1. (1) A state-endorsed digital identity shall:

   1. (a) incorporate state-of-the-art safeguards for protecting an individual's identity, including compromise detection, recovery mechanisms, and cross-context correlation protections;
   2. (b) include methods to establish authenticity and integrity;
   3. (c) be compatible with a wide variety of technological systems while maintaining strong privacy and security;
   4. (d) support online and offline presentation;

   5. (e) enable a holder to:

      1. (i) selectively disclose an individual's identity attributes; or
      2. (ii) demonstrate that the individual meets a specified minimum age without disclosing the individual's age or birth date;
   6. (f) allow a holder to choose a digital wallet that conforms with the requirements established by the department; and
   7. (g) be easy for a holder to adopt and use.

2. (2) The department shall:

   1. (a) validate verification of an individual's identity provided by an identity proofing entity;
   2. (b) comply with the requirements of this chapter through technological means where possible;
   3. (c) ensure any technical infrastructure used to control the issuance or revocation of a state-endorsed digital identity is maintained within a state-controlled data center located within the state;
   4. (d) ensure that a state-controlled data center located within the state shall use best practices in collection, processing, storage, and disclosure of all individual identity and identity attributes;

   5. (e) select open technological standards for the creation, issuance, use, and acceptance of a state-endorsed digital identity that are:

      1. (i) publicly available; and

      2. (ii) free from:

         1. (A) licensing fees; and
         2. (B) patent restrictions;

   6. (f) verify and endorse a specific set of identity attributes including an individual's:

      1. (i) name;
      2. (ii) birth date;
      3. (iii) image; and
      4. (iv) Utah residence address; and

   7. (g) create a process for:

      1. (i) a holder to:

         1. (A) obtain, maintain, and control an individual's state-endorsed digital identity;
         2. (B) use an individual's state-endorsed digital identity;
         3. (C) limit access to an individual's state-endorsed digital identity and identity attributes;
         4. (D) obtain a new state-endorsed digital identity if the individual's state-endorsed digital identity is compromised; and
         5. (E) migrate a state-endorsed digital identity to another digital wallet compliant with this chapter;
      2. (ii) a holder to request that an individual's identity attributes be amended or corrected; and
      3. (iii) appointment of a digital guardian to obtain or use a state-endorsed digital identity on an individual's behalf.
3. (3) A state-endorsed digital identity may not include a mechanism that allows the department to monitor, surveil, or track the presentation of a state-endorsed digital identity to another entity.

4. (4) Information provided by an individual to the state to obtain a state-endorsed digital identity may only be:

   1. (a) used for the purpose of issuing and managing a state-endorsed digital identity;
   2. (b) used as authorized by the individual;
   3. (c) retained as long as necessary to issue and manage a state-endorsed digital identity;
   4. (d) maintained within a state-controlled data center located within the state; or

   5. (e) disclosed to:

      1. (i) the subject of the record or the subject's digital guardian; or
      2. (ii) a person with a warrant or court order.

5. (5) The department may only revoke an individual's state-endorsed digital identity if:

   1. (a) the state-endorsed digital identity has been compromised;

   2. (b) the department's endorsement was:

      1. (i) issued in error; or
      2. (ii) based on fraudulent information; or
   3. (c) the holder requests that the department revoke the individual's state-endorsed digital identity.
6. (6) The department shall report a data breach regarding individual identity or identity attributes in accordance with Section 63A-19-405.

Enacted by Chapter 436, 2026 General Session