Apple rolls out support for California digital IDs

Lea esta historia en Español

Apple launched California identity cards and driver’s licenses for iPhones today, making the digital IDs easier to present — but for now they are only accepted at select airports and a small number of businesses selling age-restricted items such as alcohol, tobacco, fireworks, or guns.

Drivers are still legally required to carry their physical licenses, even if they get a digital one. And they cannot use digital licenses at offices of the Department of Motor Vehicles, which issues them, since the agency only accepts them online, through an app.

In the near future, however, use of digital IDs are expected to spread both in government and the private sector, with sales terminals rolling out to enable more stores to accept them, more California state agencies accepting them, and the Biden administration urging the federal government to do the same.

Apple vice president Jennifer Bailey called the launch “an important milestone in the rollout of IDs in Apple Wallet” in a press release issued by Gov. Gavin Newsom’s office.

Smartphones that operate on Google’s Android operating system got the ability to add a California ID or driver’s license to Google Wallet last month. California is the fifth state to get Google Wallet identification and seventh state to get Apple Wallet identification.

Few businesses and virtually no state agencies make use of mobile ID to verify identity, but that’s changing fast. Verifone, whose sales terminals accept payments from Apple or Google smartphones, is working with the California DMV and the company TruAge to make in-person age verification commonplace at businesses throughout the state. 

“There’s only a handful of them available in the state today but the plan is for several thousand to be rolled out in the very near future,” mostly by merchants,  said DMV director Steven Gordon.

Digital IDs also work online. Apple started allowing apps such as rental car service Turo to verify people’s age with digital IDs last year and Google’s Chrome web browser started testing its Digital Credential API for verifying identities online last month.

Californians could carry digital IDs on smartphones previously but only by installing additional software; the state last year launched the California DMV Wallet app on Apple and Google devices. The app and new wallet integration are part of the state’s digital ID strategy, which includes plans to follow a federal standard for remote verification of a person’s identity and to integrate with Login.gov, an identity and sign-on service that has been adopted by more than 50 federal agencies, including the Internal Revenue Service and Department of Homeland Security. Login.gov started working with state governments in 2022 and expanded those offerings last month.

The Biden administration is reportedly working on an executive order that aims to reduce fraudulent benefit claims by accelerating this integration, pushing more state governments to adopt digital driver’s licenses and IDs and requiring all federal agencies to use Login.gov. Apple and Google declined to answer when asked if they’re part of  talks to draft language in the executive order.

Curbing AI with digital IDs

For now, though, adoption is limited: The California DMV is the only California agency that accepts mobile identification cards — and even then only digitally — and the Transportation Security Administration is the only federal agency that accepts them, when screening passengers at roughly 25 airports nationwide, including Los Angeles and San Francisco international airports.

“We do hope that we’re going to be able to find a sister agency at the state level to start using this,” said Gordon, who previously worked at tech company Cisco Systems and oversaw DMV modernization efforts during the COVID-19 pandemic.

The California Department of Technology, which created the state’s digital ID strategy,  is working on integrating the strategy and one of its key components, the “Identity Gateway,” with state services, including transit discount programs and eligibility verification for programs like CalFresh food benefits and veteran services. The ultimate goal, department spokesperson Bob Andosca told CalMatters, is to begin pushing state agencies to adopt digital IDs in the near future in order to allow Californians to “access all state services through one digital ID system.”

In addition to speeding access to government services, remote identity verification with digital IDs and services like Login.gov or California’s Identity Gateway can reduce the number of private tech companies state governments interact with. That potentially includes less reliance on artificial intelligence software.

A September 2023 analysis by the group Electronic Privacy Information Center found that roughly half of AI contracts signed by state agencies involve fraud detection. In the most high profile case to date, the California Employment Development Department wrongfully denied unemployment benefits to at least 600,000 people because AI provided by Thomson Reuters falsely identified their claims as fraudulent. Digital IDs allow state agencies to verify that people are who they say they are when they apply for benefits online, potentially eliminating the need for fraud detection tools like the one used by EDD.

State-issued IDs for iPhones were first introduced in 2021 and are now available in Arizona, Colorado, Georgia, Hawaii, Maryland, and Ohio. The IDs are also in the works for eight additional states and their use expands to Japan, the first country outside the U.S., next year.

Apple and state officials have tried to make the process of adding a digital ID relatively simple. To add an ID card or driver’s license to your Apple Wallet, launch the Wallet app and then tap the plus button in the top right corner. Then take a picture of the front and back of your physical ID card or driver’s license. You will then be prompted to do a series of face and head movements, allowing your smartphone to scan your face to match it to the picture on your ID card. After your phone does its facial matching, the state needs to do its own, so you will be prompted to take a selfie that gets encrypted and sent to the DMV for a face recognition search of a database containing photos of ID cards and licenses. The state also receives a fraud score from Apple based on how a person uses their iPhone and the settings they choose.

