If the shadow of every ID check is permission, then the shadow of digital ID systems is the ability to deny permissions in more places, more often, and with less friction.
Security engineers use the surprisingly poetic phrase "something you know, something you have, something you are" to describe ways identity is authenticated online. But if we zoom out to what digital ID systems actually do from a sociotechnical perspective, a more accurate description might be "something they classify, something they deem deserving, something they gatekeep."
Your ID isn't for you; it's for the bouncer and the system that put the bouncer in place. Put another way, the shadow of an ID is the permission and exclusion it represents.
New unregulated technologies cast this shadow long and deep. Facial recognition has made your face your ID, ad trackers have normalized persistent tracking online as the default, and now AI-fueled bots and deepfakes insist all humans need even more and more confirmation that they are real. Privacy laws have struggled to gain traction in the United States without being watered down by Big Tech. Meanwhile, age verification legislation—which encourages more tracking online and has been backed by a remarkably successful lobbying effort—has outpaced consumer privacy laws in a fraction of the time, despite mounting evidence that they do not work as intended and create harmful side effects. It's a mess.
What's worse, digital ID systems have become calcified in so many minds as the only approach to managing resources or addressing public safety concerns that the new harms they create are minimized and treated as collateral damage. I saw this firsthand while working in the Federal Government, when the Equifax breach exposed the shortcomings of relying on data brokers for identity proofing. Rather than pause and explore alternatives, the Login.gov team shifted to the two credit bureaus that had not yet been breached and doubled down on scaling the product under the banner of "modernization." Over the following years, Login.gov would receive roughly $187 million—about 18% of all Technology Modernization Fund dollars—making it the program's largest recipient. The third largest recipient of this non-democratic modernization fund, by the way, was Customs and Border Protection.
Like an ouroboros, digital ID systems sustain themselves through their own failures. Breaches become justification for collecting and linking more personal data and creating new ways to classify, evaluate, and score people, which in turn produce new risks, new failures, and new demands for expansion.
Credit bureaus and predictive policing now seem almost quaint compared to the new forms of classification emerging today. Today's identity verification corporations are creating new ways to quietly estimate someone's age, infer their identity through voice, movement, or web traffic, or sort them into categories of risk and suspicion.
I've written before about the concept of deservedness, where researchers have developed frameworks to measure how people predictably decide who deserves support, resources, rights, or public benefits and who does not. With more forms of identification and classification, there will be new opportunities to decide that different people deserve different things, both online and offline—perhaps most literally today through surveillance pricing or ICE's expansion into our cities, where data brokers, facial recognition, and other digital tools are helping create a perpetual line-up and an everywhere border.
And then there is gatekeeping. Franz Kafka said it best in his short parable "Before the Law," in which a man spends his entire life seeking entry through a gate that was supposedly meant for him alone, only to be denied access until the moment of his death. As the gatekeeper closes the entrance, he tells him, "Here no one else can gain entry, since this entrance was assigned only to you. I'm going now to close it." Soon, we may all be the man before the law with our own personalized gates.
We're in a perfect storm moment where privacy-invasive data collection has not been reined in, AI is producing new waves of bots and fraud online, and the market increasingly insists that we conduct our lives online and remotely. This puts us on a non-stop train toward more permissions, more denials, and more invasive data collection to design systems to sort people between the two.
The good news is that we have not fully architected a score-based permission society, and there is still time to resist. In fact, the United States has a long tradition of skepticism toward centralized identification systems, including resistance to a national ID, years of pushback against Real ID, and opposition to the use of ID for voting rooted in the country's history of disenfranchisement and Jim Crow.
As you encounter the next invasive digital ID system, I encourage you to push back and ask others to stop and think about the world we are building. If you'd like to explore the shadow of digital ID systems further, I hope you'll take a look at the new report that Cynthia Conti-Cook and I recently published for the Surveillance Resistance Lab, Digital ID or Democracy? An Advocate’s Introduction and the companion State Digital ID Systems and Policy Tracker.