The safety and privacy concerns of storing your driver's license in a digital wallet

They can reveal less information than a physical card, but privacy protections don’t necessarily follow your data after you share it.

Putting your driver's license in a digital wallet doesn't mean storing a picture of the plastic card on your phone. A standards-based mobile driver's license, or mDL, contains digitally signed information that lets a compatible reader verify it came from the issuing authority.

That design can make some interactions more private than showing a physical card, while also protecting access to the ID with your phone's security features. But moving identification onto a smart device raises a different set of questions about tracking, data retention and what happens if the phone becomes unavailable.

Handing over a physical driver's license exposes everything printed on it to the person checking it. If someone only needs to confirm that you're over 21, for example, they may also see your exact birth date, home address and license number. An mDL can be more selective. The standard supports broad age statements such as whether someone is over 21, allowing a compatible verifier to request that answer rather than seeing the person's complete date of birth.

Apple and Google add their own protections as well. Apple says you can review requested information before sharing it, and in-person presentation requires authentication with Face ID, Touch ID or an applicable accessibility method. Driver's license and ID data is encrypted, and you don't need to hand your phone to the verifier or unlock it.

Google says its US driver's licenses and state IDs are encrypted and stored locally on the phone rather than in your Google Account. Google Wallet also shows the requested information before it's shared and requires you to authenticate.

Those controls don't make a digital license automatically safer than a physical one, but they can give you more control over what you reveal.

The 2021 ISO/IEC 18013-5 standard supports two ways to provide a digital license. With device retrieval, the information is sent directly from your phone to the reader. With server retrieval, the reader gets the information from the authority that issued the license instead. Privacy advocates object to that second method because the issuer could potentially learn when or where the ID is being used.