It will not stop criminal activity. It hands your identity to US-controlled infrastructure subject to US law. It will harm the vulnerable. And the child protection argument doesn't hold up to scrutiny.

We are living through a sustained period of escalating, sophisticated cyber attacks. In 2024, a ransomware attack on Synnovis — an NHS blood testing partnership — forced hospitals in London to cancel thousands of appointments and resulted in the exposure of patient data affecting hundreds of thousands of people.^[1] In 2023, the Electoral Commission disclosed it had been subject to a hostile attack giving access to the electoral registers of approximately 40 million people — access that had gone undetected for over a year.^[2] The Ministry of Defence, multiple NHS Trusts, and HMRC have all experienced significant data incidents in recent years.

The UK government does not have a good record of keeping data safe.

Against this backdrop, the proposal is to build centralised infrastructure linking every citizen's verified identity to their digital life.

Labour's own MPs recognised this. Rebecca Long-Bailey said in the December 2025 parliamentary debate that the real fear was that "we will be building an infrastructure that can follow us, link our most sensitive information and expand state control over all our lives." She added that this policy "does not arrive in a vacuum — it sits alongside a worrying pattern: the accelerated roll-out of facial recognition, attempts to weaken end-to-end encryption, and data laws that strip away privacy protections."^[3]

The Sovereignty Illusion — It's Not a British System

There is a dimension to this debate that has received almost no attention in mainstream coverage, and it is the one that should concern engineers, security professionals, and anyone who cares about what digital sovereignty actually means in practice.

The Government Digital Service — the body building GOV.UK One Login, the authentication layer on which Digital ID would be built — mandates Amazon Web Services as its core infrastructure provider. This is not contested. It is published GDS policy.^[4] AWS signed contracts worth £894 million with three central government departments in a single day in December 2023 — £450 million with the Home Office, £350 million with HMRC, and £94 million with the Department for Work and Pensions.^[5] Across the UK public sector, 95% of central and local public sector organisations spent budget on hyperscale cloud services in 2023/24 — when software services running on hyperscale cloud are included, that figure rises to 99%, covering more than 1,100 public sector bodies including government departments, councils, police forces and NHS organisations.

Amazon Web Services is an American company. It is subject to US law. Specifically, it is subject to the CLOUD Act — the Clarifying Lawful Overseas Use of Data Act, passed by the US Congress in 2018. The CLOUD Act grants US law enforcement extraterritorial authority to compel US companies to produce data stored anywhere globally, and makes geographic data residency in UK regions legally irrelevant when American corporate jurisdiction enables compelled disclosure.^[6]

The device layer compounds this further. The GOV.UK Wallet — the mechanism by which digital ID would be held — lives on phones running iOS (Apple, US company, US jurisdiction) or Android (Google, US company, US jurisdiction). The UK has already used the US-UK CLOUD Act agreement to attempt to compel Apple to disable end-to-end encryption on iPhone backups globally — a demand Apple resisted and which has been reported by Lawfare as an extraordinary overreach.^[9] The device manufacturers who would hold your identity credential are the same companies whose encryption the UK government is actively trying to undermine.

The government's own consultation document cites Estonia as the model for what Digital ID could achieve.^[10] Work and Pensions Secretary Pat McFadden identified the Estonian identity card explicitly as the inspiration for the scheme in Parliament. This comparison is either dishonest or reveals a fundamental misunderstanding of why Estonia's system works.

What makes Estonia different is its philosophy. Data is decentralised across secure databases, connected by a backbone called X-Road. Every access is logged, so citizens can see who looked at their data and why. Estonian engineers designed X-Road at its inception to ensure data sovereignty while enabling seamless interoperability — a standardised, reusable infrastructure operating securely over the public internet, with the sovereignty built into the architecture from the ground up.^[11]

X-Road is open-source software, developed and controlled by the Nordic Institute for Interoperability Solutions — a consortium of Estonia, Finland, and Iceland. It runs on infrastructure owned and operated by the Estonian state. It is not hosted on AWS. It is not subject to the CLOUD Act. It is not dependent on Apple or Google to deliver the wallet. The entire value of the Estonian system is that Estonia controls it. A British system built on US hyperscaler infrastructure and delivered via US-controlled devices is not Estonia. It is the aesthetic of Estonia layered on top of the sovereignty problem it was specifically designed to solve.

