulings/sales-tax/2011.html
• Original PDF: https://tax.illinois.gov/content/dam/soi/en/web/taxarchive/research/legal/letter-rulings/sales-tax/2011/st-11-0015.pdf

Original ruling text

ST 11-0015-GIL 03/29/2011 COMPUTER SOFTWARE
This letter concerns the taxation of computer software transactions. See 86 Ill. Adm. Code
130.1935. (This is a GIL.)

March 29, 2011

Dear Xxxxx:
This letter is in response to your letter received in this office on September 28, 2010, in which
you request information. The Department issues two types of letter rulings. Private Letter Rulings
(“PLRs”) are issued by the Department in response to specific taxpayer inquiries concerning the
application of a tax statute or rule to a particular fact situation. A PLR is binding on the Department,
but only as to the taxpayer who is the subject of the request for ruling and only to the extent the facts
recited in the PLR are correct and complete. Persons seeking PLRs must comply with the
procedures for PLRs found in the Department’s regulations at 2 Ill. Adm. Code 1200.110. The
purpose of a General Information Letter (“GIL”) is to direct taxpayers to Department regulations or
other sources of information regarding the topic about which they have inquired. A GIL is not a
statement of Department policy and is not binding on the Department. See 2 Ill. Adm. Code
1200.120. You may access our website at www.tax.illinois.gov to review regulations, letter rulings
and other types of information relevant to your inquiry.
The nature of your inquiry and the information you have provided require that we respond with
a GIL. In your letter you have stated and made inquiry as follows:
On behalf of our client (hereinafter ‘Taxpayer’), we are requesting a Private Letter
Ruling (‘PLR’) regarding the sale of authentication and resolution services on a
subscription basis through provision of a digital certificate. An executed Power of
Attorney form authorizing FIRM to represent the Taxpayer is this matter is enclosed. To
the best knowledge of Taxpayer and FIRM: (1) the Illinois Department of Revenue
(‘Department’) has not previously ruled on the same or similar issue for the Taxpayer or
a predecessor;1 (2) the same or similar issue was not previously submitted and
withdrawn by Taxpayer or FIRM prior to the Department’s issuance of a PLR; and (3)
Taxpayer is not under audit by or involved in litigation with the Department.
DESCRIPTION OF SERVICES
The Taxpayer is a provider of authentication solutions for businesses and individuals
seeking to perform secure electronic commerce and communications over the internet.
One such solution is the provision of a digital certificate and authentication and
resolution services on a subscription basis.
Digital certificates are commonly used to facilitate the secure transmissions between
end user browsers and the Taxpayer’s customers’ (‘customers’) servers. A digital
certificate allows an end user to recognize that they are, indeed, accessing the
customers’ server [sic]. For illustration purposes, assume ‘InternetRetailer.com’ is a

customer of the Taxpayer. An end user of ‘InternetRetailer.com’ will access the website
and know that they are accessing the real ‘InternetRetailer.com’ site and not a fake site,
because a check mark will appear on the real ‘InternetRetailer.com’ site, indicating that
the website is authenticated by the Taxpayer. This check mark, trademarked by the
Taxpayer and recognized throughout the world, serves as the visible indication on the
end user’s screen that the customer’s site is who it purports to be.
A digital certificate is provided through an online process, and the first step in this
process is the customer’s access of the Taxpayer’s online portal to complete a
registration form. As part of the customer’s request of a certificate through registration,
a private and public key pair is generated by the customer’s web server. The private
key is retained by the customer on its web server. The public key is part of the
information sent to the Taxpayer in the registration process.
The Taxpayer performs all due diligence necessary to authenticate the identity of the
applicant, the related website and business, and the information presented by the
customer during the registration process, including the public key. Once the Taxpayer
authenticates the identity of the applicant, a digital certificate is electronically sent to the
customer. A digital certificate is a flat file containing: the customer’s public key,
metadata with information such as certificate expiration date, the certificate owners’ [sic]
name, the name of the issuer (certification authority, i.e. the Taxpayer), serial number of
the certificate, and an electronic signature of the issuer.2 The flat file does not contain
binary code.
The digital certificate is installed by the customer on a customer’s web server. When
end users connect to the customer’s server through a web browser, the browser
establishes the authenticity of the digital certificate (and thus the authenticity of the web
site) by mathematically proving that the certificate presented by the customer’s web
server was digitally signed by the Taxpayer. The digital certificate also contains the
aforementioned public key. It is described as a ‘public’ key because the digital
certificate (and key contained therein) is readily viewable by any browser.
The end user’s web browser creates a session key that is used to encrypt the
transmission between the customer’s server and the end user’s browser. However, the
end user’s browser must first use the public key to encrypt the session key and then
transmit the session key to the web server. The web server will use the private key to
decrypt the session key so that both the web server and browser can begin using the
session key for the encrypted transmissions. After the initial handshake between the
browser and web server, the session key is used for the encryption of the
transmissions. The encryption strength of the transmission is directly related to the bit
length of the session key. The encryption/decryption is performed by the cryptographic
software built into the web browser and customer’s server. This software is not
provided by the Taxpayer.
In addition to authenticating the digital certificate and website, the end user’s browser
communicates with the Taxpayer’s servers to verify that the digital certificate is valid
and not revoked (resolution service). If the certificate is valid, the end user’s browser
will show the end user a notification that the certificate is valid and has not been
revoked. The charges for the authentication service, digital certificate, and resolution
service are part of a lump sum subscription charge and must be renewed periodically.
ISSUE

