A Utah-led governors consortium is giving ten states until January 2027 to adopt privacy-first digital ID rules. The goal, according to the report, is to act before the ISO 18013-5 mobile ID standard spreads further without oversight. Experts quoted in the coverage say that standard retains government tracking capabilities. For residents, the debate comes down to one question: digital ID credential tracking privacy, and whether the people who issue your mobile ID can see where and when you use it.
A note on sourcing: the source article is short, and the text available to us is truncated. It names a consortium, a ten-state group, a January 2027 deadline, and the ISO 18013-5 standard. It also mentions someone named Bramwell, but the available text does not complete that reference. This post sticks to those points and explains the technology in general terms. It does not claim details about the consortium's framework that the source does not confirm.
What the January 2027 Deadline Means for Residents
According to the report, ten states have until January 2027 to adopt privacy-first digital ID rules. The logic behind a deadline is that technical standards tend to harden once they are widely deployed. If mobile IDs roll out across more states under a standard that permits tracking, and no oversight rules exist, those design choices become difficult to reverse.
For residents, the practical effect is that the next several months are when rules are most likely to be shaped. State legislatures, motor vehicle agencies, and governors' offices can still decide what data a digital ID system may log, how long it may keep that data, and who may access it. Once a system is live, changing those settings usually means rebuilding parts of it.
How Credential Tracking Works in ISO 18013-5 Mobile IDs
ISO 18013-5 is an international standard for mobile driver's licenses. It defines how a phone can present identity data to a verifier, such as a police officer, a retailer, or an airport checkpoint. The source says experts believe the standard retains government tracking capabilities. The article text we have does not spell out the mechanism, so here is the general concern in plain terms.
Tracking risk in any digital credential system usually comes from a few places:
- Verification logs. If a verifier's app or a back-end service records each time a credential is checked, those records can build a history of where you showed your ID.
- Contact with the issuer. If a check requires the system to reach back to the government issuer, the issuer may learn when and where the credential was used.
- Retention. Even modest logs become sensitive when they are kept for a long time or combined with other databases.
Whether a specific state deployment does any of these depends on how it is configured, which is exactly why oversight rules matter. A standard can allow privacy-protective use and still permit tracking. The rules around it decide which one residents get.
Real-world rollouts show why this matters. Our coverage of Indonesia's IKD digital ID passing 20.5 million users looks at privacy risks that appear when a national digital identity scales quickly.
Privacy-First Alternatives: Selective Disclosure and Zero-Knowledge Proofs
Privacy-first digital ID design generally relies on two ideas.
Selective disclosure lets you share only the attribute a verifier needs. A bar needs to know you are over 21, not your address or full birth date. A well-designed credential can reveal just that one fact.
Zero-knowledge proofs go a step further. They let you prove a statement is true, such as "I am over 18," without revealing the underlying data at all, and without giving the verifier something that can be linked back to you across visits.
These techniques reduce what verifiers learn, but they do not automatically stop tracking. Logging at the verifier, contact with the issuer, and long retention periods can undermine them. Privacy-first rules therefore need to cover both the cryptography and the surrounding data practices.
The same tension appears in online age checks. A roundtable by SFLC.in on privacy risks in age verification shows how verification systems can collect more than they need.
Rights to Look for in Your State's Digital ID Rules
The source does not list the consortium's specific requirements, so treat this as a reader's checklist rather than a description of its framework. When your state debates or launches a mobile ID, look for:
- A ban on tracking use. Rules that prohibit the issuer from logging where and when you present your credential.
- Data minimization. Verifiers should request only the attributes they need, and the system should support selective disclosure.
- Short, defined retention limits. Any logs that exist should be deleted on a set schedule.
- Independent oversight. An audit process or regulator that can check whether the system behaves as promised.
- Voluntary use. A physical ID option that remains fully valid, so no one is forced into the digital version.
- Limits on secondary use. Restrictions on sharing data with other agencies or commercial parties.
What This Means For You
If you live in one of the ten states, the next few months are when public input counts most. If you live elsewhere, the same questions apply as mobile IDs expand. You do not need to avoid digital ID entirely. The aim is to know how your state's version handles logging and retention before you rely on it.
In the meantime, you can keep a physical ID for situations where you would rather not generate a digital record, and you can ask your motor vehicle agency what it stores when a mobile ID is verified.
Takeaways
- Check your state's program. Look at your motor vehicle agency's published privacy policy for its mobile ID and see whether it addresses logging and retention.
- Ask about tracking directly. Contact your state representative or agency and ask whether presenting your credential can be recorded or traced back to you.
- Support privacy-first rules. Comment on proposed rules or legislation that limit tracking and require selective disclosure.
- Keep options open. Retain a physical ID where possible.
- Learn from other rollouts. The Indonesia IKD and SFLC.in age-check articles linked above show how digital ID and verification systems can create privacy risks when safeguards lag behind deployment.
Digital ID credential tracking privacy will be decided in the rules written now, so it is worth finding out what your state is planning.
