Governments are increasingly offering people the option of getting a digital counterpart to the paper and plastic identity credentials that agencies issue, which can be stored in a digital wallet.

State governments have been at the forefront with new mobile driver’s license (mDL) initiatives; however, a variety of federal, state, and local agencies are considering launching similar initiatives that might encompass other credentials, including passports, Social Security cards, and birth certificates. Together, these digital IDs represent a new class of verifiable digital credentials (VDCs) that will transform the ways that people in the United States prove their identity, both in person and online.

VDCs have the potential to improve security, privacy, usability, and inclusivity for individuals and business if they are designed, deployed, and used responsibly. However, the introduction of VDCs — specifically government-issued ones — also brings the possibility that they could erode security, privacy, and civil liberties.

Among the top concerns is that, by making it easier than ever for individuals to prove who they are online, companies and government agencies will start to ask for ID for use cases where they rarely — if ever — did so before. And in doing so, they could significantly change the balance of power in terms of what is expected of individuals to allow them to engage and transact online.

For example, most everybody agrees you should be able to use your VDCs for use cases where you need to prove who you are as part of completing a transaction online – think applying for a credit card or government benefits.

But should a restaurant be able to ask you to prove who you are just to make a take-out order – including sharing your height and weight? What if a retailer wants to collect all the data from your mDL to offer “a more personalized experience?” It’s not hard to imagine a world where – without any constraints on who can ask for ID and in what circumstances – people are expected to share their identity every place they go online.

In other countries, governments are setting rules to govern who can ask for proof of ID online and in what circumstances. In the U.S., however, neither the Federal nor most state governments have focused on this issue.

To help address these concerns, the Better Identity Coalition released an initial straw man of a “voluntary code of conduct” that could help to address these concerns. The code would establish a set of rules that digital wallet providers and others in the digital identity ecosystem can pledge to adhere to and use as a tool to restrict inappropriate or overly invasive requests for identity information.

The goal is that, by proactively setting rules of the road for the use of VDCs, this code can help mitigate the risks involved with new government digital credentials while ensuring that the benefits of improved security, privacy, usability, and inclusivity are fully realized.

Our early conversations around this concept with stakeholders from digital wallet providers, identity issuers, privacy and civil liberties advocates, and major online service providers has been quite positive – although it is safe to say that not everybody is on the same page in terms of what should go into a code or how it should be enforced. As we release the straw man, we are also posing questions to the public, including:

• Would this Code be a net positive for the identity ecosystem?
• What are the elements that you like? Which elements (if any) are a concern?
• Are the initial use cases – and associate attribute bundles tied to those use cases – the right ones?
• What processes should be used to update the code?
• Should specific use cases be banned? Or just “strongly discouraged?”

The Better Identity Coalition is accepting comments on the code until December 15, and we welcome your input! Our goal is to incorporate feedback and release version one of the code in the first half of 2026.

You can access the code on GitHub here. A PDF of the code can also be found below but comments will only be accepted through GitHub. 

‍