Florida Just Deleted a Federal Identity Standard From State Law

What happens when a legislature finds a federal identity-assurance standard already sitting inside its own statute and decides to take it back out? Florida just did that, and it is the rare digital ID story with a genuinely good ending.

CS/HB 961 passed the Florida House 113-0 and the Senate 37-0 this year. It is now Chapter 2026-56, effective July 1, 2026. The bill is about salvage titles and odometer fraud, not digital identity, until you read what it actually changes.

Before this bill, Florida already required an electronic signature on the odometer disclosure an insurance company files when a wrecked or flood-damaged car gets a salvage title or a certificate of destruction. Buried inside that requirement was a specific technical citation: the identity-verification system behind that signature had to meet NIST Special Publication 800-63-3, Level 2 or higher, across three categories the standard calls Identity Assurance, Authenticator Assurance, and Federation Assurance. That is a federal identity-verification benchmark, not a Florida-written one, sitting inside Florida statute.

H0961 deletes it. Section 1 strikes the NIST Level 2 citation from s. 319.30(3)(d), Florida Statutes, and replaces it with a plain requirement: the insurer or its authorized agent has to build control processes acceptable to the Department of Highway Safety and Motor Vehicles that verify identity, preserve records, and keep the system secure and auditable. Florida House committee staff confirmed the deletion directly in the bill’s official analysis. The state did not add a federal identity mandate this year. It took one out.

This law still does not touch you if you are buying, selling, or driving a car in Florida. It regulates insurance companies and the vendors they hire to process one specific electronic signature. No Florida driver gets a digital credential. No physical ID becomes invalid. Nobody’s phone gets searched.

Most of the digital ID stories that deserve scrutiny follow the same shape. A bill hard-codes a federal identity-assurance standard into state law for a narrow, defensible purpose. Nobody objects, because the purpose is narrow. Then a later bill points back to that citation and extends it to something bigger, and the hard part, getting the standard into state code in the first place, is already done. That is the shelf our review exists to watch for.

H0961 runs that pattern in reverse. Florida had already built the shelf, and nobody was watching it closely. This year, instead of building on it, the Legislature took it down. Insurers still have to verify identity. They just no longer have to point to one named federal framework to do it.

“Acceptable to the department” hands DHSMV real discretion to decide what controls satisfy the law. An agency could use guidance or approval practice to recreate something close to the old NIST standard without another vote in the Legislature. That risk is real, and it is bounded. The statute still lists exactly what DHSMV’s controls have to cover: identity verification, record integrity, security, confidentiality, preservation, disposition, and auditability. The whole requirement stays confined to one insurer-filed transaction. Watch how DHSMV implements it. That watchfulness is not opposition to the bill.

Support. H0961 keeps the anti-fraud protections Florida needs in salvage-title transactions and removes a rigid tie to a federal identity-assurance framework that never needed to be written into state law in the first place. Florida did not build a digital ID system this year. It dismantled a small piece of one nobody had noticed yet.

This is our read of the bill. We encourage you to read it yourself and reach your own conclusions.