Do the laws that mandate identity verification set security standards that the websites which collect and verify the data must meet?