For most of the twentieth century, a passport was a booklet, a stamp and a border guard’s judgement call. What is replacing it is something rather more complicated, and the consequences stretch well beyond travel.
Identity Is the New Battleground of the Digital Age
For most of human history, proving who you were meant producing something physical: a face someone recognised, a document bearing a state seal, a signature that could be compared to a ledger. The bureaucratic machinery built around these anchors was slow by design: slow enough to make forgery difficult, slow enough to allow for human scrutiny. That era is ending faster than most governments anticipated.
The infrastructure of personal identification is being rebuilt from the ground up, driven by the convergence of biometrics, cryptography and distributed ledger technology. What emerges will determine not just how governments issue passports, but how individuals control their own data and how the boundary between physical and digital existence is drawn. The question of who gets to define that boundary, states, corporations or citizens themselves, is where the real argument lies.
Join The European Business Briefing
New subscribers this quarter are entered into a draw to win a Rolex Submariner. Join 40,000+ founders, investors and executives who read EBM every day.
SubscribeIdentity underpins access to healthcare, financial services, voting rights and legal standing. Get the transition wrong and you do not just inconvenience people: you exclude them. The World Bank’s most recent data puts the number of people worldwide without any recognised legal identity at around 800 million, a figure that shapes everything from access to bank accounts to the ability to cast a ballot.
From Paper to Programmable: The Identity Revolution
The shift from analogue to digital identity has been underway for two decades, but Covid-19 compressed what might have been a ten-year transition into roughly eighteen months. When physical verification became impossible overnight, governments that had resisted remote identity checking suddenly had no alternative. Some of the improvised solutions that emerged during lockdown, video-based identity checks, e-signatures, remote biometric enrolment, have since become standard practice, with no serious appetite to reverse them.
Today, the frontier of civil identity management now sits at the intersection of biometric authentication and cryptographic security. Facial recognition and fingerprint scanning, once the preserve of border agencies and intelligence services, have become routine at commercial airports: British Airways now boards all domestic departures from Heathrow’s Terminal 5 biometrically, with passengers walking through gates using a face scan rather than presenting a boarding card. International routes are following, with the airline running active trials on selected flights.
The European Union’s eIDAS 2.0 regulation represents the most ambitious attempt yet to create an interoperable digital identity layer across a major economic bloc. Under the framework, member states are required to make a European Digital Identity Wallet available to all citizens by 2026. The wallet would allow individuals to store verified credentials (a driving licence, a professional qualification, a prescription) and disclose only what is strictly necessary in each transaction, rather than handing over a full document. Whether governments meet that deadline, and what citizens actually do with the wallets once issued, remains to be seen.
Biometrics: Power and Peril
Biometric identification has gained ground for a straightforward practical reason: it is considerably harder to forge than anything a printing press can produce. Stolen passwords are sold in bulk on criminal marketplaces. Counterfeit documents, while not trivial to produce, have a long history of fooling border agencies. A live facial scan matched against a cryptographically signed enrolment record is a harder problem to crack, at least at scale.
Deployment has accelerated sharply across both public and private sectors. Schiphol and Changi airports now route a significant share of passengers through fully automated biometric gates. Several major European banks have moved facial and voice authentication into their standard verification flow for high-value transfers, partly for security and partly because customers proved more willing to use it than product teams had expected.
The technology has not been without controversy. Studies by the US National Institute of Standards and Technology found measurable error-rate disparities across demographic groups in some commercial facial recognition systems, with higher false-positive rates for darker-skinned women in particular. Regulators have been slow to draw hard conclusions from this work. The EU AI Act now classifies real-time biometric identification in public spaces as high-risk, placing the legal burden of proof on those who deploy it. In Brussels, civil society organisations have campaigned for an explicit municipal ban; several other European cities have called for similar restrictions while the EU-level framework is still being implemented.
None of that debate is close to resolution. The efficiency gains from biometric verification are real enough that governments and corporations will not abandon it; the civil liberties concerns are serious enough that some form of tighter regulation is probably inevitable. Where exactly that line is drawn will look different in Berlin, Washington and Nairobi.
