Utah Passes Nation’s Strongest Digital Identity Bill
Utah Passes Nation’s Strongest Digital Identity Bill
https://www.aclu.org/news/privacy-technology/utah-digital-id-law
Publish Date: 2026-03-30 11:13:00
Source Domain: www.aclu.org
Subscribe to the Free Future Newsletter
Free Future home
The Utah state legislature recently passed new enabling legislation for the state’s “State Endorsed Digital Identity” (SEDI), which, while lacking in some respects, includes many important privacy protections and represents the best effort we have yet seen in a state to square privacy protections with the looming dangers to civil liberties that flow from digital identities.
This past November I wrote about Utah’s laudable drive to build the state’s digital identity program with privacy protections. In 2021 we issued a report on digital identity, and in 2024 we issued guidance explaining a series of legislative protections that should be mandated before a state adopts any digital ID.
Utah’s new law has some very positive provisions that match many of our recommendations — but it also has some meaningful limitations.
A “duty of loyalty.”
In perhaps its most striking feature, the law includes a potentially powerful provision creating a “duty of loyalty” to individuals by the government ID issuer, wallet providers, and verifiers/relying parties. They are required to “refrain from practices or activities” related to digital ID that “conflict with the best interests of an individual” or “take advantage of,” “exploit,” “cause harm,” are to their “detriment,” or that “result in a disproportionate risk” to them.
Such a duty appears to stem directly from a proposal by Neil Richards and Woodrow Hartzog, in a 2021 law review article proposing “A Duty of Loyalty for Privacy Law,” as well as from related concepts advanced by a number of legal scholars including Jack Balkin, author of “Information Fiduciaries and the First Amendment” (2016).
Richards and Hartzog wrote that “a duty of loyalty framed in terms of the best interests of digital consumers is coherent and desirable and should become a basic element of US data privacy law.” They noted that adoption…
