Sharing an identity credential leaves privacy questions

Historical report — W3C’s October 20, 2026 Digital Credentials draft described browser-mediated presentation and issuance of credentials. It remained a Working Draft, without W3C endorsement, rather than a completed standard or universal browser capability. ^[1]

A separate May 2025 data-model standard distinguished issuers, holders and verifiers: one party made claims, another held credentials, and a recipient checked them. It said verifiers still had to validate claims and choose which issuers to trust. Checking a credential’s authorship did not automatically settle whether its claims were suitable for a particular decision. ^[2]

W3C’s May 2025 Privacy Principles addressed another layer: minimizing the data requested to carry out a person’s goals and giving people control over what was shared. Those were architectural principles, rather than an audit of every wallet. A request’s information needs remained separate from a credential’s technical authenticity. ^[3]

On October 20, FIDO Alliance promised wallet-architecture and verifier-identification working documents in the weeks following that announcement. The latter concerned identifying the service requesting information, not just the credential holder. It was a prospective certification framework, not evidence that every wallet or requesting website had passed an assessment. ^[4]

The browser draft itself warned that long-lived identifiers could enable tracking, even with selective disclosure. Its mediation mechanism did not remove the need to scrutinize unnecessary identity requests. ^[1]

About this item: Retrospective report. No first-hand reporting or independent testing is claimed. Corrections policy.