Utah doesn’t issue identities anymore — it ‘endorses’ them

A new law in Utah makes a unique distinction in how the state treats identity.

Signed into law last March, SB 260 creates several new protections for residents, including that “the state does not establish an individual’s identity,” but rather that, in some instances, it “endorses” it. Or in the words of Alan Fuller, Utah’s chief information officer: “The government doesn’t give you your identity — your parents do.”

Fuller said the new law is a key piece of the state’s work to develop mobile driver’s licenses and digital identity cards that prioritize individuals’ rights. As in more than a dozen other states, Utah offers a mobile driver’s license, and has for several years, but Fuller admitted it’s rather basic. Though Utah’s has some features, like the ability to selectively reveal information, it’s essentially just a picture of a license, he conceded.

The new state law was needed to tee up further identity work in Utah. Fuller said the state needs to create mobile driver’s licenses and digital identities that have a more comprehensive feature set, like the ability to verify identity online.

“We’re glad we did our mobile driver’s license,” he said. “It was a great first step, but now we realize we need to build on that and build a more robust digital identity that could be used in a number of different cases.”

Though states also offer regular identity cards, the driver’s license is in many cases the de facto identity document. Fuller said he wants to decouple the two.

“It’s really an accident of history that the driver’s license in every state has become the primary form of identity credential and we’d really like to separate that so you have an identity credential, regardless of whether you’re a driver or not,” he said.

Utah is also interested in legislating online protections for minors, and is among the states to have mandated, in 2023, that adult websites take additional steps to ensure they only serve their content to adults. Utah’s law doesn’t explicate just how adult websites should verify users’ ages, but online age verification usually amounts to the honor system, which is not very effective. Fuller said he wants the state to issue digital identities to minors that could aid in such verifications, but that would also fill a need in the analog world.

“We need a digital identity credential for minors,” he said. “For example, when someone goes to kindergarten, usually now the parents have to go get a birth certificate to say ‘I am the guardian of this child.’ Wouldn’t it be great if they already had a digital credential issued by the state that says this is who the child is and this is who the guardian is?” 

Nick Doty, a senior technologist at the Center for Democracy and Technology, a digital rights nonprofit, said he hadn’t heard of any other states making the legal distinction that Utah has. It’s “significant,” he said, because the government’s control of identity bears risks to privacy and free expression.

Doty said that while Utah’s new ID law offers needed legislative protections, the full suite of protections his organization advocates for will require participation in several domains, including private industry, standards organizations and state governments. 

“I’m not optimistic about good federal policy on this at the moment,” he said. “But it’s also not just a state issue. There are going to be international technical standards that apply so you can use your identity in different places. And clearly there are going to be states that are issuing digital identities and providing hopefully some protections.”

Doty said there’s a lot of conversation right now among groups like the World Wide Web Consortium and the International Organization for Standardization on how to appropriately issue mobile driver’s licenses and how they should be used online. Among the issues is whether a popular ISO standard for mobile driver’s license should include a requirement that allows the credential to surveil users.

“But there are many more technical protections that are relevant,” Doty said. “Like protections against tracking across websites. We’re not just concerned about whether your government will find out where you’re using your ID, but if you try to prove your age to multiple websites, are those websites going to be able to track you together?”