Digital identity: how digital ID works, the main models and the risks

Digital identity is how a person proves who they are, and facts about themselves, using digital technology, whether logging in to a tax portal, opening a bank account or showing a phone at an airport. In the World Bank’s guide for practitioners, identity is ‘the combination of characteristics or attributes that make a person unique in a given context’, and ID systems collect and validate those attributes and give people proof of them ‘in the form of a credential’. Digital ID systems are ‘those that use digital technology throughout the identity lifecycle’, from capturing data to checking identity.

It is now ordinary government business: in the World Bank’s GovTech Maturity Index 2025, 59 per cent of economies reported the use of digital ID for identification and online services. This guide explains the basic terms, the main models, the standards that shape them, real systems by country, the risks and how to judge a system. It draws on IQGov’s weekly EUDI wallet tracker and our reporting; for the wider picture, see the guide to digital government.

What digital identity means

The World Bank’s Identification for Development (ID4D) initiative says ID systems help answer three questions: ‘Who are you?’, ‘Are you who you claim to be?’ and ‘Are you authorized or eligible for something?’ The first is identification, the second authentication and the third authorisation. A social service agency, for example, may use a person’s government-recognised digital ID to check that a new claimant is who they say they are, but still need to check their income against another source, such as a tax register, before deciding whether they are eligible.

Foundational and functional ID. A basic distinction is between two kinds of system. Foundational ID systems, ‘such as civil registers, national IDs and population registers’, are created to identify the general population for a wide variety of transactions. Functional ID systems are built ‘to manage identification, authentication, and authorization for specific sectors or use-cases, such as voting, taxation, social protection, travel, and more’. The line blurs in practice: in the United States, social security numbers and driver’s licences are issued for specific purposes but used as general-purpose credentials.

Legal identity. Behind both sits the idea of legal identity. Proof of legal identity is ‘a credential, such as birth certificate, identity card or digital identity credential that is recognized as proof of legal identity under national law’. The UN’s Sustainable Development Goal target 16.9 is to ‘provide legal identity for all, including birth registration’ by 2030.

Credentials, authentication and the identity lifecycle

An identity is not created once and forgotten. The World Bank describes a lifecycle in four stages:

• Registration. A person claims an identity and provides data and evidence, which is then checked; identity proofing ‘commonly involves a deduplication process to ensure uniqueness’, using biographic data or biometrics.
• Issuance. The provider issues ‘one or more credentials and/or authenticators—e.g., cards, certificates, PINs, etc.’
• Use. The person authenticates, or ‘proves’, their identity to get a service. ID systems can also verify specific attributes such as name or age, using a card’s chip, a barcode or a query to the database.
• Management. Providers update data and credentials and renew, revoke or deactivate them; records may be retired if they turn out to have been created fraudulently, after security breaches or after the person’s death.

Authentication factors fall into three groups: something you have, such as a card, phone or cryptographic key; something you know, such as a password or PIN; and something you are, such as a fingerprint. ‘Using multiple factors increases the level of assurance’, the World Bank notes. Passkeys let people sign in without a password. GOV.UK One Login, the UK government’s sign-in, is rolling out passkeys to more than 23 million users; ‘A passkey lets people securely sign in using their fingerprint, Face ID or PIN instead of a password’. See GOV.UK One Login and passkeys and Singpass and passkeys.

The main models of digital ID

The World Bank sorts government-recognised digital ID into three structures. In a centralised model there is a single provider, in some cases the body that keeps the national register, as with Belgium’s eCard, the Netherlands’ DigiD and India’s Aadhaar. In a federated model, several providers are coordinated or accredited through a trust framework, as with BankID in Sweden, Norway and Finland. In an open-market model, regulated providers work through bilateral agreements with individual agencies; the guide cites the United States. Several models can coexist in one country. Three forms of credential are described below.

National ID cards with chips. A chip on the card lets it prove identity electronically. In Estonia, 99 per cent of residents have an ID card, whose chip ‘can be used as definitive proof of ID in an electronic environment’. The same card serves as a travel document for Estonian citizens within the EU, a health insurance card and a key for digital signatures and i-Voting, according to e-Estonia. See IQGov’s Estonia profile and Estonia’s e-residency record.

