The long prehistory of digital identity
Digital identity is often discussed as if it were born with smartphones or online platforms. In practice, its roots lie much earlier, in the administrative ambitions of the modern state and the technical architecture of digital networks. Long before people logged in with passwords or scanned QR codes, governments and large institutions were building systems to identify, classify and authenticate individuals at scale. Census registers, civil registries, passport systems and national insurance numbers all established a central principle: identity could be standardised, recorded and reused across transactions.
The digital turn changed the medium, not the underlying ambition. Once records became machine-readable, identity ceased to be merely documentary and became computational. A person was no longer represented only by a paper certificate, but by entries in databases, links across systems and credentials that could be verified electronically. That shift laid the groundwork for today’s debates over digital wallets, biometrics and privacy-preserving credentials.
Digital identity did not begin on the internet; the internet inherited it from a much older administrative tradition.
The timeline that follows shows how digital identity emerged through several overlapping histories: public administration, cryptography, internet governance and social policy. At each stage, a familiar tension appears. The same tools that make identification more efficient can also make surveillance easier, exclusion harder to contest and institutional power more durable.
1960s to 1970s: databases, privacy law and the first backlash
By the 1960s, large-scale computerised record keeping had become feasible for governments and major organisations. Public authorities in Europe and North America began to imagine linked administrative databases that could unify tax, welfare, health and population records. This was the first era in which identity became a database problem rather than simply a paperwork problem.
The political consequences were quickly recognised. In 1973, the US Department of Health, Education, and Welfare published Records, Computers and the Rights of Citizens, a foundational statement of fair information practices. It argued that computerised personal-data systems required explicit safeguards, including transparency, purpose limitation and access rights. These principles would later shape privacy law around the world.
Europe moved in a similar direction. In 1981, the Council of Europe adopted Convention 108, the first binding international treaty devoted to data protection. The convention did not speak only to digital identity, but it addressed the precise danger that digital identity systems create: the ability to collect, process and exchange personal information across institutions at low cost and high speed. In other words, the infrastructure of digital identity and the infrastructure of privacy law grew up together.
1970s to 1990s: public key cryptography changes the trust model
If administrative databases supplied one half of digital identity, cryptography supplied the other. In 1976, Whitfield Diffie and Martin Hellman published their landmark paper on new directions in cryptography, introducing the possibility of secure communication between parties who had not previously shared a secret. Soon after, Ronald Rivest, Adi Shamir and Leonard Adleman developed RSA, a practical public key cryptosystem.
These advances mattered because they changed how trust could be organised online. Instead of relying solely on closed institutional systems, public key cryptography made it possible to verify signatures, authenticate users and protect communications over open networks. Identity could now be asserted and validated mathematically, not just administratively.
By the 1990s, this model had become central to internet security. The X.509 standard, developed through international telecommunications standardisation, created a widely used format for digital certificates. Public key infrastructure, or PKI, promised a world in which trusted authorities could issue digital credentials that would allow individuals and organisations to transact securely online.
Digital identity did not begin on the internet; the internet inherited it from a much older administrative tradition.
Yet PKI also exposed a durable truth about digital identity: technical elegance does not guarantee social adoption. Certificate hierarchies proved complex to govern. Trust anchors were centralised. User experience was poor. The cryptographic solution to identity was real, but it was never politically neutral or institutionally self-executing.
1990s: the web creates a mass market for authentication
The commercial internet transformed identity from a specialist issue into an everyday one. Once millions of people began using web services, email and online banking, systems for proving who someone was became economically indispensable. The simplest answer was also the most fragile: the username and password. It was cheap, easy to deploy and almost infinitely scalable. It also shifted the burden of identity management on to users, who were expected to remember credentials across growing numbers of services.
In parallel, governments sought legal recognition for electronic transactions. In 1999, the European Union adopted a directive on a Community framework for electronic signatures. In 2000, the United States enacted the E-SIGN Act, giving legal force to electronic signatures in interstate and foreign commerce. The legal environment was catching up with the technical one: identity no longer had to be witnessed in person or embodied in ink on paper to carry official weight.
This period also established an enduring split in digital identity. On one side were private-sector account systems built for convenience and market access. On the other were high-assurance identity frameworks, often linked to law, regulation and state recognition. The friction between convenience and assurance has never disappeared.
