Online identity verification without big tech: how decentralized ID can help

In many parts of the country, the only thing you need to check out at Whole Foods is the palm of your hand. Amazon recently announced its plan to expand this payment system, known as Amazon One, to stores nationwide, as well as to other retailers, concert venues, and stadiums.  

The program, which announced its expansion plans in July, is part of the company’s efforts to integrate biometric data into payments systems and a direct response to growing competition from Apple and Google in the realm of digital wallets. But shopping applications like Whole Foods undersell Amazon’s larger ambitions: identity verification through biometrics. In the long term, Amazon One hopes to become a one stop shop for all ID needs—which today includes retail payments and age verification and could one day sweep in sensitive data like medical records.

The need for better online identification is not new. Before the internet, most people relied on physical identification papers and cards, such as a birth certificate, a driver’s license, or passport. These documents are issued by a trusted public authority, usually the government, but are still susceptible to fraud and loss. And in 2023, about 850 million people worldwide lacked any form of official ID. 

With the advent of the internet, digital identification solutions that rely on username and password login systems were developed. These digital IDs can be more accessible and convenient. But anyone who has forgotten their login information or been victim of a data breach knows this solution is deeply flawed at best. And most digital ID solutions in use today can only verify a user’s identity on a specific digital platform, without real world applicability. 

Newer identification solutions like Amazon One, known as federated identification, attempt to solve the core inconvenience and security challenges created by digital IDs. But because they rely on centralized, third parties like Amazon or Google to store information, they are still subject to security and privacy risks. Indeed, the prospect that Amazon or another tech giant would collect, store, and share large amounts of users’ biometric data has already raised privacy concerns among citizens’ rights groups, and skeptics have been quick to point out the cybersecurity and hacking vulnerabilities presented by outsourcing a core public need to a private company.

Fortunately, there’s a promising alternative that is both convenient for users and free of centralized reliance on a private entity. Known as decentralized identity, it relies on blockchain technology to solve the security, privacy, and consent issues presented by legacy forms of identification.  

Decentralized ID (DiD) removes the need to outsource identity management to centralized authorities. Instead, user data is distributed and stored on the blockchain and in users’ own digital wallets. With DiD, trusted third-party “issuers” verify key identifiers and credentials – whether a birth certificate issued by the state, proof of employment issued by an employer, or a diploma issued by a university. When a third party requests this information, the user presents proof of the credential by accessing the data stored on the blockchain and locally in their own wallet. 

The potential benefits of this type of decentralized identification system are significant. Because DiD allows users to answer questions like “do you meet the income requirements” without revealing unnecessary information like account numbers and birthdate, the technology solves many of the core problems presented by legacy forms of identification. These include: 

• Privacy and control issues (no one has access to personally identifiable information that you do not share), 

• Convenience (there is one single source of truth – not a multitude of passwords and siloed accounts), 

• Portability (your DiD follows you if you move or change a service),

• Security (data is encrypted), 

• Expanded access (it is available to anyone with a phone or internet access), and 

• Other institutional benefits, such as the ease of verification and the elimination of the need for large repositories of data.

Being able to prove you are who you say you are underpins everything we do in life, from shopping to working to participating in our civil society. As our economy becomes ever more digitized, the ability to identify oneself online will only become more critical. At the same time, access to and usability of identification have been longstanding policy problems, and it is important that we find a solution that works for everyone.

For DiD to move from promise to reality it will need to overcome the challenge of network effects such as interoperability and accessibility concerns. The full utility of DiD can only be unlocked by widespread use. Governments around the world have begun to recognize this, as well as the benefits that DiD can bring, with the European Union and Argentina both moving to adopt some form of DiD solutions.

Regulatory clarity surrounding blockchain technology will be essential to DiD’s success in the US. For example, companies have developed innovative ways of using blockchain and DiD to improve compliance and better fight money laundering. But the current lack of clear regulatory guidance when it comes to crypto is hampering the pace of innovation in this space. As the U.S. considers a path forward, it should prioritize identity systems that best protect user control, consent, and privacy.