Single and federated logins. Some governments run a single login for their online services. Brazil’s gov.br account is described by the government as an identification that ‘proves in digital media that you are you’, and Brazil reported 175 million active gov.br accounts in May 2026. Singapore’s Singpass is ‘every Singapore resident’s trusted digital identity’. The UK has added a regulated private market: under Part 2 of the Data (Use and Access) Act 2025, which mostly came into force on 1 December 2025, private digital verification services can be certified against a government trust framework and listed on a statutory register.

Wallets and verifiable credentials. Another model gives people cryptographically verifiable credentials to keep in a digital wallet. The W3C, the web’s standards body, published its Verifiable Credentials Data Model 2.0 as a W3C Recommendation on 15 May 2025. It defines a verifiable credential as ‘a tamper-evident credential whose authorship can be cryptographically verified’, exchanged between an issuer, a holder and a verifier. A key feature is selective disclosure, ‘the ability of a holder to make fine-grained decisions about what information to share’. Ukraine’s Diia, the EU Digital Identity Wallet and mobile driving licences also hold documents in digital form. The World Bank noted in 2019 that decentralised or distributed-ledger identity models had not yet, to its knowledge, been accepted as legal proof of identity.

Standards and frameworks

ISO mobile driving licence (ISO/IEC 18013-5). The international standard ‘Personal identification — ISO-compliant driving licence — Part 5: Mobile driving licence (mDL) application’ is listed as valid from 30 September 2021. It sets interface specifications between the mDL, the reader and the issuing authority, and leaves out how holders consent to share data and how data and private keys are stored. In the United States, the Department of Homeland Security amended its REAL ID rules, effective 25 November 2024, to waive, temporarily and state by state, the requirement that mDLs be REAL ID-compliant before federal agencies accept them; the rule refers to processes required by ISO/IEC 18013-5:2021 and says at least half of all states are believed to be preparing for or issuing mDLs. The Transportation Security Administration accepts digital IDs at more than 250 airports, though ‘all passengers must still carry an acceptable compliant physical ID’. Login.gov, the US federal sign-in, now accepts mobile driver’s licences stored in Google Wallet or Samsung Wallet, FedScoop reported. See Login.gov and mobile licences, Colorado’s licence at airports and New South Wales’s proof of age.

NIST SP 800-63 levels. The US National Institute of Standards and Technology’s Digital Identity Guidelines, SP 800-63-4, were finalised in July 2025, replacing SP 800-63-3. They promote ‘a risk-based approach to digital identity solution implementation’ and set three scales, each with three levels:

• Identity assurance (IAL), for identity proofing. ‘IAL1 supports the real-world existence of the claimed identity’; IAL2 requires additional evidence and more rigorous validation; IAL3 adds a trained proofing agent in an on-site, attended session and ‘the collection of at least one biometric’.
• Authentication assurance (AAL). AAL1 gives ‘basic confidence’ that the user controls an authenticator; AAL2 requires ‘two distinct authentication factors’; AAL3 requires a public-key cryptographic authenticator ‘with a non-exportable private key that provides phishing resistance’.
• Federation assurance (FAL), for passing identity from one system to another, from FAL1, ‘a basic level of protection for federation transactions’, to FAL3, ‘a very high level’.

Levels in practice. Brazil’s gov.br account shows how levels work for citizens. It has three levels of security and access: bronze, based on biographical data validated in government databases, with single-factor authentication, for less sensitive services; silver, obtained by validating a civil ID document, through an identity provider or by biometric validation, with multi-factor authentication; and gold, obtained by validating a civil ID document, through an identity provider and by biometric validation against a government database, or with a digital certificate, which opens any digital service.

Trust frameworks. Where private firms provide government-recognised identity, the state can set the rules. The UK’s DVS trust framework ‘sets out the rules that organisations must meet to provide certified DVS in the UK’. Certification is optional, but required to appear on the statutory register. By July 2026 the register listed 46 providers offering 64 certified services, and the trust mark is called UK CertifID. See the UK trust mark and register and New Zealand’s trust framework rules.

EU eIDAS and the EU Digital Identity Wallet. The EU’s first eIDAS regulation, Regulation (EU) No 910/2014 of 23 July 2014, covers electronic identification and trust services. Under it, member states could notify national eID schemes on a voluntary basis, and recognition of notified eIDs became mandatory in 2018. A notified scheme must specify assurance levels ‘low, substantial and/or high’, from ‘a limited degree of confidence’ in a claimed identity to ‘a higher degree of confidence’.