2000s: e-government turns identity into a public utility
During the 2000s, many governments began treating digital identity as a foundation for e-government. The logic was straightforward. If citizens were to file taxes online, access public services remotely or sign official documents electronically, the state needed a reliable way to authenticate them. Several countries built schemes that linked legal identity to digital credentials, often through smart cards, mobile systems or national population registers.
One of the most studied examples came from Estonia, where a national ID-card infrastructure, backed by cryptographic signatures and legal interoperability, became integral to public administration. The significance of the Estonian model lay not merely in technology but in institutional design. Identity was embedded in a broader system of data exchange, administrative process and legal recognition. It illustrated that digital identity works best when aligned with state capacity, coherent governance and clear public purpose.
What scaled digital identity was not merely better code, but the decision to treat identification as public infrastructure.
International institutions took notice. The World Bank and other development agencies increasingly framed identification as an enabler of service delivery, financial inclusion and state effectiveness. The argument was especially influential in lower- and middle-income countries, where weak identity systems were seen as barriers to voting, banking, welfare access and migration management.
But the public-utility framing came with risks. Once identity became a gateway to essential services, errors and exclusions could become more consequential. A missing record, failed biometric match or inaccurate register entry might mean not just inconvenience, but denial of income, healthcare or legal recognition.
Late 2000s to early 2010s: mobile connectivity and biometrics broaden the field
As mobile phones spread and sensor technology improved, digital identity expanded beyond fixed desktop environments. Authentication was no longer confined to passwords typed into websites. It increasingly included one-time codes, SIM registration, mobile ID systems and device-linked credentials. At the same time, biometric technologies moved from specialist security settings towards mainstream identity management.
What scaled digital identity was not merely better code, but the decision to treat identification as public infrastructure.
Fingerprints, facial images and iris scans were attractive to policymakers because they appeared to solve a persistent problem: how to make identity unique and difficult to share or forge. The appeal was particularly strong in contexts where documentary records were incomplete or inconsistent. Biometrics seemed to offer a route from weak legacy systems to stronger digital assurance.
Yet this was also the moment when criticism sharpened. Unlike passwords, biometric traits cannot simply be changed after compromise. Their use can increase the consequences of breaches, false matches and function creep. Researchers and civil-liberties groups warned that biometric identity systems, especially when combined with centralised databases and weak oversight, could entrench surveillance or discrimination. The technical promise of uniqueness did not eliminate the political question of legitimacy.
2010s: identification becomes a development priority
The 2010s marked a decisive shift in global policy. Identification was no longer treated primarily as a domestic administrative matter; it became an international development objective. In 2014, the World Bank launched Identification for Development, an initiative arguing that robust and inclusive identification systems were essential to economic participation, service delivery and legal empowerment. In 2015, the United Nations’ Sustainable Development Goals included target 16.9: to provide legal identity for all, including birth registration, by 2030.
That commitment reflected a hard reality. According to international estimates, large numbers of people still lacked official proof of identity, making it difficult to access schooling, social protection, finance, property rights or cross-border mobility. Digital systems appeared to offer a way to close the gap more quickly than paper-based administration alone.
But the push for universality also raised the stakes. If digital identity is required to participate in social and economic life, then system design becomes a question of rights, not merely efficiency. Inclusion depends not only on enrolment numbers but on governance: redress mechanisms, accessibility, data minimisation, interoperability and protections against misuse.
Mid to late 2010s: regulation and rights reshape the debate
By the middle of the decade, the digital identity conversation was being reshaped by a broader turn towards data rights and platform accountability. In Europe, the General Data Protection Regulation, adopted in 2016 and applied from 2018, strengthened rules around consent, purpose limitation, data minimisation and individual rights. Digital identity systems, whether public or private, had to reckon with a stricter legal environment.
The European Union also advanced a more integrated trust-services framework through eIDAS, which established a basis for cross-border recognition of electronic identification and trust services within the bloc. This mattered because identity does not stop at national borders. Trade, migration, education and public administration all create demand for credentials that can be recognised across jurisdictions.
The period clarified a central lesson: digital identity is never just about proving who someone is. It is also about deciding which institutions may ask, what they may learn, how long they may retain it and whether individuals can contest the result. Rights-based regulation did not settle these questions, but it made them impossible to ignore.
