Digital IDs are Eroding our Digital Rights

“Un-personing”

Earlier this year, the ACLU sounded the alarm on the many propositions for state digital driver’s licenses. When an individual’s ID is digitally stored, scanned, and managed by a centralized system, the government gains the ability to “un-person” them, to revoke their identity at will, with unprecedented speed, convenience, and efficiency.

Observe how the Trump Administration designated 6,000 immigrants holding legitimate Social Security Numbers as dead in the Social Security Administration’s system, sweeping away their access to government benefits, legal employment, and banking services. While this example takes place in the USA, the concerns raised apply to just about any recently proposed or implemented digital ID system.

Digital rights matter

Your digital rights matter, regardless of who you are or what you do. That was the crux of Edward Snowden’s 2014 TED talk. Twelve years later with the converging proposals for centralized digital ID systems across the “free” world, it has never been more relevant. There is a pervasive myth that the only people who need to care about digital privacy are criminals, black-hat hackers, dark web market drug dealers, and organized crime syndicates: a classic case of “you have nothing to fear if you have nothing to hide”. Your digital rights, like any other kind of right matter because “you never know when you are going to need them”. Your rights are the foundation for your freedom and security.

The internet should not be a dystopian panopticon. Everyone does plenty of things on the internet that are perfectly legal yet are still embarrassing or sensitive somehow and warrant hiding — messages between you and your best friend, self-conscious medical symptom searches, even a perfectly pedestrian browser history. Everyone has a right to privacy, the right to live their life without a pair of digital eyes looking over their shoulder. Privacy is a human right.

The EU

The EU proposed their eIDAS 2.0 system in 2021, one of its features being the introduction of the EUDI wallet, a development which threatened to de-anonymize Europeans on the internet, definitively linking their legal identities to their online activity. An open letter signed by 24 entities (including the EFF and Privacy International) released in 2023 warned: “In its current form, the European Digital Identity System would be a gift for Google and Facebook to undermine the privacy of EU citizens. This will impact everyone in the EU and put them at a lower privacy level than people in other world regions.”

By 2025, some alterations had been made to the specifications of eIDAS 2.0 to address concerns over privacy and security, but as of 2026, glaring issues still remain: for example, lack of support for any real pseudonymity and impotent anti-tracking measures. In spite of this, eIDAS 2.0 is currently being implemented. While adoption by citizens is voluntary, it is concerning that member states and their public services and financial institutions are required to implement support for the wallet.

The UK

Insidiously sold as a streamlining of administrative processes, the UK’s digital ID proposal from 2025 highlights fundamental problems with centralized systems. For example (like any centralized authentication system), every time the ID is used, be it physically or online, a request has to be made to a central authority for verification. The result is that the digital ID system stores a detailed log (who, where, when, what) of the ID holder’s virtual and tangible whereabouts. This is exacerbated by the fact that the main “benefit” of this system is that government organizations will have shared access to this information, information that is neatly bundled up and tied to a persistent unique identifier for each ID, accessible by the same UK government organizations that are adopting AI systems internally. Massive amounts of sensitive demographic and activity data available to AI within a monolithic centralized authority really sets off the alarm bells.

Centralized digital ID databases are high-value targets for threat actors. The highest-profile incident occurred in 2018, when India’s massive Aadhaar biometric ID system was breached, with known instances of access to the database being sold for as low as roughly 8 USD online. This risk is especially relevant, as the UK’s digital ID proposal is designed to be an extension of One Login, an existing identity verification system that the National Cyber Security Centre previously raised serious security concerns over — a system that also happens to fail the UK government’s cybersecurity standards.

If that didn’t sound dystopian enough, an individual’s digital ID in this proposal would include a biometric photo, that is, a concrete, unchangeable piece of unique identifying data tied to a digital ID, one that is being justified for facial recognition use by the police.

Venezuela

There already exists a cautionary tale for the hazards of digital ID systems taken to their logical extremes: Venezuela’s “Patria”. Patria is a centralized-authority wet dream, a central digital ID system where the ID is required for everything from healthcare and food benefits, voting, essential services, to immigration and migration. All of these services utilize the same fingerprint scanners, that is, the same scanners that authorize welfare benefits are used for voting. There are no data protection laws here, and as previously established, every authentication of an identity adds a new breadcrumb to the trail of its owner. This ruthless “efficiency” and centralization has been used to great effect by the Venezuelan government, enabling the doxxing of political dissenters and the revoking of the passports of human rights activists.

The connective tissue between Venezuela and the two aforementioned systems from liberal democracies is the use of a centralized system for identity verification. The UK and EU flirt with making digital IDs mandatory for citizens while Venezuela shows just how far this power can be extended when pushed to its logical extremes.

Australia

Australia’s Digital ID Act 2024 appears to be doing some things better: it’s been designed and iterated with individual rights in consideration, participation is strictly voluntary, there are no single identifiers, biometric use is restricted, and most importantly, identities are not stored in a centralized database. The implementation avoids centralization by distributing data and verification across various relevant government agencies. On paper this seems like a reasonable implementation when compared to the other examples.

In June it was announced that starting from December 2026, the system is expanding to allow “accredited private providers” to verify Australian digital IDs and charge for the service. The system is currently in use by 264 government services that are responsible for 113 million transactions a year.

What’s worrying here is that much like in the EU’s case, the armature for reliance and deep integration into everyday life is under construction. The relative decentralization of Australia’s system cuts both ways after that recent announcement: there is technically no centralized database, but now the private sector is involved with sensitive public sector data. There’s also a concern in the risk of a messy web of dependence and interorganizational data leakage between the large number of entities involved. Perhaps Australia’s proposal isn’t even ideal, but rather the bare minimum to be required regarding data protection and centralization and even then, it still looks rough around the edges.

Conclusion

Mandatory digital IDs are being implemented and proposed worldwide. Effectively or literally, digital ID systems hand a concerning amount of power over the identity of citizens. It’s easy to take democracy for granted, to distance a liberal democracy from Venezuela, but you cannot place the security of your rights in the hands of the ruling party. Your rights should be protected systemically. A regime change or election should not make a country’s citizens vulnerable to gross abuses of a system.

This warning is echoed in the 6,000 “un-personed” individuals in the United States, holders of legally acquired Social Security Numbers declared dead in a centralized Social Security Administration database at the orders of the Trump Administration.

Everyone should care about their privacy and digital rights, the right to not be forced into using a digital ID, the right to not be tracked by a central authority every time they have to authenticate their own identity, the right to not have their sensitive data leaked in a government data breach, the right to have these rights protected by a system that respects them. Someday, any or all of us may need our digital rights, let’s not leave that up to chance.