Government is making moves on mobile drivers licenses, GSA administrator says

The General Services Administration is looking to mobile drivers licenses as “the future of digital identity verification,” its acting administrator Stephen Ehikian said Monday during an mDL industry day hosted by the agency. 

The agency’s single sign-on and identity proofing service, Login.gov, is planning to add mDLs as an option for users to prove their identity, according to a June roadmap. Over 100 million people use the offering to access government benefits and services online. 

Login.gov is working with the National Institute of Standards and Technology’s National Cybersecurity Center of Excellence to add mDLs in the first half of fiscal 2026, which covers October of this year through March of next year, according to the roadmap.

This is part of a bigger project at NCCOE, which is building a reference architecture showing real-world business use cases for mDLs. 

Currently, the use of mDLs is largely confined to the physical world, such as at airports. But some in industry say that using mDLs online for benefit applications, for example, could help the government stop fraud fueled by identity theft. 

The NIST project is focused first on the use of mDLs to set up an online financial account. Later, the focus will turn to setting up an account to access government systems and then to healthcare provider access. NIST is working with tech vendors, regulators, standards bodies and mDL adopters on the project, in addition to government agencies.

For Login.gov, the promise of mDLs is “strengthening the identity proofing process,” Luigi Ray-Montañez, the head of engineering for Login.gov, said at the same Monday event. “They are a tool for both improving the user experience for legitimate users, as well as fighting the fraud.”

Last fall, GSA added facial recognition to the service as part of the agency’s quest to meet NIST standards for digital identity proofing — called identity assurance level two — following a 2023 bombshell watchdog report that found that GSA had been claiming Login.gov met that standard when it did not.

NIST is currently working to update those digital identity guidelines, including by adding details on how mDLs fit in.

The use of mDLs and digital identity documents offers a potential alternative to identity proofing solutions that require users to take photos of their physical IDs and submit a selfie to match against the ID, a process Login.gov added last year.

That setup is becoming less useful as artificial intelligence and other technologies used by bad actors to game the system improves, NIST itself has said. 

The current process can also be difficult for users, said Ray-Montañez. 

“Taking a picture of a plastic card — it is difficult at the scale that Login.gov operates,” he said. “We see a lot of user frustration, user friction with that process. A lot of need to retry. A lot of blurriness. Cell phone cameras weren’t, frankly, designed to read the 2D barcode on the back of driver’s licenses.”

The hope is that mDLs are easier to use and can better protect against fraud, he said, something Ehikian also pointed to.

“Failure to ensure there's seamless acceptance and adoption across government systems could impact our ability to counteract fraud, especially as you think about what's coming down the pipeline with advanced quantum computing and implications around fraud,” he said. “MDLs are a critical advancement in digital identity proofing.”

“This is a transformative step towards secure, seamless digital identities, the holy grail,” Ehikian added. “We're paving the way to align federal strategies with state and industry standards. This is critical, and to do so in a way that strengthens privacy, security and public trust.”

His comments follow the Trump administration’s gutting of a cybersecurity executive order from late in President Joe Biden’s term that required NIST to issue guidance on digital identity documents — including mDLs — for online identity verification. President Donald Trump rolled back that and other digital identity provisions last month through his own executive order, citing false claims about immigrants.