Mandatory digital identity systems have moved from pilot programs to live infrastructure in more countries than most people realize. This isn’t speculation about a future rollout. It’s a status report on what’s already operating, what’s being built right now, and what to actually look for in your own jurisdiction if you want to know how far along this goes.
What’s already live
India’s Aadhaar system, launched in 2009, remains the largest biometric identity database on Earth, with over 1.3 billion enrollments covering fingerprints, iris scans, and facial photographs. It started as a voluntary tool for accessing subsidies and has since become a practical requirement for opening a bank account, getting a mobile SIM card, filing taxes, and receiving welfare payments. “Voluntary” and “practical requirement” are doing very different work in that sentence, and Aadhaar is the clearest example of how a system marketed as opt-in becomes de facto mandatory once enough services are gated behind it.
The European Union passed the EUDI Regulation in 2024, legally obligating all 27 member states to offer citizens a European Digital Identity Wallet by 2026. The wallet is designed to hold a verified national ID, driving license, diplomas, and payment credentials in a single app, usable both online and for in-person verification. Member states are not required to make the wallet mandatory for citizens, but they are required to accept it wherever they currently accept other forms of ID, and several national governments (Germany, Italy, and Denmark among them) have already started integrating it into tax and healthcare portals ahead of the 2026 deadline.
China’s social credit and real-name verification infrastructure ties national ID numbers to internet access, mobile accounts, high-speed rail travel, and increasingly to platform accounts on services like WeChat. Real-name registration for internet use has been a legal requirement since 2017 under the Cybersecurity Law, meaning anonymous online activity at scale is not practically available to Chinese citizens using domestic platforms.
What’s in active rollout right now
Worldcoin (rebranded World) has deployed iris-scanning hardware (“the Orb”) in over 35 countries specifically to issue a “World ID,” a cryptographic proof of unique humanhood intended to distinguish real people from bots and AI-generated accounts online. As of 2026 it has scanned over 12 million people. The stated purpose is to solve bot verification for AI-era platforms, not government identity, but several fintech and social platforms have begun accepting World ID as a KYC layer, which extends its functional reach beyond its original scope.
The UK’s Online Safety Act, in force since 2025, requires platforms hosting adult content or content deemed harmful to minors to implement “robust” age verification. In practice this has pushed major platforms toward facial age-estimation software and government-ID upload as compliance methods, meaning a law written to protect children has become the mechanism through which age (and by extension, identity) verification is being normalized for general internet access in the UK.
The United States has no federal digital ID mandate, but has a fragmented state-by-state rollout of mobile driver’s licenses (mDLs) via Apple Wallet and Google Wallet, live in over 15 states as of 2026 including Arizona, Colorado, Georgia, Maryland, and Utah. TSA accepts mDLs at a growing number of airport checkpoints. There is no requirement to use an mDL instead of a physical card yet, but the infrastructure for a fully digital replacement is now built and operating in production, not theoretical.
The pattern across all of these systems
None of these rolled out as an announced, single mandatory system. Each one followed a similar path: introduce it as optional and convenient, integrate it into one or two essential services, then expand the list of services that require it until opting out becomes impractical rather than illegal. Aadhaar didn’t need to be legally mandatory to become functionally unavoidable once banks and mobile carriers required it. The EU wallet doesn’t need to be mandatory for citizens if enough government portals only accept it. This is the mechanism worth watching, not any single announcement of compulsory enrollment.
The technical convergence point across most of these systems is a verifiable credential standard, most commonly the W3C Verifiable Credentials data model, which allows a credential issued by one authority (a government, in most cases) to be cryptographically verified by a third party (a bank, an age-gated website, a border checkpoint) without that third party needing to contact the issuer directly. This is the plumbing that makes cross-service digital ID interoperable, and it’s largely settled at the technical standards level even in countries that haven’t launched a public-facing wallet yet.
What the actual risks are, stated plainly
Centralized biometric databases are a single point of failure for identity theft at a scale physical documents never allowed. India’s Aadhaar database has had multiple exposure incidents involving hundreds of millions of records since 2017. Linking a single credential across banking, healthcare, travel, and internet access means a suspended or revoked digital ID can lock a person out of all of those simultaneously, which is a different category of consequence than losing a physical wallet. And once age or identity verification becomes standard for accessing mainstream platforms, anonymous or pseudonymous participation in public discourse becomes progressively harder to maintain, regardless of whether that was the stated intent of any individual policy.
What to actually check for your own situation
If you want to know how far this has progressed where you live, three concrete questions cut through the noise: does your country have a functioning mobile ID wallet already integrated with a government service (tax, healthcare, or banking), is there a legal requirement (like the UK’s Online Safety Act) forcing platforms toward ID verification for content access, and has a private company’s identity product (like World ID) been adopted by financial or social platforms as a verification layer in your region. Those three answers tell you more about your actual exposure than any single piece of legislation, because the infrastructure is being built in pieces across public and private sectors simultaneously, and it’s the sum of those pieces that determines how avoidable participation actually is.
For more on how this connects to broader surveillance infrastructure, see our coverage of the surveillance state and Big Tech’s censorship apparatus.
