What Makes a Digital Identity Framework Trustworthy?

States across the country are developing digital identity programs. Legislation is moving. Procurement decisions are being made. For state leaders, the central question is no longer whether digital identity infrastructure should exist. It is what conditions that infrastructure should satisfy before the state puts its name behind it and asks residents to trust it.

That question deserves a concrete answer. Trustworthiness in a digital identity framework is not a feeling or a marketing claim. It is a set of design decisions, legal commitments, and enforcement mechanisms that determine whether the system protects the people who use it or merely functions for the institutions that accept it.

What follows are seven criteria that any state evaluating a digital identity framework should examine. They are not theoretical ideals. Each addresses a failure mode that existing systems have demonstrated or that credible civil liberties analysis has identified as a risk. Utah's State-Endorsed Digital Identity (SEDI) framework, enacted through SB 275, is one framework that addresses all seven. But the criteria themselves belong to any state serious about getting this right.

Participation must be voluntary, and the alternative must be real

A digital identity system that residents are compelled to use is not an identity service. It is a mandate. Trustworthy frameworks make participation explicitly voluntary and protect residents who choose not to participate from losing access to services they are otherwise entitled to receive.

This means more than a line in a policy document. The statute or regulation governing the framework should prohibit government entities from conveying material benefits for digital over physical identification, withholding services from residents who present physical credentials, or requiring device surrender during a presentation. Utah's SEDI statute does all three at 63A-20-304, and additionally enumerates the right to physical identity as one of eleven rights in its Digital Identity Bill of Rights.

The harder design problem is ensuring that the nondigital pathway remains a first-class experience. If the digital channel automates eligibility checks in seconds while the physical channel routes to a manual review queue that takes days, the system is voluntary in name only. States that take voluntary participation seriously need to design the physical alternative as a working service, not as a fallback that quietly degrades.

The issuer should not be able to observe presentations

Many existing digital credential systems contact the issuing authority each time a credential is presented. The issuer learns when, where, and to whom the credential was shown. Even when no one sets out to build a surveillance system, a verification architecture that phones home to the issuer creates a detailed behavioral record of where residents assert their identity.

A trustworthy framework prohibits this by design, not just by policy. The architecture should allow cryptographic verification at the point of presentation without requiring a callback to the issuer. Utah's statute is unambiguous on this point: a state-endorsed digital identity "may not include a mechanism that allows the department to monitor, surveil, or track the presentation of a state-endorsed digital identity to another entity" (63A-20-301(3)). The ACLU's analysis of the legislation specifically praised this provision as one of the law's most important privacy protections.

The distinction between a policy prohibition and an architectural guarantee matters because policies can be revised, exceptions can be carved out, and audit logs can be repurposed. A system that never generates issuer-side presentation data in the first place offers a materially stronger protection than one that generates the data and promises restraint.

Open standards prevent lock-in and enable accountability

A digital identity framework built on proprietary technology creates dependency on a single vendor or platform. If the state cannot switch providers without rebuilding its infrastructure, the vendor's design choices become the de facto governance framework, regardless of what the statute says.

Open standards address this by requiring that the technical specifications underlying the system are publicly available, free from licensing fees and patent restrictions, and not controlled by any single commercial entity. This is not just an interoperability requirement. It is a transparency requirement. When standards are public, independent researchers, civil liberties organizations, and competing vendors can evaluate whether the system actually delivers the protections it claims.

A trustworthy framework should also be format-agnostic. Locking a digital identity program to a single credential format limits adaptability and concentrates leverage. A framework that defines the rights, privacy properties, and accountability obligations the system must satisfy, and then allows multiple credential technologies to qualify, creates a healthier ecosystem with more competitive pressure on every participant.

Wallet portability gives residents meaningful choice

If a digital identity credential works only in one wallet application, the wallet provider acquires outsized leverage over both the state and its residents. The provider controls the user experience, the data handling practices, and, practically speaking, the resident's ability to use their state-endorsed credential at all. This is a concentration-of-power problem disguised as a technology choice.

Trustworthy frameworks require that the personal digital identifier at the core of the credential is transportable to the infrastructure of the holder's choosing. Residents should be able to move their credentials between wallet providers without losing functionality or needing to re-enroll, and no single platform company should become the gatekeeper for how residents interact with their own identity.

Making wallet portability real requires more than adopting an open standard. A wallet provider can implement a published specification while adding proprietary extensions that create practical switching costs. Conformance testing and certification programs close the gap between a standard on paper and interoperability in practice. The ACLU's analysis of Utah's SEDI specifically praised its open wallet ecosystem for preventing Apple, Google, and Samsung from monopolizing digital wallet control.

