Big news from hashtag#EIC2025 yesterday: AAMVA (American Association of Motor Vehicle Administrators) said on stage that they will forbid their members from enabling “server retrieval”, the hidden surveillance feature inside the new mobile driving license (MDL).
This is big news. While no hashtag#MDL in production currently uses this “phone home” feature, it’s very existence in the ISO specification means that, in theory, the DMV could choose to be notified every time you use your MDL to prove your identity, age, or address. Given the wide range of scenarios where an instantly-verifiable digital identity credential like an MDL would be useful, this could be tantamount to a citizen-scale surveillance dragnet for the government: a massive invasion of privacy and curtailment of liberty. Thankfully, hashtag#privacy advocates have been tirelessly shining a light on this risk, and with this clarification of policy we know that at least in the US the risk is somewhat reduced. How the rule will be enforced and what transparency measures will be in place are not yet clear, but this is a very positive step nonetheless.