In brief
Authentication of a person does not establish authority to know everything about that person. VIDA requires identity systems that let people prove what a transaction needs, and nothing more, without the issuer watching where their credentials are used.
- Verification before collection. Where government needs an answer to a defined question, it receives the authorized answer, not the underlying record (Section 10).
- No phone-home. Presenting a credential does not tell the issuer where, when or to whom it was shown (Section 11).
- Selective disclosure. Minimum knowledge exposure for every presentation (Section 12).
- No population golden records. Purpose sequestration, and a prohibition on government records that unify a population's information across purposes (Section 13).
- Interoperability without integration. Connecting systems does not aggregate their authority; identifiers are designed to resist correlation (Sections 14 and 15).
- Nondigital equivalence. Services remain available to people who cannot or choose not to use smartphones, wallets or biometrics (Section 20).
- Commercial participants. Companies that join the identity ecosystem are certified and bound by contractual duties, with prohibited and presumptively prohibited practices (Sections 23 and 24).
Section map
| Sections | What they do |
|---|---|
| 1–4 | Title, findings, definitions, and relationship to PDTA, GAAFA and the FCGIAS architecture standard. |
| 5–8 | Digital autonomy; identity operations and the limits of governmental informational authority; identification and identity resolution; authentication distinguished from authorization. |
| 9–12 | Credential issuance, holding, presentation and delegation; authorized answer and verification before collection; no-phone-home and presentation privacy; selective disclosure. |
| 13–16 | Purpose sequestration and the prohibition on government population golden records; interoperability without integration; anti-correlation identifiers; trust, status and revocation. |
| 17–21 | Open standards, portability and vendor independence; administrative, recovery, guardianship and break-glass capability; integrated service delivery; accessibility; cross-sovereign transactions. |
| 22–26 | Vendors; commercial ecosystem participation and certification; prohibited commercial practices; AI boundary inheritance; procurement and anti-rent-seeking. |
| 27–33 | Data Trusteeship Authority oversight and State CIO implementation; conformance and standards; enforcement; legacy transition through PDTA Section 28; review; effective date 180 days after enactment. |
Text
Bracketed terms, such as "[Legislative Body]" and effective-date periods, are for each state to specify. For drafting assistance, write to legislative@fiduciarycommons.com.