Whether the Taxpayer’s sales of authentication services via provision of a digital
certificate to the Taxpayer’s customers for consideration are subject to the Illinois
sales/use tax when provided to customers located in Illinois.
RULINGS REQUESTED
I. Taxpayer’s sales of digital certificates are exempt from Illinois sales and use taxes
(ROT, SOT, SUT and UT), because the transaction does not involve the transfer of
tangible personal property.
II. Taxpayer’s provision of authentication services is exempt from Illinois sales and use
taxes (ROT, SOT, SUT and UT), because the transaction is a service that does not
involve the transfer of tangible personal property incident to the service.
III. Taxpayer’s provision of resolution services is exempt from Illinois sales and use
taxes (ROT, SOT, SUT and UT), because the transaction is a service that does not
involve the transfer of tangible personal property incident to the service.
BASIS FOR OUR RULINGS REQUESTED
I.

The digital certificates issued by the Taxpayer to its customers are not
delivered via a tangible medium and are not computer software.

The Illinois Retailer’s [sic] Occupation Tax (‘ROT’) is imposed on persons engaged in
the business of selling tangible personal property at retail.3 The ROT is imposed on all
sales at retail of tangible personal property unless specially exempted from tax or
exempted from the definition of ‘sale at retail.’
The digital certificate provided by the Taxpayer is not tangible personal property as it is
delivered entirely over the internet.
In Illinois, canned software is considered to be tangible personal property regardless of
the form in which it is transferred or transmitted.4 Computer software is defined as a set
of statements, data, or instructions that is used directly or indirectly in a computer in
order to bring about a certain result.5
The digital certificates provided by the Taxpayer do not constitute computer software as
they do not provide a set of statements, data, or instructions that is used directly or
indirectly in a computer in order to bring about a certain result. The certificate is a flat
file containing only information (a public key, metadata with information such as
certificate expiration date, the certificate owners [sic] name, name of the issuer, serial
number, electronic signature, etc.). The flat file does not contain binary code and does
not dictate statements, data or instructions that is used directly or indirectly to bring
about a certain result.
Under Illinois law, information or data that is transferred or downloaded electronically is
not considered tangible personal property.6 Therefore digital products, including data
and information transmitted through an electronic medium such as the Internet, would
not be considered tangible person [sic] property subject to the ROT.

In a previously-issued General Information Letter (‘GIL’), the Department concluded that
electronically downloaded books are not subject to tax, because they involve only the
transfer of data and information.7 In two more recently-issued GILs, the Department
reinforced its position that any data or information transferred or downloaded over the
internet is not considered a transfer of tangible personal property.8
The digital certificates sold by the Taxpayer are akin to a digital product in that only data
or information is being conveyed. In the case of the provision of digital certificates by
the Taxpayer, nothing is downloaded to the user’s computer. There is no transfer of
tangible personal property and the entire transaction is conducted electronically via the
Internet. Therefore the digital certificates would not be considered transfers of tangible
personal property and are not subject to tax.
II.

The services associated with authenticating the digital certificate are not
taxable services in the state.

