State lawmakers call for stronger digital identity, data privacy frameworks

Digital identification programs have proliferated across the states in recent years, and a recent panel of state lawmakers said they are keen to establish foundational identification and privacy guardrails as digital credentials become more commonplace. 

For state lawmakers looking to stay abreast of evolving tech trends to better serve their residents, “the question is not, ‘Will you be a part of a digital identity program?’” said Utah Rep. Paul Cutler, speaking during a panel session at the National Conference of State Legislatures 2026 Legislative Summit in Chicago last week. 

“The question is, ‘What type will it be, and what are the policy decisions that we need to make as we go down these roads?” he said. 

“We should be viewing digital identity and the things that underpin it as infrastructure — more importantly — as critical infrastructure akin to utilities [like] electricity and water, because they are so important for the continuity of what is the American existence, especially in a growing digital economy,” said Jordan Burris, vice president and head of public sector at Socure, a digital identity and verification company. 

Inside Colorado’s expansion of digital identity programs

Colorado is developing a new digital identity management program that is slated to launch by the end of the year, Sarah Tuneberg, chief information officer and executive director of the Colorado Office of Information Technology, said during the panel. 

The state’s “data backpack” framework will serve as a “more user-centered, more privacy-prepared version of document storage,” she explained. The initiative also builds upon the state’s broader digital identity strategy, which is driven by a “state-owned” mindset that puts data security and government efficiency at the forefront, she said. 

The data backpack will be a centralized profile through which Colorado residents can upload and securely store documents like income verification forms, public assistance applications and other personal information across state services. The framework can help reduce duplicative or erroneous data inputs and state costs to verify resident information, Tuneberg said.  

“When [residents are] applying for benefits, we're asking people for the same pieces of information sometimes 12, 15 [or] 25 times,” she told Route Fifty in an interview. “If we can create a secure place where they can store them and then enable them to share it much more easily … then it reduces the [administrative] friction. It also reduces the error rate for things like [the Supplemental Nutrition Assistance Program] because we can verify a credential, like income, and residents can store it and share it with the people they need to.” 

Such privacy measures are increasingly pertinent without a federal framework, particularly as states face mounting pressure to share sensitive resident information, such as voter rolls or driver’s license data, with the Trump administration, Tuneberg told Route Fifty. 

Utah’s national digital identity and data privacy approach 

“The demand in the future to have verifiable identity is going to be undeniable,” Christopher Bramwell, chief privacy officer of Utah, said during the session. He added that “there's a point in time where all the [identity] data that's going to be collected is going to be in verifiable form for digital identity, and so you can encumber that with new protections.” 

To get ahead of incoming complications with digital credential implementation, lawmakers in the Beehive State unanimously passed a bill establishing Utah’s state-endorsed digital identity, or SEDI, framework earlier this year, Bramwell said. It went into effect in May. Utah has maintained a mobile driver's license program since 2021. 

It includes, for instance, a digital identity bill of rights, which outlines Utahns’ rights to not surrender mobile devices when presenting digital credentials and not use a mobile ID if they do not want to, among others. 

The bill also creates stringent privacy protections for digital and mobile driver’s licenses programs in the state. For example, the bill bans issuers of mobile IDs from including mechanisms that could be used to monitor, track or surveil the ID holder. 

Additionally, the law requires digital credentials to enable selective disclosure — a feature that allows the ID holder to display information confirming that they are a certain age without disclosing unnecessary information, such as their home address. Selective disclosure settings are also available in Colorado’s mobile ID program, Tuneberg said. 

Utah is looking to gather other state leaders to help build and expand upon the state’s digital identity framework, Bramwell said. The state is collaborating with the American Civil Liberties Union, business associations and other state officials to help develop “a comprehensive, balanced privacy strategy that will balance privacy, transparency and [the] use of data across government and the private sector,” he explained. 

Topics like digital identity and data privacy can be a lot for state lawmakers to digest and implement, but “if you set a [digital identity] foundation, it’s going to actually be a comprehensive strategy to solve a lot of the problems and harms that are faced to our constituents,” Bramwell said.