The revision, which builds on the 2014 regulation, is Regulation (EU) 2024/1183, published on 30 April 2024 and in force since 20 May 2024. The European Parliament adopted it on 29 February 2024 by 335 votes to 190, with 31 abstentions. Its main points:

• Deadline. Member states must provide wallets up to 24 months after the adoption of the implementing acts; the Commission says they will make wallets available ‘to every citizen, resident and business by the end of 2026’.
• Choice and cost. The wallet is ‘available to any EU citizen, resident, and business who wants to use it’, and citizens and residents ‘should have a right to a European Digital Identity wallet that is safe, free, convenient to use’. Qualified e-signatures for non-professional use will be free.
• Minimal sharing. Users ‘share only what is necessary’; a child, for example, can prove their age ‘without revealing other personal data’.
• Acceptance. Service providers legally obliged to identify their customers unequivocally will have to accept the wallet for authentication.
• Testing. According to the Commission’s pilot page (updated 22 July 2026), six large-scale pilots have tested the wallet, four of which have concluded their work, and 550 private companies and public authorities across 26 member states, as well as Norway, Iceland and Ukraine, are participating. The EU’s Digital Decade target is 100 per cent of EU citizens having access to digital ID by 2030.

IQGov’s own data shows how far countries have to go. When the EUDI wallet tracker was last checked, on 18 October 2026, none of the 27 member states was listed as live: 25 were in development, Lithuania’s status was unconfirmed and no public plan was found for Portugal. Official plans in six countries (Czechia, Finland, Germany, Latvia, Romania and Sweden) put the launch after the end of 2026. Read more in Europe’s wallet moment, Germany names its identity wallet d-you and Finland and Bulgaria put wallet supervisors in place.

The EU wallet for banks, payments and cross-border services

Article 5f of the eIDAS Regulation, added in 2024, says who must accept the wallet. Public services come first: where member states require electronic identification to access an online service provided by a public sector body, ‘they shall also accept European Digital Identity Wallets’.

Banks and other private firms. Under Article 5f(2), private relying parties, meaning businesses that rely on the wallet, must accept it where Union or national law or a contract requires them to use strong user authentication for online identification, ‘including in the areas of transport, energy, banking, financial services’ and seven other sectors. Microenterprises and small enterprises are exempt. The timing, as written in the law, is ‘no later than 36 months from the date of entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6) and only upon the voluntary request of the user’. Member states’ 24-month deadline to provide a wallet (Article 5a(1)) runs from the same implementing acts, so private acceptance falls due a year later; Europe’s wallet moment sets out the dates. A relying party must also ‘register in the Member State where it is established’, stating the data it will request (Article 5b).

Payments and strong customer authentication. The regulation defines strong user authentication as using ‘at least two authentication factors from different categories’: knowledge, possession or inherence. That closely follows strong customer authentication under the EU’s second Payment Services Directive (PSD2), which, as the European Banking Authority sets out, means authentication based on the use of ‘two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is)’. Recital 62 of the regulation says secure electronic identification and attestations should help the financial sector, for example ‘to support the fulfilment of strong customer authentication requirements for online identification for the purposes of account login and of initiation of transactions in the field of payment services’. The Commission’s pilot pages say: ‘Banks will be enabled to use wallets to enact strong customer authentication.’

What the pilots tested. The four original large-scale pilots began in April 2023, and the Commission’s pages say each one’s work ‘began in 2023 and ended in 2025’. Two of them tested payments:

• NOBID, with organisations from Denmark, Germany, Iceland, Italy, Latvia and Norway, tested a payment use case, ‘Allowing citizens to perform secure transactions for onsite and remote payments’. On 8 September 2025 the consortium reported that German tests included ‘a combination of a payment transaction with age verification of the citizen’, and Icelandic users tried ‘making payments in an online store’.
• EWC, the EU Digital Wallet Consortium, piloted three use cases: travelling, payment and organisational digital identities; its payment demonstrations include ‘Online payments with an EUDI Wallet’.
• POTENTIAL tested six use cases, including opening a bank account: ‘Instant ID authentication when opening a bank account’.
• DC4EU covered education and social security, testing the Portable Document A1, the European Health Insurance Card, educational diplomas and professional qualifications, not payments.