The Illinois service occupation tax (‘SOT’) is imposed on persons engaged in the
business of making sales of services.9 In general, SOT is levied on persons making
sales of services and is measured by the selling price of any tangible personal property
transferred that is incidental to the sale of the service.10 Therefore, when no tangible
personal property is transferred in relation to a service, the service is not subject to
SOT.
The Taxpayer’s authentication services consist primarily of due diligence procedures to
verify the identity of its customer (and the customer’s website). Once verified, the digital
certificate is then installed by the customer onto the customer’s server. All further
encryption and decryption is performed entirely by software built into the web browser
and the customer’s server. This is not software provided by the Taxpayer.
Although the Taxpayer’s authentication services are not specifically enumerated in the
Illinois statute, they may be considered analogous to a security monitoring, data
processing, or information service.
In previously-issued GILs, the Department has reiterated the statutory guidance that a
service is not subject to SOT if no tangible personal property is transferred, and has
applied this rule to services such as data processing,11 as well as security services.12
As discussed herein, the Taxpayer provides no tangible personal property with its digital
certificates. Similarly, there is no tangible personal property transferred with the
authentication services the Taxpayer provides.
In an Illinois Private Letter Ruling, the Department established that a taxpayer who
provided electronic business and financial information through a database via the
Internet was not subject to tax on its sales of web-based information services.13 This
ruling further reinforces our position that the Taxpayer’s web based authentication
services would not be subject to the SOT, as there is no tangible personal property
transferred with the service.
III.

The resolution services provided by the Taxpayer to verify the digital
certificate are not taxable services in the state.

The resolution service is provided by the Taxpayer after the digital certificate is
obtained. The resolution service allows the end user’s browser to verify that the digital
certificate is, indeed, valid and not revoked.
This resolution service is also not taxable in Illinois. As previously stated, SOT is levied
on persons making sales of services and is measured by the selling price of any
tangible personal property transferred that is incidental to the sale of the service.14
Therefore, when no tangible personal property is transferred in relation to a service, the
service is not subject to SOT.
As the resolution service is not enumerated as taxable by Illinois law, and it is not
performed on a tangible media, it is not taxable in the state.
Requested Action
We request that the Illinois Department of Revenue review the stated facts and issue a
ruling that the Taxpayer’s digital certificate and authentication processes is [sic] not
subject to Illinois ROT or SOT.
A copy of our executed Power of Attorney, Form IL-2848, is enclosed. If you have any
questions, please contact me.

DEPARTMENT’S RESPONSE:
The Department’s regulation “Public Information, Rulemaking and Organization” provides that
“[w]hether to issue a private letter ruling in response to a letter ruling request is within the discretion of
the Department. The Department will respond to all requests for private letter rulings either by
issuance of a ruling or by a letter explaining that the request for ruling will not be honored.” 2 Ill. Adm.
Code 1200.110(a)(4). The Department declines to issue a Private Letter Ruling. Although we are not
providing you with a Private Letter Ruling, we hope the following general information will be of
assistance.
The Illinois Retailers' Occupation Tax Act imposes a tax upon persons engaged in this State in
the business of selling tangible personal property to purchasers for use or consumption. See 86 Ill.
Adm. Code 130.101. In Illinois, Use Tax is imposed on the privilege of using, in this State, any kind of
tangible personal property that is purchased anywhere at retail from a retailer. See 86 Ill. Adm. Code
150.101. These taxes comprise what is commonly known as "sales tax” in Illinois.
Illinois Retailers' Occupation and Use Taxes do not apply to sales of service that do not involve
the transfer of tangible personal property to customers. However, if tangible personal property is
transferred incident to sales of service, this will result in either Service Occupation Tax liability or Use
Tax liability for the servicemen depending upon his activities. For your general information see 86 Ill.
Adm. Code 140.101 through 140.109 regarding sales of service and Service Occupation Tax.
Services that involve the transfer of tangible personal property (such as, for example, written reports,
other tangible media and training manuals) incident to a sale of service may be subject to either
Service Occupation Tax liability or Use Tax liability.
Information or data that is electronically transferred or downloaded is not considered the
transfer of tangible personal property in this State. See 86 Ill. Adm. Code 130.2105(a)(3). However,
canned computer software is considered taxable tangible personal property regardless of the form in
which it is transferred or transmitted, including tape, disc, card, electronic means or other media. See

