To track the status of this bill, find it on our Legislation Tracker. Click here to contact the sponsor of the bill to share your thoughts, or click here to email your Senator and Representative about it.
Libertas Institute supports this bill
SB 275, sponsored by Senator Kirk Cullimore, establishes a “digital identity bill of rights,” which guarantees individuals the right to manage and control their digital identity as a way to protect their privacy. This bill is the result of a careful and collaborative effort to perform a study of state-endorsed digital identity under the strict requirements set out by the legislature in SB 260, passed in 2025.
Libertas supports this bill.
The driving principle behind the bill is the belief that a state should endorse identity, not create it, and that such an endorsement of a digital identity should not come along with unauthorized state surveillance, tracking, or persistent monitoring through a digital identity system. In this way, if SB 275 is passed, Utah’s choice to pass on the opportunity to exert greater control and surveillance over citizens will make it a pioneer in personal privacy.
To achieve the state’s lofty goal, SB 275 grants individuals the right to choose which identity attributes they choose to disclose. Rather than handing over a full ID, which is essentially a full list of identifying information — as is typical for a drivers’ license or a passport — Utahns using a digital ID would have the right to choose which “identity attributes” to share (e.g., confirming a legal name without also sharing birthdate, home address, or eye color). Moreover, the bill would make digital ID completely voluntary by prohibiting the government from withholding services from physical ID users or conferring a special benefit onto digital ID users.
SB 275 also imposes strict operational requirements on digital wallet providers and services verifying a person’s identity that mandate they only process identity attributes with explicit user consent, and incorporate state-of-the-art safeguards and tamper-resistance. The bill also establishes a “duty of loyalty,” which prohibits the state, digital wallet providers, and verifiers, from processing a Utahn’s identity attributes in any way that exploits the individual, conflicts with their best interests, or causes them harm.
However, just because a privacy right or protection is granted does not mean governments will abide by it. Privacy violations are an unfortunate reality that deserve persistent government scrutiny and accountability. To this end, SB 275 requires the Office of the Legislative Auditor General to conduct a comprehensive audit beginning in January 2028 to evaluate the program’s effectiveness, its compliance with anti-surveillance restrictions, and its optimal long-term placement within state government.
Utah policymakers and Utahns should keep a close eye on Utah’s digital ID experiment, including close scrutiny of any privacy violations uncovered by the system’s first audit in 2028. But on the whole, the digital identity bill of rights and duties of loyalty included in SB 275 are a step in the right direction toward modernizing identity in the digital age and rejecting the proliferation of technological surveillance.