Two new consortia began in 2025; one, WE BUILD, is ‘focusing on business and payment use cases’, according to the Commission’s pilot page (last updated on 22 July 2026).

Qualified trust services and attestations. The wallet also holds electronic attestations of attributes, such as ‘diplomas, licences, birth certificates or powers and mandates’. A qualified attestation is one ‘issued by a qualified trust service provider’ that meets the requirements in Annex V, and a qualified provider is one that ‘is granted the qualified status by the supervisory body’. Qualified attestations, and those issued by or for a public body responsible for an authentic source, ‘shall have the same legal effect as lawfully issued attestations in paper form’ (Article 45b).

Across borders. Recognition of notified national eIDs is not new (see above): under Article 6 of the 2014 regulation, an eID notified at level substantial or high ‘shall be recognised’ by another member state’s online public services that require electronic identification at level substantial or high, provided its level is at least the one the service requires. The 2024 regulation adds wallets: member states tell the Commission about each certified wallet, and the Commission publishes a list of them in the Official Journal (Article 5d). An attestation from a public body responsible for an authentic source in one member state is recognised in all member states (Article 45b(3)). IQGov’s EUDI wallet tracker shows how far each country has got; see also Germany’s wallet law and Finland and Bulgaria’s wallet supervisors.

Digital ID by country: examples from every region

Estonia, Europe. A chip-based national card held by 99 per cent of residents is used to log in to banks, check medical records, submit tax claims and vote online, according to e-Estonia. Estonia also shows the risks of a single card design (see ‘Security and breaches’ below).

European Union. The EU Digital Identity Wallet is meant to let people access public and private services online and offline, store documents ‘from a train ticket to a university diploma’ and make legally binding e-signatures. IQGov’s tracker follows each member state.

United Kingdom, Europe. GOV.UK One Login has more than 23 million users, and more than 300,000 switched to passkeys during the initial trial. Alongside it, the statutory register of certified private digital verification services went live on 1 December 2025; many of the services are also certified for right to work, right to rent and criminal records (Disclosure and Barring Service) checks.

Ukraine, Europe. The Ministry of Digital Transformation said in October 2025 that over 23 million Ukrainians use Diia, which offers more than 70 digital public services and 33 digital documents. See The app that would not go down.

India, Asia. Aadhaar is a ‘biometric based digital identity platform’. By March 2026 more than 144 crore (1.44 billion) Aadhaar numbers had been generated, and over 2,707 crore (27 billion) authentication transactions were carried out in 2024–25, according to India’s Press Information Bureau. The same source says the DigiLocker document wallet, launched in 2015, had 67.63 crore (676 million) users on 5 March 2026. See Aadhaar adds face authentication and Aadhaar abroad.

Singapore, Asia. Singpass, created by the Government Technology Agency (GovTech), gives access to over 2,700 services across 800 government agencies and businesses, with over 41 million transactions every month by 5 million users. Its app carries a Digital IC to prove identity at government counters, and face verification is compulsory for all users. See also Vietnam’s cross-border test with Singpass.

United Arab Emirates, Middle East. UAE PASS, ‘the unified national digital identity’, has exceeded 12 million registered users, Digital Dubai said in July 2026; it is used for government and private services and to sign documents. See The Gulf’s government platforms grow up.

Ethiopia, Africa. Fayda, the national digital ID, had more than 52 million registrations, 150 integrated partners and over 208 million electronic know-your-customer (eKYC) verifications as of 9 October 2026, according to Biometric Update. Its partner portal documents sign-in through the OpenID Connect standard. See also Malawi’s Nzika wallet.

Brazil, Americas. The single gov.br account had 175 million active accounts in May 2026, with the bronze, silver and gold levels described above. See also Brazil’s courts and civil identification.

United States, Americas. The World Bank cites the United States as an example of the open-market model. Federal guidance comes from NIST SP 800-63-4, and states issue mobile driver’s licences that TSA accepts at more than 250 airports. See Social Security’s online accounts.