86 Ill. Adm. Code 130.1935. If the computer software consists of custom computer programs, then
the sales of such software may not be taxable retail sales. See Section 130.1935(c).
Custom computer programs or software are prepared to the special order of the customer. The
selection of pre-written or canned programs assembled by vendors into software packages does not
constitute custom software unless real and substantial changes are made to the programs or creation
of program interfacing logic. See Section 130.1935(c)(3).
If transactions for the licensing of computer software meet all of the criteria provided in Section
130.1935(a)(1), neither the transfer of the software or the subsequent software updates will be
subject to Retailers’ Occupation Tax. A license of software is not a taxable retail sale if:
A)

It is evidenced by a written agreement signed by the licensor and the
customer;

B)

It restricts the customer’s duplication and use of the software;

C)

It prohibits the customer from licensing, sublicensing or transferring the software
to a third party (except to a related party) without the permission and continued
control of the licensor;

D)

The licensor has a policy of providing another copy at minimal or no charge if the
customer loses or damages the software, or permitting the licensee to make and
keep an archival copy, and such policy is either stated in the license agreement,
supported by the licensor's books and records, or supported by a notarized
statement made under penalties of perjury by the licensor; and

E)

The customer must destroy or return all copies of the software to the licensor at
the end of the license period. This provision is deemed to be met, in the case of a
perpetual license, without being set forth in the license agreement.

Please note that acceptance of a software license agreement by clicking “accept” while online
is not considered “acceptance” sufficient enough to constitute a written agreement signed by the
licensor and the customer for purposes of subsection (a)(1)(A) of Section 130.1935.
Charges for updates of canned software are fully taxable pursuant to Section 130.1935. If the
updates qualify as custom software under Section 130.1935(c), they may not be taxable. But, if
maintenance agreements provide for updates of canned software, and the charges for those updates
are not separately stated and taxed, then the whole agreement would be taxable as sales of canned
software.
As noted in a prior General Information Letter (ST 01-0148) issued by the Department, a digital
signature or identification is not considered computer software and is therefore not subject to tax;
however, any software used to create, encrypt, decrypt or read a digital signature is considered to be
software and may be subject to taxation. Generally, the provision of a digital certificate,
authentication and resolution services are not subject to tax. However, any canned computer
software or any other tangible personal property provided to the customer with the provision of the
digital certificate or services may be subject to tax.
I hope this information is helpful. If you require additional information, please visit our website
at www.tax.illinois.gov or contact the Department’s Taxpayer Information Division at (217) 782-3336.

Very truly yours,

Richard S. Wolters
Associate Counsel
RSW:msk
1

Our review of the publically-available General Information Letters (GIL) issued by the Illinois Department of Revenue revealed one
GIL with facts similar to our taxpayer. Please see ST 01-0148-GIL. To our knowledge, our client did not submit this ruling request.
2
Note that the exact contents of a certificate adhere to certain established standards such as the ‘X509’ standard that specifies what
can or cannot be contained on a certificate.
3
35 Ill. Comp. Stat. 120/1; Ill. Admin. Code tit. 86, § 130.101.
4
Ill. Admin. Code tit. 86 § 130.1935(a).
5
35 Ill. Comp. Stat. 105/3-25.
6
Ill. Admin. Code tit. 86 § 130.2105(a)(3).
7
Illinois Dept. of Rev. General Information Letter No. ST 07-0068-GIL (06/19/2007).
8
Illinois Dept. of Rev. General Information Letter No. ST 09-0098-GIL (07/30/2009); Illinois Dept. of Rev. General Information
Letter No. ST 10-0010-GIL (02/26/2010).
9
Ill. Admin. Code tit. 86, § 140.101.
10
Ill. Admin. Code tit. 86, § 140.101(b)(1); Ill. Admin. Code tit. 86, § 160.101(c)(1).
11
Illinois Dept. of Rev. General Information Letter No. ST 07-0125 GIL (08/16/2007).
12
Illinois Dept. of Rev. General Information Letter No. ST 99-0311 GIL (10/13/1999).
13
Illinois Private Letter Ruling No. ST 04-0013 (10/27/2004).
14
Ill. Admin. Code tit. 86, § 140.101(b)(1); Ill. Admin. Code tit. 86, § 160.101(c)(1).