Once it’s set up, smartphone IDs promise to be easier to use than physical ones. To present one, hold your phone near a reader at a government facility (like the airport or DMV) or at a private business (like a liquor store) to establish a connection between the reader and your phone. Then a prompt pops up on the phone showing what information the other party is requesting, such as date of birth and legal name. You approve the exchange by authenticating on the device (via face or fingerprint scan or with your passcode) and your identifying information is then shared. A history of such exchanges is stored on your smartphone and is not made available to Apple or the state authority that issued the device, according to Apple.

Until mobile IDs are more widely accepted, the DMV still recommends that you carry a physical ID card. If drivers don’t carry physical licenses with them, they’re breaking the law, said California Highway Patrol spokesperson Jaime Coffee.

New privacy worries as digital ID acceptance grows in California

California’s previous mobile ID technology, the DMV smartphone app, is currently used by more than half a million people. The app can not only present a mobile ID but also read one, including the new ones from Apple and Google wallets, through the included ID reader, used to verify a person’s identity, age, or driving privileges. Apple also offers a reader for mobile IDs that are on iPhones or Android devices.

The ID reader is the only way DMV currently accepts digital IDs.

But the hope, DMV director DMV director Gordon said, is that Apple and Google offering digital IDs in California leads more citizens to carry them and more stores and financial institutions to accept them, both in person and online.

He also thinks digital IDs can improve access to state and local government services by allowing people to do things such as verify their identity when signing on to websites to pay taxes. He envisions DMV employees in the field handing out mobile IDs on the spot to homeless people in order to quickly replace lost ID cards, allowing them access to government services they would otherwise be locked out of. He also thinks mobile IDs can make life safer for the public and police alike with wireless ID sharing during traffic stops.

The DMV is hosting hackathons in Silicon Valley in October and November to explore different ways to use digital IDs.

For all their promise, the new IDs also raise new privacy concerns. Electronic Frontier Foundation director of engineering Alexis Hancock criticized California’s DMV Wallet app earlier this year for a lack of protections to control what information you share. Such protections would, for example, allow a person buying beer to digitally verify that they are over 21 but not share their address with the store. 

Hancock thinks it’s imperative that lawmakers put rules into place governing the use of mobile IDs. One example: banning the creation of databases that track a person’s movement wherever identification or age verification takes place  — databases that don’t exist today but which could conceivably be enabled by digital IDs.

That kind of list and potential surveillance could impact a lot of people in states where it’s become common to verify age before gaining access to adult content. The California Legislature this year failed to pass a bill that would have made it illegal to store, retain, or share information obtained when verifying a person’s age or track their online activity. But the bill also would have required businesses that sell things such as fireworks, spray paint or pornography to verify a person’s age. Some privacy advocates opposed the law, but more than 20 U.S. states have considered age verification laws, according to the Free Speech Coalition.

Apple and Google generally employ strong security protections, Hancock said, and it’s in their economic interest to do so, but “you can’t just trust companies at their word to not try to exploit that (sort of information). We have learned that lesson multiple times in the past.

“My general worry around these programs,” she continued, “hinges on the fact that what happens when you present such information so freely, and the more frequently you present this information digitally, the greater the chance of said information being leaked in some sort of way, shape, or fashion.”

Hancock is also concerned about agreements signed between tech providers and state agencies. A review of contracts between Apple and Georgia and Arizona by CNBC concluded that the company exerts a high degree of control over state government agencies, requiring them to provide digital ID cards free of charge and pay for systems used to issue digital ID credentials. Similar provisions are found in agreements between tech giants and the state of California. 

Following a public records request, CalMatters obtained a memorandum of understanding signed in 2022 by an Apple executive and Digital ID program director Greg Fair, a California Department of Technology employee. That agreement requires the government to pay for staff and computer systems necessary to maintain Apple Wallet ID cards. It also requires the state to treat digital IDs the same as physical ones, tells the government how to market digital IDs, and makes the state offer a digital option when people get a new ID or replace a lost or stolen one.

A subsequent contract signed in August 2023 requires the state supply Apple with monthly reports. The contents of those reports are unknown since this portion of the contract is redacted.

The Google contract signed in July also details continuing work on new features such as selective disclosure, getting an ID without the possession of a physical card, sharing an ID across devices, and “adding multiple credentials (such as for a parent and child).”

Both contracts state that Apple and Google will not share information about someone with third parties, including law enforcement, without the person’s consent. They also state that both companies will work with state agencies to prevent fraudulent ID issuance and report suspected instances of  digital ID fraud.

After reviewing the documents, Hancock said the contents confirm her fear that the state gives too much control to Apple by agreeing to do things such as suggest a digital option when people renew their physical driver’s license and give Apple prior approval power over marketing. 

“They [Apple] steer the shift of public perception around digital ID,” she said. “A lot of communications about how this gets presented to California citizens is controlled by Apple.”

Both the DMV and Login.gov have histories of making mistakes when attempting to modernize government services.

Last year, a federal Government Services Administration investigation found that Login.gov misled other government agencies to believe it complied  with a federal remote identity verification standard. It hadn’t, according to  a former director of Login.gov, due to concern of the technology’s discriminatory impact. 

At the California DMV, a 2019 Los Angeles Times investigation found problems during rollout of a voter registration program paired with vehicle registration. Among them: the DMV inadvertently shared personal information and 100,000 inaccurate documents with local election officials across the state of California.