The risks: exclusion, privacy, breaches and function creep

Exclusion. Digital ID cannot help people who have no ID at all. World Bank ID4D estimates published in February 2023 found that some 850 million people globally do not have an official ID, mostly in low- and lower-middle-income economies in Sub-Saharan Africa and South Asia. Over half are children whose births have not been registered, and women in low-income countries are 8 percentage points less likely than men to have an ID. The World Bank’s guidance is that ‘no one should be denied identification or associated services because they lack mobile or internet connectivity or digital literacy’. See The offline citizen.

Privacy and function creep. The World Bank lists the risks of any ID system: security breaches, exposure of sensitive data, unauthorised disclosure, surveillance, discrimination, unjust treatment from wrong data, identity theft and function creep, ‘using and disclosing personal data that was collected for one purpose for other purposes without a person’s consent’. It warns that digital ID systems ‘can amplify them and increase the scale of their consequences’, especially when large amounts of data sit in centralised databases or one identifier is used across many systems. Courts have tested these limits:

• India, 2018. On 26 September 2018 a five-judge bench of the Supreme Court upheld the validity of Aadhaar but struck down part of Section 57 of the Aadhaar Act, so that, as reported at the time, mobile companies could not demand Aadhaar and citizens would not need to link it to bank accounts or mobile numbers. Scroll.in argued that the judgment’s wording on which bodies were covered was inconsistent.
• Jamaica, 2019. In April 2019 the Supreme Court declared the National Identification and Registration Act ‘unconstitutional, null, void and of no legal effect’, according to LiveLaw. Chief Justice Bryan Sykes said the regime as it then stood did not offer sufficient protection for the sensitive data to be collected, the Gleaner reported.
• Kenya, 2021. In October 2021 the High Court quashed the government’s decision of 18 November 2020 to roll out Huduma Namba cards, because no data protection impact assessment had been carried out, and ordered one under the Data Protection Act, Capital FM and Hapa Kenya reported.

Security and breaches. A flaw in a widely used component can hit a whole country at once. In Estonia, an international research team informed the Information System Authority (RIA) on 30 August 2017 of a vulnerability that affected around 800,000 Estonian ID cards. The certificates of affected cards were suspended from 3 November 2017, and holders could renew them remotely from their own computers. At the time of the suspension, the prime minister, Jüri Ratas, said that as far as was then known there had been no instances of e-identity theft, Phys.org reported. Identity theft is also a risk where credentials are weak; see the IRS identity theft backlog.

Vendor lock-in. Dependence on one supplier can raise costs and reduce flexibility. The World Bank’s principles call for ‘vendor and technology neutrality’ and procurement rules that prevent technology and vendor ‘lock-in’, and say open APIs let a component of the ID system ‘be replaced with minimal disruption’.

How to judge a digital identity system

The ten Principles on Identification for Sustainable Development, endorsed by 25 international organisations, associations and development partners, are high-level standards that the World Bank says practitioners should follow. Combined with the standards above, they give nine questions any official, journalist or citizen can ask:

• Who is covered, and who is left out? The first principle is ‘universal coverage for individuals from birth to death, free from discrimination’, for all residents, not just citizens.
• What does it cost the person? The World Bank says birth registration and the first issue of any credential that is mandatory, in law or in practice, should be free.
• Is there a non-digital route? Even the US airport scheme requires travellers to carry a physical ID, and the EU wallet is for those ‘who want to use it’.
• How much data does each check reveal? Authentication should ‘only provide “yes or no” confirmation of a claimed identity’, or the minimum data a law requires; selective disclosure in verifiable credentials and the EU wallet is built for this.
• Does the level of assurance match the risk? NIST asks agencies to select controls ‘by determining the assurance level required’; eIDAS uses low, substantial and high.
• Is sign-in resistant to phishing? NIST’s highest level requires ‘a non-exportable private key that provides phishing resistance’; passkeys, as on GOV.UK One Login, are one route.
• Is there a law, and independent oversight? The principles call for a comprehensive legal and regulatory framework, and ‘independent oversight and adjudication of grievances’. Kenya’s court case turned on a missing impact assessment.
• Is it built on open standards? Look for international standards such as ISO/IEC 18013-5 or the W3C data model, and for vendor and technology neutrality.
• Can it recover from failure? Estonian card holders could renew affected cards remotely from their own computers; ask how a system would revoke and reissue credentials at scale.