Digital Driver’s Licenses Threaten to Create a “Great Internet Lockdown”

Subscribe to the Free Future Newsletter
Free Future home
Imagine you wake up one day, turn on your computer or phone, and try to log in to a social media site. You’re greeted by a message: “We need to confirm your identity. Click here to send us your digital ID.” You’d signed up for a digital driver’s license months ago to access your IRS tax information online — but why is this social media asking for it?
Seemingly overnight, you find demands to share your digital ID coming from every direction, online and off. Want to enter a convenience store? Scan your ID. Want to browse a clothing store, buy a cup of coffee, park your car? Scan your ID. When you try to watch a video online, log on to social media, or look at a news site, you get a pop-up demanding that you “click here to submit your driver’s license.” Now that the infrastructure exists, you find yourself asked to submit your license at every turn. And submit you will, because you will have little choice.
Two converging trends are threatening this future. The first is a craze for identity verification laws. Starting with one conservative lawmaker in Louisiana pushing to block minors from accessing adult material, demands for online age verification policies, previously blocked by the Supreme Court, have become a trend. These laws threaten to build a bureaucratic wall between Americans and the information they need and have a First Amendment right to access — information that encompasses far more than adult material.
The other much less noticed trend is a push to create an unbreakable version of that bureaucratic wall: digital driver’s licenses that can be used online. So far more than half the states have enacted such digital driver’s IDs or are moving towards doing so. This push is coming from a number of directions. Big businesses such as banks that are legally required to verify identity want to it more cheaply. An obscure private organization, the American Association for Motor Vehicle Administrators (AAMVA), is also pushing for digital licenses through the states’ motor vehicle agencies, which have the power to put an ID in every American’s wallet, physical or digital. The Department of Homeland Security is also getting behind the trend, and Google and Apple have prematurely introduced products that can allow for such IDs to be used online.
These entities are not only creating this bureaucratic wall, they are setting the rules and policies that will govern how it works — policies that should be set through the democratic political process. All of this is happening largely unnoticed by the American public.
Together, these two trends threaten the creation of an entirely new online identity infrastructure that would transform the internet. Most online services today do not demand remote identity verification, because doing so is cumbersome and a significant imposition on customers. But by making it easy for visitors to share with a single click their fully DMV-vetted, cryptographically locked-down, largely counterfeit-proof ID, that infrastructure will also make it easy for ID verifiers to demand that of their visitors. And verifiers will have very strong incentives to do so — for age verification, for advertising (confirming your actual identity makes your views more valuable), security (identifying you in case you hack the site), and safety (making sure you haven’t previously been blacklisted from a site).
This new identity system threatens to create an entirely new locked-down internet — one that is licensed, gated, and subject to identification checks, qualification tests, and blacklists at every turn. Once a site or service has proven your true identity, you can never escape your relationship with them or their memory of your every click and keystroke. Web sites could put up new, fine-tuned gates based on a wide variety of characteristics — not just whether a visitor is over or under 13 or 21, but any age. Digital checkpoints could also be based on gender, place of residence, citizenship, or any other fields present on current or future ID cards. Once you’re bound to your unalterable real identity, sites could gatekeep based on any data they might possess about you. We may find ourselves nostalgic for today’s Internet, which will look wildly free and open in comparison.
There is already far too much tracking online, and polls show Americans are very uncomfortable with it — but that tracking is far from perfect. A digital ID could make it inescapable. Among the victims would be privacy, user control, and the possibility of anonymous speech — a longstanding American value going back to the Federalist Papers and pro-revolutionary pamphlets that were written anonymously.
We and others have proposed that at a minimum states require that digital IDs be architected at a technical level to resist centralized tracking, and that they be accompanied by laws that restrict who may demand presentation of a digital ID and what they can do with the data when they’re permitted to do so. But with the exception of New Jersey and Utah, no states have enacted such protections. DHS has the power to regulate how state digital IDs operate to be compliant with Real ID and thus acceptable for federal purposes — but has not used that power to insist on any nationwide privacy protections. The states need to do that before we get locked into a digital prison that we can’t escape.