The crucial question is no longer whether identity can be digitised, but under what rules, for whose benefit and with what recourse when systems fail.
Late 2010s to early 2020s: decentralised ideas and verifiable credentials
As frustrations with centralised identity silos mounted, new approaches gained traction among standards bodies and policy researchers. One strand of thinking focused on user-controlled or decentralised identity: systems in which individuals could hold and present cryptographically verifiable credentials without every transaction requiring direct contact with the original issuer. The World Wide Web Consortium’s work on Verifiable Credentials became a key reference point.
The crucial question is no longer whether identity can be digitised, but under what rules, for whose benefit and with what recourse when systems fail.
The attraction was clear. Such models promised more selective disclosure, better portability and less dependence on giant central databases. In principle, a person could prove a fact about themselves, such as age, qualification or licence status, without exposing unrelated personal data. This represented a shift from identity as exhaustive revelation to identity as minimal necessary proof.
Still, decentralisation solved only part of the problem. Credentials must still be issued by trusted institutions. Relying parties must decide which issuers to trust. Devices can be lost, interfaces can confuse users and market incentives can push systems back towards concentration. Decentralised identity is best understood not as an escape from governance, but as a different way of organising it.
2020 to 2022: the pandemic accelerates digital credentials
The Covid-19 pandemic did not invent digital identity, but it dramatically expanded public familiarity with digital credentials. Health certificates, online service access and remote verification became more prominent during a period when physical movement and face-to-face administration were constrained. The European Union Digital COVID Certificate, for instance, demonstrated how interoperable credentials could be deployed across multiple jurisdictions under urgent conditions.
The episode was instructive for two reasons. First, it showed that digital credentials can be adopted quickly when there is a clear use case, common standards and political coordination. Secondly, it revealed how fragile legitimacy can be when identity-linked systems are introduced under pressure. Questions about proportionality, expiry, interoperability and secondary uses quickly surfaced.
For digital identity more broadly, the lesson was sobering. Technical functionality may be achieved faster than durable public trust. A credential that works cryptographically may still fail politically if governance is opaque or if people fear mission creep.
2020s: digital wallets and cross-border identity
In the present decade, attention has shifted towards digital wallets, reusable credentials and cross-border interoperability. In Europe, the revised eIDAS framework and the move towards a digital identity wallet reflect a strategic effort to create a trusted ecosystem for authentication, attestation and signatures across member states. Similar conversations are taking place elsewhere, as governments consider how citizens might store and present official credentials securely through consumer devices while retaining legal validity.
These initiatives reveal how digital identity is maturing. The objective is no longer simply to replicate paper documents online. It is to create a modular credential layer for the digital economy: one that can support public services, banking, education, mobility and professional certification. In effect, identity is becoming part of the transactional fabric of digital societies.
Yet the old trade-offs remain visible. Wallet architectures may reduce data sharing in some contexts while increasing dependence on device ecosystems in others. Cross-border interoperability may ease mobility while creating pressure for standardisation that does not fit every legal culture. And stronger credentials may improve security while making anonymous or pseudonymous participation harder to preserve.
What the history suggests about the next phase
The history of digital identity suggests that the field advances in waves, each driven by a different institutional need. The first wave was administrative: how to record populations efficiently. The second was cryptographic: how to verify identity over insecure networks. The third was transactional: how to support e-commerce and e-government. The fourth, now under way, is architectural: how to build interoperable credential systems that are portable, privacy-aware and suitable for cross-border digital life.
Three judgments follow. First, digital identity should be treated as constitutional infrastructure, not merely technical plumbing. Systems that mediate access to welfare, mobility, work and speech require safeguards proportionate to their social power. Secondly, inclusion must be measured by outcomes, not enrolment statistics. An identity system is not inclusive if people cannot correct errors, recover access or use it without undue dependence on a single channel or device. Thirdly, privacy is not the enemy of functionality. Well-designed credentials can reduce data exposure while preserving trust, but only if institutions resist the temptation to collect everything simply because they can.
The next chapter will probably not be defined by a single global model. Different jurisdictions will continue to balance convenience, civil liberties and state capacity in different ways. But the strategic direction is clear enough. Identity is becoming a programmable layer of governance and commerce. The central challenge is to ensure that, as this layer becomes more capable, it does not become less accountable.