The Liberal Democrat spokesperson for science and technology, Tim Clement-Jones, put it plainly when discussing the UK's hyperscaler dependency: "If you see that kind of risk, where a hyperscaler like Microsoft can be pressured to withdraw a service, you have to look at the fact that we are so heavily embedded — we've got Microsoft, AWS and Google all over government. Where are the alternative UK suppliers?"^[12]

The question answers itself. There are none. Because the government's cloud-first policy has spent a decade ensuring there would be none. Digital ID, built on this infrastructure, does not create a sovereign identity system. It creates a US-controlled identity system with British branding — and it creates it at precisely the moment when the reliability of US institutional alignment with UK interests is less certain than it has been at any point since the Second World War.

It Won't Work. And It Will Cause Harm.

The practical argument against Digital ID is straightforward and devastating.

Criminal activity online — exploitation of children, trafficking, radicalisation, serious organised crime — does not primarily occur on the open, indexed, regulated web that Digital ID would affect. It occurs on the dark web, in encrypted channels, in private networks specifically engineered to resist identification. Tor, I2P, and the range of tools used by serious criminal actors are not affected by whether a mainstream browser requires identity verification — these tools were engineered specifically to resist exactly this kind of architecture.^[24] The people conducting serious criminal operations will route around age verification in minutes. They already have. It is where they live.

What Digital ID will do is impose a surveillance layer on the law-abiding majority that provides negligible safety benefit and measurable, serious harm to the most vulnerable people the system claims to protect.

The person researching addiction will not seek help if their real identity is attached to the search. The young person questioning their sexuality in an unsupportive household will not look for community if their browsing is attributable. The abuse victim researching their options will not reach out if they cannot do so privately. The person in the early stages of leaving a controlling relationship will not look for resources if every search is traceable. The person with a stigmatised mental health condition will not seek information if doing so creates a permanent record.

The internet gave vulnerable people a private route to information and connection that had never previously existed in human history. Digital ID closes that route — and closes it in the name of people who have demonstrably failed to use the mechanisms that were already available to them.

We do not need to speculate about what happens when governments mandate the collection of identity data at scale. It happened last year. The UK government mandated it. The data was collected. And then it was stolen.

Proton's conclusion is the only intellectually honest one available: even those who take child safety seriously, even those who acknowledge the harms of unregulated online access, must accept that age verification systems cannot be deployed until "genuinely secure, decentralised, open standard solutions that genuinely respect your privacy are developed and made widely available."^[14] The Estonia model in the sovereignty section above is exactly what that looks like. What the UK government is building is not that.

The Child Protection Argument, Examined

And now the argument that is designed to end all argument.

Digital ID. Age verification. Online safety. The children.

The deployment of child protection as the justification for Digital ID deserves to be examined with the same rigour we apply to any other claim. When we do, the gap between the stated justification and the verifiable record of those advancing it is large enough to be structurally significant.

The existing legal framework for addressing child exploitation online is not inadequate. The National Crime Agency's CEOP Command operates within existing law and has achieved real results.^[19] The tools exist. What they require is political will and adequate resourcing — both of which have been provided more reliably to bodies pursuing copyright infringement than to those pursuing serious exploitation.

Keir Starmer was Director of Public Prosecutions when the Crown Prosecution Service reviewed the Jimmy Savile file in 2009 and concluded there was insufficient evidence to prosecute.^[20] Savile was by then already known to some in the establishment as a serious predator. The Independent Inquiry into Child Sexual Abuse subsequently found he had abused victims across thirteen NHS hospitals over decades.^[21] The failure was institutional. Starmer led the institution.

The figures who appear in proximity to child protection policy — whose networks intersect with the circles that shape online safety legislation — do not uniformly have records that invite deference to their instincts on this subject. The partial release of documents relating to Jeffrey Epstein's network is revealing not because of what it confirms but because of what it tells us about the distance between the public positioning of the powerful and their private conduct.^[22]

What the record actually shows is this: our laws, when applied with genuine intent, work. The Digital Economy Act 2010 was enforced with more consistent energy against teenagers downloading music than against the abuse of children by those with access to institutional protection.^[23] That disproportion is not accidental. It is the system revealing its actual priorities.

Digital ID will not protect children from those who abuse them with institutional impunity. It will prevent vulnerable young people from anonymously seeking help — which is precisely what Part 2 of this series documented. It makes the internet less safe for the people it claims to protect.

The child protection argument for Digital ID is a political instrument. It is deployed to make opposition toxic and silence dissent. It deserves to be named as such — and then set aside so the actual argument, about surveillance, about corporate immortality, about who controls access to the information commons that was given to all of us, can be examined on its merits.

Next: Part 4 — The Street. We are turning the tide. 2.9 million signatures. A Labour government on its 13th U-turn. Rallies in London, Edinburgh, Cardiff and Belfast on 25th April. Here is where we stand and what you can do.