> Sure, there are multiple laws. The ones I've read all seem similar enough to me on the points people bring up.
The laws are template laws, but do occasionally differ in important ways. You've mentioned before that Texas includes a financial penalty for retaining user IDs beyond verification. You didn't mention that Texas is pretty much the only state that does this, and the majority of the other bills only allow for suing for harm and attorney's fees. Harm can be difficult to prove for information retention, and these provisions rely on individual action for enforcement.
You mention later in this comment that Utah includes provisions for ID-only verification. You don't mention that Utah is (as far as I can tell) one of the only states that offers this kind of detail, most merely mentioning that "government identification" could be used for verification.
These things matter. When we treat these bills as a single unit, we run the risk of building a composite bill that theoretically addresses every concern, even though that composite bill doesn't actually exist anywhere.
----
> Identity verification is not that mysterious.
Agreed. Do you believe that the security professionals who are intimately familiar with identity verification services and who know how the current services work are just... lying? Like, what do you think is happening here? This is not something complicated where there are a bunch of debates about how ID verification can work, we know how the ID verification services today work. And security professionals are saying there's a security risk.
Does the Texas AG know something that they don't? Is there some secret new ID verification system that only lawmakers know about? Like you say, this isn't that mysterious, ID verification online exposes users to privacy and security risks. It's straightforward, this is a known risk.
The fact is, there are no identity verification services I'm aware of that I think are secure enough enough to use for this level of transaction -- and every 3rd-party ID service I'm aware of works by retaining and accessing stored information about users.
The people talking about the security risks know how existing identity verification services work. They're not that complicated. They work by collecting and transmitting and cross-referencing personally identifying data, and that process is vulnerable to attack and data misuse.
----
> i.e. KBA, which is already a thing. These companies already know facts about everyone. You claim you're person X. They ask you to tell them a fact they already know. They check your answer against their database. They don't need to store anything you tell them.
Okay, are you listening to yourself?
> They check your answer against their database.
So personally identifying information is collected and stored. And that information is linked to requests to access potentially compromising or embarrassing material on a level of granularity where those requests, if intercepted, can be used to link personal identities back to those requests. By your own admission.
I don't know, you're agreeing with me and then saying "see, that means that data doesn't have to be stored." No, you just described data getting stored and held by a 3rd-party (notably, a set of 3rd-parties that have had historically awful security and have regularly been irresponsible with those databases) and then cross-referenced with individual access requests in a way that would necessarily require personally identifying to these data brokers which individuals were interacting with which companies.
Sure, those services don't need to store your newly uploaded ID -- they already have it! But what comfort is that? They still have the ID either way. You are describing a system that can only exist by hoovering up and retaining huge amounts of data on individuals, and you're advocating that this system should be expanded.
And while we're on this subject, none of the laws I've read ban retaining records of this access or selling information about which individuals' identities are verified, even though that could be compromising or personal information. More PII and data is created during this process than just the ID you transmit, and I don't think a single law that I've read addresses that fact. But sure, the data broker that already has your ID won't store the image you sent them. That'll be a huge comfort to Texas users when those sites get hacked and leak access information about which users had their IDs verified for which services.
What you're describing is not a privacy-respecting system.
----
> The Utah law also allows the user to present a "data file from a state agency or an authorized agent of a state agency that contains all of the data elements visible on the face and back of a license or identification card and displays the current status of the license or identification card."
I avoided pushing this point too hard before, but reminder that there is no requirement in any of the laws I've read for state agents or authorized agents of the state to delete records of that request or to avoid linking those requests to individual services. The laws as written do not block government agencies from using this information to build detailed records of who accesses which services.
> No need for the site to save anything. Just check the signature and age.
This would not pass a check for fake IDs. Nor would it prevent shared IDs. The laws I've read provide no guarantee that a system that was trivially bypassed would be sufficient to ward off State action. Again with the ambiguity about what "reasonable" means, which is a major problem in these bills. "Don't violate privacy, but it has to work." Well, if all you're doing is OCR on a license and you're not cross-referencing that data or storing information about attempts, that is not a system that is hard to bypass.
Also as I mentioned above, there isn't just one law. Other laws do not go into this level of detail about what kinds of IDs are accepted or how they could be verified. Great that Utah does (although Utah's example is not sufficient to address concerns) -- that just leaves all of the other bills.
> I don't see what makes porn sites unique vs. any other e-commerce business that requires customers to identify themselves wrt. security.
Multiple things:
A) not all porn sites are e-commerce businesses, and not all platforms affected by these bills are porn sites. These bills are not typically restricted to commercial transactions -- merely accessing commercial sites requires verification, even without a business relationship.
B) e-commerce businesses with traditional verification requirements typically do not allow for anonymous usage in the first place. Many of them have extensive "know your customer" rules and are not concerned with protecting the privacy of their users -- quite the opposite, many of them are required to retain information about their users.
C) Security-wise they're not that different, and the criticism of these bills directly extends from knowledge about the security risks and bad practices of many of those e-commerce sites. Whether or not you understand the security implications, I promise you the organizations and security experts that are pushing back on these bills already understand that Flowroute exists.
Note that the theoretical instant, private identification that you seem to be proposing sites will implement doesn't exist for the companies that are relying on this verification today. Once again, I'm left pointing out that you're describing a happy-path scenario that isn't the case for any online identification system I can find. As far as I can tell, these services all store data about their users' individual identities.
----
> Also many grocery stores do scan IDs when you hand them to the cashier. Who knows what they're doing with that info. Wouldn't surprise me if they retain and sell it.
Shouldn't you check up on that before advocating that Internet ID verification is fine because it's just like local verification? Me personally, before I compared digital ID verification to local ID verification, I might make sure that local verification isn't retaining and selling all of your data, because otherwise the comparison would look awful. Have you checked to see whether security professionals have also raised alarms about local storage of ID information? Because... they have, for the exact same reasons :)
Local ID verification ideally should not involve scanning an ID, and the fact that it sometimes does anyway is worrisome. It doesn't bode well for expanded digital ID verification.
If your point is "local verification doesn't require sending information to multiple parties across the Internet and yet companies still do it anyway, and we still don't know what's happening to your data in that scenario" then... I mean, you have to understand that's not something that is likely to make anybody feel more charitable to your argument, right? That's not something that makes online ID verification seem like a good idea.
----
Once again, I'll repeat:
- Texas's own language refers to these systems as storing user information.
- There are no ID verification systems that I'm aware of for online services that work without maintaining and storing information about users.
- Addressing long-term retention of submitted information is not sufficient to address the privacy and security concerns that researchers have brought up.
- None of the bills I've read are clear that an unverifiable zero-retention policy would be sufficient to avoid liability, this seems to be something you're just reading into the text as an assumption of good will.
What you're suggesting above about retention practices and the ability of ID verification services to do this without storing customer data isn't true -- but even if it was true (which it's not) it changes nothing. Regular transmission of this kind of information is dangerous, users should not be trained to submit this kind of information casually, especially not to sites that they don't have business relationships with. The transmission and collection of this information exposes users to risks to both privacy and security.