Data minimization should be structural, not aspirational

The principle of selective disclosure is straightforward: a person proving they are over 21 should not need to hand over their name, address, date of birth, and license number. But in many identity systems, the credential transmits a full data payload and relies on the verifier to discard what it did not need. That is data minimization by trust, not by design.

A trustworthy framework treats selective disclosure as a right, not a feature. The credential architecture and presentation protocol should allow the holder to construct a cryptographic proof that reveals only the specific attributes the verifier requested, and nothing more. Utah's SEDI statute codifies this as an enumerated right at 63A-20-101(8), and separately requires wallet providers to support age-minimum verification without disclosing the holder's age or date of birth.

Data minimization also extends beyond the moment of presentation. What can a verifier or wallet provider do with identity data after a transaction is complete? Processing restrictions matter as much as disclosure controls. Without explicit limits on retention, secondary use, and sharing, the data that selective disclosure kept out of the initial transaction can still end up collected, aggregated, and sold downstream.

Accountability should flow from a duty to the individual

Most privacy frameworks operate on a notice-and-consent model: organizations disclose their practices, individuals click "agree," and the organization is free to do whatever it disclosed. Decades of experience have demonstrated the limits of this approach. Consent flows are designed to be clicked through, not read. The asymmetry between the organization drafting the terms and the individual accepting them is structural, not incidental.

A more protective model creates affirmative obligations that run toward the individual regardless of what disclosures were made. Utah's SEDI statute introduced a Duty of Loyalty at 63A-20-701, requiring that all ecosystem participants refrain from practices that conflict with an individual's best interests, take advantage of or exploit an individual, result in disproportionate risk, cause detriment, or cause harm. The concept draws on academic work by Neil M. Richards and Woodrow Hartzog, who argued that data collectors should be obligated to act in the best interests of the people who trust them with their data.

The ACLU described Utah's Duty of Loyalty as the law's "most striking feature," noting that if enforced, it could offer broad privacy protection beyond anything achievable through notice-and-consent alone. They also flagged that terms like "harm" and "best interests" will be difficult to establish in litigation, a legitimate concern. But even an imperfect duty of loyalty sets a different structural baseline than a regime where organizations can do whatever they want as long as they disclosed it first. The question for other states is whether their frameworks place the interests of the individual above the convenience of the operator, or whether they default to the notice-and-consent model that privacy law has been trying to move beyond for years.

Rights need enforcement mechanisms, not just enumeration

An enumerated right without an enforcement mechanism is an aspiration. It may signal intent, but it does not protect anyone when something goes wrong. A trustworthy digital identity framework needs a credible path from violation to remedy.

Utah's SEDI statute routes complaints through the state's data privacy ombudsperson, who may refer cases to the attorney general. The attorney general can issue civil investigative demands and bring civil actions to enjoin violations, obtain declaratory relief, or recover damages, restitution, and disgorgement. The statute also mandates a legislative audit beginning January 1, 2028, evaluating compliance with surveillance and tracking restrictions, program effectiveness, and recommended statutory changes.

These mechanisms are real, though not without limitations. The ACLU identified the absence of a private right of action as a significant weakness: enforcement depends entirely on the attorney general's willingness and capacity to pursue cases. Under-resourced attorneys general may lack the motivation to bring novel civil claims against well-funded technology companies. States designing their own frameworks should weigh whether attorney-general-only enforcement provides sufficient accountability or whether additional mechanisms, such as a private right of action or an independent oversight body, would strengthen the system's credibility with the public.

The test is structural, not rhetorical

Any vendor can claim its product respects privacy. Any state can publish a set of principles. The difference between a trustworthy framework and a well-marketed one is whether the protections are embedded in statute, enforced through governance, and implemented in the architecture itself.

The seven criteria above are structural questions that reveal how seriously a framework takes the interests of the people it asks to participate. A framework that addresses all seven, as SEDI does, has a stronger foundation for public trust than one that addresses some and defers the rest. Every state building digital identity infrastructure will benefit from asking these questions early, because the answers shape whether the resulting system earns confidence or merely demands adoption.

SpruceID works with states translating digital identity policy into deployable, rights-respecting infrastructure. If your state is evaluating frameworks or designing its own, we would welcome the conversation.

About SpruceID: SpruceID builds digital trust infrastructure for government. We help states and cities modernize identity, security, and service delivery — from digital wallets and SSO to fraud prevention and workflow optimization. Our standards-based technology and public-sector expertise ensure every project advances a more secure, interoperable, and citizen-centric digital future.