Florida’s $114 Billion Budget Has Two Sentences About Government Identity Systems. That’s the Problem.

Can you hold a $114 billion budget accountable if the parts that matter most are one sentence long? Florida’s 2026-2027 budget package is a real test of that question, and the honest answer right now is no.

The General Appropriations Act, H5001-E, and its companion implementing bill, H5003-E, passed during the Fifth Special Session and were signed in June. Together they appropriate $114,461,515,410 in total funds after the Governor’s line-item vetoes, which totaled roughly $1.66 billion. Both bills run hundreds of pages. Almost nobody outside the agencies themselves reads them section by section, and that’s exactly the terrain where accountability goes to die.

Buried in the general appropriations act, now Chapter 2026-232, are two sections that deserve more attention than a budget bill’s page count usually gets. Section 177 carries forward unspent money from the Department of Management Services’ “Legacy Authentication and Identity Verification Replacement Pilot.” Section 208 does the same for the Department of Commerce’s “Identity Governance and Administration solution.” Both provisions survived the Governor’s veto pen untouched.

Neither section states a dollar amount. Neither names a vendor, a technology, or a covered population. Neither describes what data these systems collect, how long they keep it, or which other agencies can access it. Each one simply says the leftover money from last year’s appropriation continues “for the same purpose,” a purpose the current bill never actually describes. That absence should stop you cold in a budget this size. To know what these programs really involve, you’d have to dig up last year’s budget bill and the underlying procurement records, none of which are part of what the Legislature voted on this year.

To be clear about what this isn’t: nothing in these sections requires a Floridian to obtain a digital credential, invalidates a physical ID, or authorizes a device search. This is not a citizen-facing digital ID mandate. It’s something narrower and, in its own way, more concerning: government identity infrastructure getting funded, year after year, through a mechanism specifically designed to avoid the kind of scrutiny a brand-new program would attract.

The implementing act, Chapter 2026-233, runs 159 sections translating that budget into operating authority: transfers, spending conditions, agency rulemaking power, and a network of temporary provisions that mostly expire July 1, 2027. Section 155 ties almost all of it to the fate of the underlying appropriation, meaning a single line-item veto in H5001-E can silently void a provision in this bill, or leave it standing, depending on exactly which specific appropriation item got struck.

That structure makes this bill functionally unreadable by anyone without a specialized crosswalk between the two documents. Section 80 restricts data-processing fund transfers. Section 97 lets state data centers realign budgets across departments. Section 98 caps a data-center assessment at 3 percent. Those are the pieces our review could independently verify against the enacted text. Dozens of other sections carry the same kind of consequence, and confirming any one of them requires tracing it back through the veto record, item by item, a task the Legislature has effectively outsourced to whoever bothers to do it after the fact.

Both bills use the same mechanism: real policy and real infrastructure decisions, made through a vehicle too large and too technical for ordinary legislative or public scrutiny to actually reach. That’s not a partisan complaint. It’s a structural one. A single sentence reappropriating money for an “Identity Governance and Administration solution” gets exactly the same up-or-down vote as a line funding highway repairs, even though one of those things deserves a real debate about data retention, cross-agency access, and citizen recourse, and the other doesn’t.

Nobody’s asking the Legislature to shut down legitimate government IT modernization. Replacing legacy authentication systems and managing employee identity access are ordinary, defensible government functions. What’s missing is the disclosure that should come with them: the dollar amount, the system’s actual scope, what data it touches, who else can see it, and what happens if it gets misused. None of that is unreasonable to ask for. All of it is currently absent from the only text the Legislature actually voted on.

A budget this size, funding identity infrastructure this consequential, shouldn’t run on two sentences and a footnote pointing back to last year. Before either project gets another dollar in the next budget cycle, the Legislature should require a public accounting: what these systems do, what they cost, and what limits apply to the data they collect. Until that happens, “for the same purpose” is doing a lot of work for a sentence nobody outside two state agencies can actually verify.

This is our read of the bills. We encourage you to read them yourself and reach your own conclusions.