Utah's State-Endorsed Digital Identity program begins not with a list of technical requirements or a vendor selection process, but with a bill of rights. Utah Code 63A-20-101 enumerates 11 rights that individuals hold with respect to digital identity, and the rest of the statute flows downstream from those rights. This post walks through each right and explains what it means in practice, why it was included, and where implementation still has open questions.
Most digital identity programs are designed around operational goals: efficiency, acceptance rate, fraud reduction, cost. Rights are then added, if at all, as constraints. SEDI inverts that logic. The rights define the goal; the architecture is required to serve them. That has real consequences for how a system must be designed, what a wallet provider can build, and what a government agency can ask for.
The first right is foundational. It declares that "an individual possesses an individual identity innate to the individual's existence and independent of the state, which identity is fundamental and inalienable."
This provision is doing philosophical and legal work simultaneously. By establishing that identity precedes the state rather than being created by it, SEDI's drafters are making a deliberate argument about the government's role: the state endorses and certifies identity, it does not originate or own it. The government's role in digital identity is more like a notary than a registrar.
This distinction carries into the statute's architecture. A SEDI holder creates a personal digital identifier that is "unique, created by or at the direction of an individual, mathematically provable to be under a holder's control, and transportable to technical infrastructure of the holder's choosing." The individual generates the cryptographic root; the state verifies their real-world identity and endorses the connection. This is structurally different from a system where the government assigns an identifier and the individual holds a copy.
The second right establishes that individuals have "a right to the management and control of the individual's digital identity to protect individual privacy."
A physical driver's license lives in your wallet; the state does not typically retain the ability to manage how you use it after issuance. Digital systems change that default. Without explicit protections, an issuer can observe every presentation, update the credential remotely, or revoke access unilaterally.
This right is the statutory basis for several downstream technical requirements: the "no phone home" provision at 63A-20-301(3) that prohibits the state from monitoring presentations, the restrictions on credential revocation, and the requirement that issuance and revocation infrastructure remain within a state-controlled data center. The Importance of Protecting Digital ID Users from "Phone Home" Surveillance explains how these protections map to architecture.
The statute guarantees that "an individual has a right to choose, receive, and use a physical form of identity assertion that is endorsed by the state."
This is not a program to replace cards with phones. It adds a digital pathway while preserving the existing one. Enrollment is explicitly voluntary under 63A-20-302(5). Government entities cannot convey a material benefit for choosing digital over physical identity, and cannot withhold services from individuals who present physical forms (63A-20-304). The ACLU's analysis notes that this protection is more robust for government contexts than private-sector contexts; private companies are not similarly constrained.
This right builds directly on the prior one: "an individual has a right to not be compelled by the state to possess, use, or rely upon a digital form of identity assertion in place of a physical form of identity assertion that is endorsed by the state."
Right 3 protects the affirmative option to have and use a physical ID. Right 4 prohibits the state from compelling you to go digital. Together they create a floor: the state may offer digital identity, even encourage it, but may not condition participation in civic or public life on having a digital credential. Utah also placed a sunset date of January 1, 2027 on its existing mobile driver's license program (Utah Code 53-3-235), specifically to avoid a parallel, less-protected system. The ACLU commended this decision as preventing coexistence of two frameworks with different privacy properties.
"An individual has a right to state endorsement of the individual's digital identity upon meeting objective, uniform standards for eligibility and verification established by law, and a right to not have such endorsement arbitrarily or discriminatorily withheld or revoked."
By requiring objective, uniform standards established by law (not by administrative discretion), the statute constrains how eligibility can be defined and modified. The second clause limits revocation to three grounds: the credential has been compromised, endorsement was issued in error or based on fraud, or the holder requests revocation. The state cannot revoke a digital identity because an individual is in a legal dispute with a government agency or has committed an unrelated offense. The ACLU specifically praised these "statutory protections against arbitrary ID revocation" as a meaningful safeguard.
"An individual has a right to have the state's operation of digital identity systems governed by clear standards established by the Legislature, including for eligibility, issuance, endorsement, acceptance, revocation, or interoperability of digital identity assertions."
This right establishes that the rules governing SEDI must be set by the legislature, not delegated to an agency through administrative processes. A government entity that wants to modify how SEDI works cannot simply update an administrative rule; the statutory framework needs to change. That creates durability and accountability (changes require public legislative action), but also rigidity if the framework needs to adapt quickly to new technical standards or threat models.
The statute grants individuals "a right to transparency in the design and operation of a state digital identity, including the right to access, read, and review the standards and technical specifications upon which the state digital identity is built and operates."
Combined with the open standards requirement at 63A-20-301(2)(e), which mandates publicly available standards "free from licensing fees and patent restrictions," this right creates a system where the technical foundation is legible to anyone willing to read it. An auditor or researcher can verify that the system works as described. For background on the distinction between the enacted statute and the working implementation guide, see What Is State-Endorsed Digital Identity (SEDI)?.
"An individual has the right to choose what identity attributes are disclosed by the individual's state digital identity in accordance with standards established by the Legislature."
Selective disclosure is the right that most directly changes the practical experience of using a digital credential. Under a conventional driver's license, verifying your age requires handing over a document that also shows your name, address, photograph, and physical description. Selective disclosure allows a credential to prove a specific claim, such as "this person is over 21," without disclosing irrelevant attributes. It can also enable zero-knowledge proofs: the credential can cryptographically demonstrate that an age threshold is met without revealing the underlying date of birth.
