To understand their concerns, Government Technology spoke with Jay Stanley, senior policy analyst from the ACLU's Speech, Privacy and Technology Project. Watch the full interview in the video below.
The letter states that identity systems must be built without the technological ability for authorities to track when or where the identity is used, which includes when “either the identity verifier or user’s application interacts with or ‘phones home’ to the identity issuer or another third party.”
It goes on to add that many authorities are, sometimes unknowingly, adopting identity systems with phone home capabilities, and asks governments to instead turn toward identity solutions that have no phone home capabilities in a way that would prioritize privacy and security over interoperability and ease of implementation.
“If you're going to do a digital ID, then at the very least it should have strong privacy protections in the way that it's built as a technological matter,” said Stanley. “But we're seeing that the version that's being pushed in the states, some of them will allow the states to ping the government every time you show your ID to a doctor's office, a liquor store, a bar, a website, maybe an adult website — and all that data would flow to the government. This is not a way to design a digital ID system if we're going to have a digital ID system.”
The ACLU has also advocated for stricter policies for digital identity systems to state legislators, publishing recommendations last fall that called for lawmakers to mandate that digital ID systems must be able to offline, similar to how a plastic driver’s license can be shown to another person in a way that creates no digital trace of the transaction.
When asked if any state approaches had emerged that the ACLU could support, Stanley pointed to Utah as the best example of proactively considering privacy protections.
During the 2025 season, Utah lawmakers voted in favor of SB 260, which was later signed into law by Gov. Spencer Cox. The law requires that when a digital ID is used, the transaction must be free from surveillance, tracking or monitoring. It also guarantees that the individual, not the state, controls their digital identity and the data it transmits.
Other components of the legislation focus on minimizing data shared, like allowing a person to prove they are over 21 without actually revealing their birth date or age. Finally, it makes it illegal for the government to punish someone or withhold services if they choose to use a physical ID instead of a digital ID.
The ACLU has other concerns apart from the phone home capabilities with digital IDs. They’re asking governments to ensure police officers or other verifiers do not take physical possession of a user’s phone to verify identity in a way that may result in the officer or relying party gaining access to other user data.
A Government Technology analysis of public data found at least 4.5 million people are currently enrolled in the digital identity programs that have been launched across the country. That number, however, only represents about 7 out of 100 eligible licensed drivers who live in states with active programs. Additionally, concerns have been raised about accessibility and if mobile driver’s license programs may further widen the digital divide. Both topics are explored in depth in the video below.
Ultimately, Stanley asserted that the goal of the ACLU is to encourage governments to consider these factors, before it may be more difficult to make changes to the framework.
“We need to get lots more states on board with this demand for good privacy and accessibility protections,” said Stanley. “Otherwise this will become a bandwagon. You know, at a certain point, all the states are going to have to be interoperable, and there's going to have to be a standard, and we don't want to get locked in to an authoritarian government and corporate spying mechanism, potentially for generations, because it's going to be very hard to change this once it gets locked in.”
