Utah has enacted what may be the most clearly articulated privacy framework for a state-issued mobile credential program in the United States, with the unanimous passage of SB 275 through both legislative chambers.
The bill, which takes effect May 6, 2026, centers on a digital identity bill of rights that establishes four enforceable protections: the right to continue using a physical ID, the right to refuse digital identification, the right to selective disclosure of identity attributes, and the right to freedom from surveillance, tracking, and profiling through the digital identity system.
For mobile ID practitioners and vendors, the selective disclosure provision carries particular weight. Utah residents will be able to confirm only the attributes a given transaction requires, such as age or legal name status, without disclosing a full credential record containing address, birthdate, or other sensitive fields. This model aligns closely with the attribute-level disclosure architecture in ISO/IEC 18013-5, the mDL standard underpinning a growing number of state digital driver license programs.
The program uses device-based credentials stored in a mobile wallet rather than a centralized government database, a design principle that distributes control to the user’s device. Digital wallet providers operating under the program are required to obtain explicit user consent before processing any identity attribute and must implement state-of-the-art security safeguards. The legislation also imposes a duty of loyalty on the state, wallet providers, and verifying parties, prohibiting any processing that exploits users, conflicts with their interests, or causes harm.
SB 275 is the culmination of a study process mandated by Utah’s Senate Bill 260, which established the State-Endorsed Digital Identity framework in 2025. Under that model, the state endorses identity rather than creates it, a distinction with direct implications for how verifying parties and relying parties interact with credentials. The state cannot withhold services from residents who choose physical ID, and routine tracking of digital identity activity is expressly prohibited.
An ombudsman pathway is established for residents who experience problems with the system. The Office of the Legislative Auditor General will conduct a comprehensive audit beginning January 2028 to assess anti-surveillance compliance and program effectiveness.
SB 275 passed the Utah Senate 25-0 on February 24, 2026, and cleared the House unanimously on March 4, 2026.
Sources: Utah Legislature, Libertas Institute
–
By the Mobile ID World Editorial Team
