The Expanding Digital ID Landscape
What You Need to Know in 2026
In This Report
EU EUDI Wallet Rollout Status and Timeline
All 27 EU member states must offer compliant digital identity wallets by December 2026.
The eIDAS 2.0 regulation represents the most ambitious digital identity infrastructure project in human history. By the end of 2026, every EU citizen, resident, and registered business will have access to at least one government-approved Digital Identity Wallet.
What Will Be Stored in EUDI Wallets?
- National ID cards and driving licences (electronic versions)
- Educational credentials (diplomas, certificates)
- Health records (vaccination status, medical history)
- Payment details and financial identifiers
- Employment information and professional qualifications
- Travel documents and residency status
- Any additional certificates or attributes issued by public or private entities
Timeline for Mandatory Acceptance
2027 — Phase 1: Banking and Financial Services
Financial institutions will begin accepting EUDI wallets for customer onboarding and verification.
2027-2028 — Phase 2: Public Services and Travel
Government agencies and airlines will integrate wallet authentication for services and border crossing.
2028-2029 — Phase 3: Private Sector and Broad Rollout
Retailers, age-verification systems, and general online services will adopt EUDI for identity checks.
Key Risks: EU Perspective
- Centralization of identity data: While wallets are device-based, the issuance, revocation, and audit trails are centralized at the national level.
- Interoperability as surveillance risk: Seamless cross-border identity sharing creates opportunities for profiling and tracking.
- Government mandate with no exit: Once EUDI becomes required for banking, employment, and travel, citizens have little choice but to participate.
- Future scope creep: Political pressure could expand EUDI to include health status, financial transactions, location data, or political affiliations.
UK Policy Evolution and Remaining Risks
After major public backlash, the UK government abandoned mandatory digital ID for right-to-work checks — but continues pushing voluntary digital credentials with significant long-term risks.
What Changed (And What Didn't)
✓ Victories Won Through Activism:
- Dropped the mandatory digital ID requirement for right-to-work checks.
- Parliamentary scrutiny forced disclosure of surveillance architecture concerns.
- Public outcry prevented the creation of a single master identity database.
✗ The Threats That Remain:
- Reusable digital credentials are still being developed with the same actors (Vodafone, NEC, Royal Mail) backing the original schemes.
- Mission creep: Voluntary now doesn't mean voluntary later. Infrastructure built for age-verification could be expanded to employment, credit, or benefits access.
- De facto mandates: If enough employers and services adopt digital credentials for convenience, choosing not to participate becomes economically irrational.
- Cross-border data sharing: UK is still committed to interoperability with EU EUDI wallets, creating surveillance vulnerabilities.
Civil Liberties Groups' Position
Organizations like Liberty, Big Brother Watch, and the Open Rights Group continue to argue that digital identity infrastructure — even if technically "optional" — creates a surveillance skeleton key. Once built, it is nearly impossible to dismantle and invites repurposing for political control, immigration enforcement, or social credit systems.
US State mDL Progress + Federal Developments
Mobile driver's licenses (mDLs) have moved from pilot phase to mainstream roll out. Federal adoption is still slow (under 10% in most states), but the infrastructure is accelerating.
Current State of mDL Adoption
Leading Adopters (mDL already available):
Colorado, Delaware, Florida, Georgia, Hawaii, Illinois, Indiana, Maryland, Missouri, Nevada, and others.
In Development:
Most remaining states are running pilots or procurement processes for mDL systems.
Current Adoption Rate:
Under 10% of eligible drivers in most states have activated mDL on their phones. No penalties or incentives yet.
Federal Standardization: ISO/IEC 18013-7
The international standard for mobile driver's licenses (ISO/IEC 18013-7) was finalized in 2024. This creates a common framework for all US states and international travelers. The US NIST (National Institute of Standards and Technology) has aligned federal guidance with this standard.
Federal Funding and Expansion
- NIST Digital Identity Grants: The federal government has allocated funding for state digital ID programs aligned with NIST Cybersecurity Framework and eIDAS interoperability standards.
- TSA Acceptance: TSA PreCheck kiosks at airports already accept certain mDLs for verification. Broader airport adoption is in pilot phase.
- Age-Verification Push: Federal legislation proposals (e.g., AMIR Act) that mandate age verification for age-restricted purchases online will likely accelerate mDL adoption once standards mature.
- Private Sector Integration: Payment processors and financial institutions are exploring mDL integration for customer onboarding and fraud prevention.
Key Risks: US Perspective
- Fragmented surveillance: Each state runs its own infrastructure, but interoperability means a holistic profile is constructible at federal or corporate level.
- No federal privacy floor: Unlike GDPR, there is no US equivalent regulating how mDL data can be used or retained long-term.
