You Shouldn't Have to Show Your Address to Buy a Beer

I think about my sisters every time someone asks me to explain what a mobile driver's license actually does.

Picture one of them at a bar. She wants a drink. The bartender needs to know one thing, that she is over 21. So she hands over her physical license, and in that moment the bartender sees everything. Her full legal name. Her home address. Her exact date of birth. Her license number. He did not need any of that. He needed a yes or a no to a single question, and instead he got her whole identity.

We have all just accepted that this is normal. You want to prove one small fact, so you hand over everything, and you trust that the stranger holding your information does nothing with it. That is a lot of trust to hand someone for a beer.

Here is the part that gets me. We do not actually have to do it this way anymore.

This is the piece of my work at login.gov that I cannot stop thinking about. A mobile driver's license is not a photo of your physical card sitting in your phone's wallet. That is the thing most people get wrong. It is not a picture. It is a cryptographically verifiable credential, and the most important thing it can do is answer a question without handing over the data behind the answer.

Watch what happens to that same bar with an mDL. The bartender's reader asks one question. Is this person over 21? Your phone answers with one word. Yes. Not your name. Not your address. Not your birthday. Not your license number. Just the single fact that was actually needed, signed by the state that issued it, so the bartender knows it is real and nobody tampered with it.

That idea has a name. Selective disclosure. You share the minimum required to answer the question in front of you, and nothing else. Once you see it, you start noticing how badly we need it everywhere.

Here, try it yourself.

Think about how many times a week you overshare your identity for no reason. Renting a car. Picking up a prescription. Signing up for something that demands a scan of your license and then keeps a copy forever, on a server you will never see, protected by people you will never meet. Every one of those is a yes-or-no question, and instead you hand over the whole document and hope for the best.

The internet is about to make this much louder. Age verification is getting pushed onto more and more of the web, and doing it honestly means actually verifying identity, which is the exact thing people do not want to do just to visit a website. Nobody wants to upload their license to read an article. And they are right to push back, because today that means oversharing to a stranger all over again, this time at internet scale.

This is not some far-off worry. Look at what is happening with AI right now. Starting July 8, Anthropic, the company behind Claude, updated its policy so it can ask people on its consumer plans to verify their age and identity to keep using it. Not just a password. A government ID and a live selfie with a facial scan, handled by an outside verification company.

Sit with that for a second. One of the most safety-minded AI companies in the world looked at the question of who is really on the other end, and the best tool available was the same one the bar uses. Hand over everything, and trust that it is held well.

I am not knocking them for it. Verifying identity is a real part of deploying powerful technology responsibly, and they are trying to do the responsible thing. That is exactly what makes it matter. The most careful people, in the rooms with the highest stakes, are walking straight into this same wall, and the only tools they have been handed are the oversharing ones.

Selective disclosure is the way out of that fight. Prove you are old enough without proving who you are. Prove you are licensed to drive without handing over where you live. The technology for this already exists. The standard already exists. What is missing is the part I get to work on, which is making it real, getting it adopted, and turning it into something a normal person can use without ever having to read a single word I just wrote.

We spent decades teaching machines to verify who you are. We are only now teaching them to verify the minimum. That second part might end up mattering more than the first.

~ Malik