Decentralised Identity: Giving Control Back to Individuals
Alongside the biometric wave runs a rather different current: the push toward decentralised identity. Under the model that has dominated for decades, your data lives with the institutions that issued your credentials, a government database, a bank’s KYC records, a social platform’s user profile. Those institutions act as gatekeepers, and when they are breached, so is your identity.
Decentralised identity inverts that model. Borrowing cryptographic principles from blockchain technology, it allows individuals to hold their own verified credentials in a digital wallet and present only what a particular transaction actually requires. To prove you are over 18, you would not hand over your date of birth; you would share a cryptographic attestation that the relevant authority has already verified that fact. The verifier gets a yes or no. Nothing else transfers.
This matters because over-disclosure has become a quiet structural problem. Today, proving your age to an online platform typically means handing over a scan of a passport or driving licence: your full name, date of birth, address and document number, processed by a third-party verification service whose data retention practices you have no practical way to audit. A working decentralised identity system collapses that into a single cryptographic confirmation, accurate and difficult to misuse.
The technical groundwork has been laid. The W3C’s Verifiable Credentials standard and Decentralised Identifiers specification provide a common language for these systems. Microsoft has been an active builder in this space, developing its own DID infrastructure. Apple and Google, by contrast, filed formal objections to the W3C’s DID Core standard when it was published, as both companies have their own credential ecosystems (Apple Wallet, Google Wallet) that do not rely on the decentralised model. The harder question is uptake: identity systems are only useful when they are universally accepted, and the history of digital identity is littered with well-designed standards that never achieved critical mass, in part because the largest platform companies preferred to retain control over the infrastructure.
The Geopolitics of Identity Infrastructure
Identity infrastructure is never politically neutral, even when it presents itself as a technical standard. Who controls the system through which citizens prove who they are holds significant power: over access to services, over the flow of personal data, and over the state’s capacity to monitor its own population.
China’s national identity system, deeply integrated with its social credit infrastructure, illustrates one direction of travel: a state-controlled identity layer that serves both citizen convenience and population surveillance, with the balance between the two determined centrally rather than by individual choice. The EU’s regulatory approach is explicitly a counter-model. GDPR, eIDAS 2.0 and the AI Act together amount to an attempt to make data minimisation and individual consent architectural features of European digital infrastructure, not optional add-ons.
Between those poles, much of the world is making foundational choices without the luxury of replacing legacy systems. India’s Aadhaar programme, which has enrolled over 1.3 billion people in a centralised biometric database since 2009, represents one model; Kenya’s move toward a federated digital identity architecture represents another. The decisions being made now across Africa and South Asia will shape how a substantial portion of humanity interacts with states and markets for the next generation.
What Comes Next
The near-term trajectory is reasonably clear. Biometric passports will give way to fully digital travel documents held on smartphones; Australia already uses facial recognition SmartGates across its major airports and has been piloting digital arrival declarations on selected routes, while Gulf states have moved further with end-to-end biometric processing at several terminals. Physical payment cards are being replaced not just by phones but increasingly by the biometric itself, your face or fingerprint as the authentication credential, with no intermediate device required. What is less clear is the governance framework that will surround these changes, and whether the regulatory imagination of most governments is moving quickly enough to keep pace.
The regulatory gap is real, but it is not evenly distributed. The EU has produced more identity-related legislation in the past three years than in the previous decade. The United States, by contrast, still has no federal digital identity framework, leaving a patchwork of state-level initiatives and private-sector standards that may or may not prove interoperable. That divergence has implications not just for citizens but for any organisation trying to operate across both jurisdictions.
What is clear is that identity has stopped being a solved problem. For most of the twentieth century it was treated as infrastructure: unglamorous, largely invisible, managed by civil servants and filing cabinets. It is now a contested frontier, where the commercial interests of platform companies, the security priorities of states and the privacy expectations of citizens are pulling in directions that do not always align.
The organisations and governments that shape the emerging architecture will have significant influence over how that tension is resolved, and over who gets left out of the systems they build. That is a less comfortable framing than “the future of identity”, but probably a more accurate one.
