> If the law contradicts a requirement that you made up, and does not itself contain that requirement, then why would you presume that it has that requirement?

First off, always good to be clear that there are multiple laws here, even if many of them are templates of each other; there's not "the law". Secondly, this is hiding behind ambiguity in many of these laws' language; it's easy to claim that a law doesn't specifically require that companies retain information about their efforts, but I guarantee you in any court case about this, requests for that information would come up.

It is painfully naive to assume that any company would feel safe implementing a legally required system that does not provide them with any evidence to prove that their system works or has worked in the past. The ambiguity about what many of these bills mean when they call for a "reasonable method" of identity verification is exactly the kind of contradicting language that I'm talking about above. "We didn't ask you to do X, we just put you in a situation where not doing X would be extremely dangerous."

I would argue that a State going to a company and saying, "do something 'reasonable'" with no legal guarantee or precedent about what will and won't be reasonable, and then additionally adding restrictions that make it practically impossible for any existing ID verification system online that I'm aware of to fit that requirement -- I would argue that is tantamount to an attempt to ban porn. It's a system that can't really be safely complied with. Of course companies being able to provide documentation and evidence of their prior verifications is a practical requirement for them operating in that kind of environment.

> There's literally no reason to have e.g. a knowledge based auth or signed id request hit disk. It doesn't need to be saved for a "short time". It doesn't need to be saved on permanent storage at all.

I don't see any indication in the laws I've read that this would be sufficient; where are you getting this idea from? In fact (I'll remind you), Texas's law explicitly refers to digital identification as something that gets stored and accessed as proof of identity. The bill's own language does not support the idea that identification would be completely transient and instantaneous.

So it is completely reasonable for critics to question these requirements given that nothing in the law would prevent the government from making a case that completely transient identification is insufficient. And even if it was sufficient, from a purely technical perspective it is not clear to me how this magically transient identification would work. Information transmitted between parties gets stored, that's how this stuff works -- what ID verification system are you imagining that can happen instantaneously without referencing any stored information and without any information leaving RAM? I'm not aware of one.

> "Let's assume for a moment that the law says the opposite of what it actually says". But it doesn't.

What? Every single law I referenced requires the transmission of this data and explicitly suggests sharing it with 3rd-party verification services. That's not me reading into the laws, it's just fact.

> It's easy for the government to investigate whether you check IDs: open the site and see if you request ID information. Present fake info and see if you accept it.

What system for instant ID verification that does not rely on storing or accessing stored, indexed information about an identity works like this? How do you propose that sites detect fake info without referencing that info against stored identifying information? Because advocates for these laws keep on saying this is easy and then describing systems that as far as I can tell, do not exist.

-----

I'm accommodating a little bit of a rabbit hole above, but I do need to loop back around to the more relevant point:

> There's literally no reason to have e.g. a knowledge based auth or signed id request hit disk.

Regular, consistent transmission and collection of ID information online presents security risks that are unique to remote identity verification and that are not present in physical spaces like shops and stores. Even if there existed a system that allowed this verification to happen entirely in RAM, that would not address the security points that professionals have raised. And even that magical system would necessarily require storing that information in more places -- on user phones and browsers in an easily transmissible format. It would necessarily require users to become more comfortable sharing information online that they should not be comfortable sharing online.

I'll repeat the same point I made in my previous comment:

> Advocates of these bills ignore that security researchers have an issue with collection and transmission of sensitive data in addition to storage, and so advocates point to narrow, non-specific language about long-term retention as if that solves all of the issues. It doesn't.

Pointing to retention as the only security risk in these laws misrepresents the concerns of security professionals. Ambiguous language that is inadequately explained or elaborated on within bills and that (theoretically) addresses one part of security researchers' concerns is not sufficient to dismiss their overall concerns. Regular uploading and transmitting of ID information to 3rd-parties over the Internet is more dangerous than showing your ID in a liquor store; transmission of that data necessarily requires copying that data, putting it in the hands of multiple parties, verifying their trustworthiness, and interacting with extremely complicated systems that have larger attack surfaces than a cashier looking at your face.

It's just not accurate to act like they're the same.