For this to work, the right must be implemented at the credential format level, not just promised as policy. What Is Selective Disclosure, and How Do Verifiable Digital Credentials Reveal Only What's Needed? explains the technical mechanisms. The statute requires that wallets enable selective disclosure (63A-20-401) and specifically enable age-minimum verification without disclosing age or birth date. Rights like selective disclosure need to be technically enforced, not just legally guaranteed; a statute that prohibits over-disclosure is only as strong as the architecture that prevents it.
"An individual has the right to any service or benefit to which the individual is otherwise lawfully entitled based on the individual's choice of a lawful format or means of identity assertion without denial, diminishment, or condition."
A government agency cannot provide faster service, additional benefits, or fewer obstacles to someone using a digital credential versus a physical one. The format is the individual's choice; the level of service must be equal. Together with Rights 3 and 4, this forms a coherent structure: you can choose your format, the state cannot compel a specific format, and your choice of format cannot be penalized.
"An individual has a right to be free from surveillance, profiling, tracking, or persistent monitoring of the individual's assertions of digital identity by the state, except as authorized by law."
This is the right that the "no phone home" prohibition at 63A-20-301(3) directly implements: "A state-endorsed digital identity may not include a mechanism that allows the department to monitor, surveil, or track the presentation of a state-endorsed digital identity to another entity."
Under many digital credentialing architectures, the issuer is contacted every time a credential is presented. Each contact creates a record. Aggregated across all presentations, that record becomes a comprehensive log of where someone went, what services they accessed, and when. The "no phone home" prohibition blocks the issuer from accumulating that log at all. The ACLU identified this as one of SEDI's most important provisions, noting it addresses the passive surveillance infrastructure that physical cards do not create.
The statute's qualifier, "except as authorized by law," does not permit the department to build a general monitoring capability and apply it only to authorized targets. The architecture itself cannot include the monitoring mechanism. How Open Standards Strengthen State Digital Identity Governance covers the architecture that makes surveillance-free presentation possible.
The final right: "an individual has a right to not be required by the state to surrender the individual's device in order to present the individual's digital identity."
A phone contains personal communications, photographs, location history, financial applications, and access to other services. Handing it to a law enforcement officer or a bartender gives that person potential access to far more than the identity attributes being verified. Device sovereignty means the credential can be presented without the device changing hands, using proximity protocols that let the verifier read relevant attributes without taking physical possession.
The ACLU specifically identified device sovereignty as one of SEDI's positive protections. The governmental entity requirements at 63A-20-304 reinforce this right: government entities may not require device surrender during presentation. Private-sector verifiers face the same prohibition, though enforcement depends on the attorney general since the statute does not create a private right of action.
The rights in 63A-20-101 create legal obligations; they do not by themselves create the technical systems that make those obligations real. Selective disclosure is a right, but whether it is technically enforced depends on the credential format, the wallet implementation, and the verification protocol. Freedom from surveillance is a right, but whether it is architecturally enforced depends on whether the system is built so that surveillance is impossible, not merely prohibited.
This is why architecture matters as much as statute. A credential format and verification protocol that makes issuer surveillance technically impossible is the completion of the protection the statute begins. The rights define the floor. Implementation determines whether the floor holds.
The official implementation standards have not yet been published. The working Implementation Guide (version 0.1.0-draft, May 2026) translates statutory requirements into technology-neutral technical specifications, but it represents an interpretation, not authoritative guidance. How SEDI turns digital identity principles into technical requirements traces the path from these statutory rights to the specific architectural decisions implementation teams will face.
The ACLU's analysis of SB 275 praised the Bill of Rights as the best state effort yet to address civil liberties concerns about digital identity, while identifying two significant gaps. First, private-sector coverage: the Bill of Rights constrains the state but does not limit when private companies may demand digital identity from customers or employees. Second, the enforcement structure flows through the data privacy ombudsperson to the attorney general, with no private right of action. The statute's Duty of Loyalty provision attempts to address part of this gap by creating affirmative obligations toward individuals that exist independently of consent, but whether it proves enforceable depends on the attorney general's willingness to pursue cases and on how courts interpret its broad terms.
The 11 rights represent a deliberate choice about sequencing: establish what individuals are entitled to before specifying how the system operates. For policymakers in other states, the rights enumeration offers a template for starting from principle rather than from a vendor contract. For implementers, it provides the requirements that architecture must satisfy. For civil liberties stakeholders, it creates a statutory basis for evaluating whether deployed systems do what the law requires.
Digital Identity Is Becoming Policy Infrastructure covers the broader landscape of why this moment matters for state policymakers. If your agency or organization is working through how selective disclosure, surveillance-free verification, and wallet interoperability map to specific credential formats and exchange protocols, SpruceID has submitted detailed technical recommendations to Utah as part of the SEDI Request for Information process and is available to discuss those questions with other practitioners.
About SpruceID: SpruceID builds digital trust infrastructure for government. We help states and cities modernize identity, security, and service delivery — from digital wallets and SSO to fraud prevention and workflow optimization. Our standards-based technology and public-sector expertise ensure every project advances a more secure, interoperable, and citizen-centric digital future.
