Yes, I read that but how? We 100% should be more concerned with fed implementation than what states were doing, as I'm betting it's going to be as stupid as UKs approach to app based verification.
I'm not sure they could even do that in a reasonable way when there are use cases like offline installs, no cameras, etc, but given Windows requires hoops to jump to avoid getting an MS account, that's probably not going to be a concern of theirs (as Congress is exceptionally inept). At least the CA law seems to consider that, given it's just self report.