Digital identity is becoming core policy infrastructure. Across benefits, financial regulation, privacy, and elections, better verification can strengthen trust while reducing unnecessary data collection and giving people greater control over their information.
Some of today’s most consequential policy debates appear to have little in common. States are implementing new verification requirements for public benefits. Regulators are defining rules for digital financial assets. Governments are reconsidering how personal data should be collected and protected. California voters will weigh new voter identification requirements this fall.
Underneath each of these debates is a similar question: how can an institution reliably verify what it needs to know while minimizing the personal information people have to disclose?
We believe digital identity and trusted data exchange are increasingly central to answering that question. Done well, they can give governments stronger evidence, give individuals greater control over their information, and reduce the tension between effective verification and privacy.
The opportunity is not simply to digitize existing processes. It is to design systems in which trust can be established with less collection, less duplication, and stronger technical protections.
The new federal Medicaid community engagement requirements make the challenge particularly visible. States will need to verify employment, education, community service, income, and exemptions across a large population, often using information distributed across employers, providers, educational institutions, platforms, and government programs.
Our recent comments to the Centers for Medicare & Medicaid Services focused on how states can meet those requirements without creating unnecessary procedural barriers. We recommended maximizing ex parte verification first, then providing additional reliable evidence pathways when existing government data cannot resolve a case.
There is an opportunity to think even more broadly about the infrastructure behind benefits verification. One model worth exploring is a benefits passport: a way for an individual to hold verified evidence of eligibility, status, or prior determinations and reuse it across participating agencies and services where program rules allow.
The concept is not a single universal determination of eligibility. Medicaid, SNAP, TANF, housing programs, and other services have different statutory requirements, and each agency remains responsible for applying its own rules. Rather, a benefits passport could allow trusted facts or determinations to become reusable evidence instead of requiring individuals and agencies to repeatedly collect the same information.
For eligible recipients, that could mean fewer forms, fewer requests for documentation, and less need to prove the same fact multiple times. For government, cryptographically verifiable evidence can provide stronger signals about who issued information and whether it has been altered, supporting program integrity alongside a better user experience.
Fraud prevention and accessibility do not have to be opposing goals. Better evidence can support both.
The same principle applies in financial regulation.
California’s Digital Financial Assets Law creates a new regulatory framework for companies engaged in digital financial asset activity with California residents. As regulators and industry build the systems needed to meet requirements like licensing, identity verification, recordkeeping, and compliance, there is a choice about the underlying architecture.
The traditional approach to compliance often involves collecting more information, making copies of identity documents, and retaining large amounts of personal data across many organizations. That may satisfy a verification requirement, but it can also increase the number of systems holding sensitive information and expand the consequences of a breach or misuse.
Privacy-preserving digital identity offers another model. Instead of treating identity verification as synonymous with collecting an entire identity record, systems can be designed to verify the specific facts required for a transaction. A business may need to establish that someone meets a particular eligibility threshold or that a credential came from a trusted issuer without necessarily retaining all of the underlying information used to prove it.
This is where cryptography and data minimization become policy tools, not merely security features. Well-designed technical systems can constrain what information is disclosed, establish whether it is authentic, and enforce some limits on how it can be accessed or reused. Legal protections still matter, but they no longer have to carry the entire burden of protecting personal data after it has been collected.
This distinction matters well beyond financial services. Privacy policy often focuses on what organizations are permitted to do with personal information after they receive it. A stronger model also asks whether they needed to receive that information in the first place.
Data sovereignty should mean more than giving people another consent screen or a lengthy privacy policy. Individuals should have meaningful control over when information is shared, with whom, and for what purpose, and systems should disclose only what is necessary to complete a transaction.
Selective disclosure, verifiable credentials, and user-controlled authorization can help make those principles concrete. Rather than transferring a complete record whenever one attribute is needed, an individual may be able to prove the relevant fact while withholding unrelated information. Rather than relying exclusively on organizational promises not to misuse data, technical controls can limit what is available to misuse in the first place.
For Californians, this creates a compelling direction for the next generation of digital government infrastructure: pair strong legal rights with technical architectures designed to enforce privacy and user control.
California voters will also consider Proposition 39, which would establish additional voter identification and citizenship verification requirements, in the November 2026 election. The measure would require voters to present government-issued identification at the polls or the last four digits of a government-issued identification number when voting by mail, among other provisions.
Regardless of the political debate over whether additional identification should be required, implementation raises familiar technical and policy questions. If government is going to ask millions of people to prove a fact, how can it make verification reliable at statewide scale without creating unnecessary privacy or accessibility barriers?
A modern identity system should be capable of proving what a transaction requires without automatically exposing everything contained in an identity document. It should support multiple ways to participate, including options for people without smartphones or those who need assisted or physical alternatives. It should also avoid creating centralized records of individuals’ activity simply because an identity check occurred.
These are not specific to elections. They are principles that should apply whenever digital identity becomes part of an interaction between an individual and government.
Benefits administration, financial regulation, privacy, and elections each operate under different laws, threat models, and institutional constraints. They should not share a single identity system or collapse their policy requirements into one technical model.
But they can share a set of design principles.
Government should be able to verify trustworthy information without collecting more data than it needs. Individuals should be able to use evidence from trusted institutions without repeatedly surrendering copies of the underlying records. Digital evidence should be interoperable rather than locked to a single vendor or application. Authorization should be meaningful and revocable. Nondigital and assisted pathways should remain available where access to a public service is at stake.
Open standards and modern cryptography make more of this possible today than was practical when many existing government systems were designed. The next challenge is institutional: defining who is trusted to assert what, which evidence is sufficient for a particular purpose, and how those rules can be implemented consistently without creating another generation of centralized data silos.
Digital identity is often discussed as a product category, a wallet, or a digital version of a physical credential. We think that framing is too narrow.
Increasingly, digital identity and trusted data exchange are policy infrastructure. They determine whether governments can increase confidence in a transaction while collecting less information, whether evidence can move safely between institutions, and whether privacy protections exist only on paper or are reinforced by the architecture itself.
As policymakers confront new requirements across benefits, finance, privacy, elections, and other areas of public life, that infrastructure deserves to be part of the policy conversation from the beginning.
Building digital services that scale take the right foundation.
About SpruceID: SpruceID builds digital trust infrastructure for government. We help states and cities modernize identity, security, and service delivery — from digital wallets and SSO to fraud prevention and workflow optimization. Our standards-based technology and public-sector expertise ensure every project advances a more secure, interoperable, and citizen-centric digital future.