- Police surveillance: Law enforcement agencies can potentially access mDL data at checkpoints without warrants or proper oversight in many jurisdictions.
- Contractor lock-in: Private companies (Idemia, Thales, etc.) building mDL infrastructure have incentives to lobby for broader adoption and data monetization.
Documented Concerns from Civil Liberties Organizations
📊 Surveillance and Mass Profiling
Once identity credentials are digitized and interoperable, the temptation for governments and corporations to correlate your movements, purchases, location, health status, and political activity becomes irresistible. A single query can now map your entire life story.
🔒 Data Breach Impact: Irreversible Harm
Unlike passwords or financial information, biometric data (fingerprints, facial recognition templates) cannot be changed. A breach of a central digital ID database would permanently compromise the identity security of millions of people.
⚖️ Exclusion and Coercion
If digital ID becomes mandatory for banking, employment, or welfare access, people without smartphones, digital literacy, or stable addresses face systematic exclusion. Governments can then weaponize access as a coercion tool.
🛑 Mission Creep and Normalization
Today's "voluntary" age-verification system is tomorrow's mandatory identifier for all online activity. Normalizing digital ID for low-stakes uses primes the public to accept it for high-stakes ones (financial control, political dissent tracking).
🔐 Revocation and Denial of Service
Centralized digital ID systems give governments a single lever to freeze all access to services for individuals or groups. This has already been used in Canada, India, and China. The US and Europe are not immune.
🌍 International Interoperability = Export of Control
As digital ID systems become interoperable across borders (EU-UK-US), the opportunity for mass surveillance expands globally. A dissident or refugee's identity can be tracked across continents.
The Difference: Government Wallets vs. Self-Sovereign Identity
| Aspect | Government Wallet (EUDI, mDL) | Self-Sovereign Identity (SSI) |
|---|---|---|
| Control of Credentials | Government holds and can revoke at will | Individual holds; no revocation without consent |
| Data Minimization | Releases full documents; issuers can track usage | Selective disclosure; only proof of required attribute |
| Auditability | Centralized logs; government has full audit trail | Decentralized; minimal or no logs of proofs |
| Interoperability | Designed for seamless integration (risk: profiling) | Open standards; individual controls each integration |
| Privacy Architecture | Centralized + device-based (hybrid) | Decentralized + device-based (no central registry) |
| Dependency on State | High; state controls all issuance and revocation | Low; relies on open standards and user agency |
Why SSI Matters
Government wallets are not inherently bad — they enable legitimate digital services. But they should be complemented by (or eventually replaced by) self-sovereign identity systems where individuals hold their own credentials and control disclosure. This preserves the benefits of digital identity (convenience, security, interoperability) while preventing the dystopian scenario of centralized, queryable records of everyone's life.
Actionable Steps You Can Take Today
1. Understand Your Rights
In the EU, you have the right to refuse digital identity systems under GDPR (right to withdraw consent). In the UK, you retain the right to use analogue identity documents for most services. In the US, state laws vary, but you can opt out of mDL programs where they remain optional.
Stay informed through organizations like Privacy International, Liberty, Big Brother Watch, and the Electronic Frontier Foundation (EFF).
2. Download and Use PowerWallet
Start holding your own verifiable credentials now. Familiarize yourself with zero-knowledge proofs and selective disclosure before you're forced to choose between a government wallet or nothing.
PowerWallet is free and open-source. It works independently of any government system.
3. Monitor Policy Changes
Subscribe to Privacy Intel Dashboard for weekly updates on:
- New digital ID mandates in your region
- Data breaches affecting identity databases
- Legislative proposals affecting privacy
- Safe practices for new systems
4. Advocate for Strong Privacy Standards
If you're in the EU, contact your MEP (Member of European Parliament) about selective disclosure requirements in EUDI implementations.
In the UK, engage with parliamentary committees reviewing digital identity policy.
In the US, support legislation that mandates privacy-by-design in federal digital ID funding and state mDL programs.
5. Use Privacy-Preserving Alternatives Now
For age-verification, authentication, and credential sharing:
- Use ProofForge to intercept identity requests before they reach trackers
- Store sensitive documents in ShadowVault (encrypted, local-first)
- Request credentials in W3C Verifiable Credential format from employers, universities, and banks
- Refuse systems that require full document uploads; insist on attribute-based verification
6. Join the Community
Participate in our community forum and live monthly sessions with cryptographers, privacy engineers, and civil liberties experts. Share your concerns, learn from peers, and stay ahead of the curve.
Ready to Take Back Control?
Download PowerWallet today and start protecting your identity before government systems become mandatory.
Download Free PowerWallet