Digital ID legislation arrives before the People's Panel finishes. What does the evidence say about cost, security and scope?

Today's King's Speech included the Digital Access to Services Bill, giving the government legal powers to create, issue and verify a national digital ID through the GOV.UK app. 

“My Ministers will also proceed with the introduction of Digital ID that will modernise how citizens interact with public services.”

The public consultation closed on 5 May. The bill was announced while the government's own People's Panel on Digital IDs is still sitting. The panel it doesn't finish until 21 June.  This means  government announced legistlation before hearing the results of its own engagement process. This raises multiple cncerns, especially when every national digital ID system that exists has expanded beyond its original purpose. 

The scheme is now officially voluntary after the original mandatory version, announced by Sir Keir Starmer in September 2025, collapsed under public opposition. A parliamentary petition against it gathered 2.9 million signatures, the fourth largest in British history. Public support dropped from 62% to 31% in three months. 

Mandatory right to work digital checks remain the plan for everyone except British and Irish passport holders. Immigration lawyers are already pointing out that "voluntary" and "mandatory digital right to work checks" sit awkwardly in the same sentence. 

Return on Investment statistics: 

• The OBR priced the Digital ID scheme at £1.8 billion over three years and noted that "no specific savings have yet been identified". The department responsible rejected that figure but declined to offer an alternative. 
• The Tony Blair Institute claims £2 billion in annual savings. The last time a Labour government built a national ID system, the 2006 Identity Cards Act, it cost £4.6 billion before being scrapped. 
• The LSE estimated the true ten year cost at £10.6 to £19.2 billion. 
• The NS&I digital modernisation hit £3 billion with what the Public Accounts Committee called "no meaningful benefits." 
• The NAO has warned for 25 years that the government lacks the skills to deliver large scale digital programmes.

Security statistics. 

• The new ID will be built on GOV.UK One Login, which lost its security certification in April 2025 after a supplier let compliance lapse. 
• A red team exercise in March 2025 found that privileged access could be compromised without detection. 
• The system met 21 of 39 required security outcomes. 
• The bill will allow the digital ID to link HMRC income records, NHS data, DWP benefits information and Home Office immigration status into a single profile raising centeralised surveillance questions.

Scope creep question. 

• India's Aadhaar was introduced for welfare subsidy distribution. It now records every authentication request across services, is being proposed for age verification that would end online anonymity, and has excluded vulnerable citizens from the benefits it was supposed to deliver. 
• China's social credit infrastructure uses centralised identity data to restrict travel, credit, employment and education. Both systems started with a narrow, reasonable justification. Neither stayed narrow.

User experience:

• Anyone who has spent twenty minutes trapped in a chatbot loop trying to reach a human at their bank, energy provider or local council already knows what digital gatekeeping looks like in practice. Digital ID is sold as making services easier to access. The lived experience of digital transformation so far is that it makes services easier to deny, cheaper to run with fewer staff, and harder to challenge when things go wrong. 
• The bill's own briefing notes reference joining up public services. That is also a description of a system where being locked out of one service could lock you out of several.

Estonia's former head of cyber security policy told The National this week that digital ID only works when it "belonged to the state rather than to a Prime Minister" and was built through "honest discussion with the population." Estonia made its infrastructure code publicly available for scrutiny. The UK government has not proposed anything comparable.

• The consultation closed eight days ago. The People's Panel doesn't finish until 21 June. The government has now legislated before hearing the results of either. What does that say about whether this is genuine consultation or pre-decided policy?
• The OBR says the scheme is unfunded. The last attempt cost £4.6 billion and was scrapped. GOV.UK One Login failed its own security framework and a red team gained undetected access. Should a system with this track record be the foundation for national identity infrastructure?
• Every centralised digital ID system in the world has expanded beyond its original stated purpose. What specific legal mechanism in the Digital Access to Services Bill would prevent scope creep, and is it enforceable against a future government with different priorities?
• The bill allows linking of HMRC, NHS, DWP and Home Office data into a single profile. If digital ID becomes the default route to proving who you are, what happens to the people who can't or won't use it, and does "voluntary" stay voluntary when services are redesigned (and by implication withheld) around it?
• If three million petition signatures and a collapse in public support are not enough to stop or meaningfully delay legislation, what level of democratic opposition would be?