The Better Identity Coalition has circulated a draft voluntary code of conduct it describes as “rules of the road” for how organizations request and use data from verifiable digital credentials. The effort offers an early framework for limiting overly broad or invasive data requests as verifiable credentials move closer to real-world deployment.
The draft is described by the Center for Cybersecurity Policy and Law as a “straw man” intended to set expectations for credential issuers, wallet providers, and relying parties around appropriate data use and misuse prevention. While many digital ID programs emphasize selective disclosure in theory, the coalition’s work is aimed at turning that principle into operational norms that can survive procurement checklists and product roadmaps.
Verifiable credentials are typically designed to let a user present a claim, such as age eligibility, without handing over an entire identity record. That model underpins many wallet and credential initiatives, including deployments and pilots that mirror Telefonica Tech’s self-sovereign identity launch.
In the U.S., the question of how credentials are requested and verified often intersects with state-issued identity, especially as public agencies weigh digital versions of driver’s licenses and other credentials. The coalition has previously argued for a larger role for state motor vehicle agencies as trust anchors, including in Better Identity Coalition’s Blueprint for State Policymakers.
The voluntary code also lands as industry groups work to define wallet trust and interoperability. For example, FIDO Alliance’s Digital Credentials Initiative is pushing into credential policy and wallet certification, and ecosystem investment continues in decentralized identity infrastructure, including NEC X’s investment in Indicio.
A key practical question is whether a shared set of expectations can curb data maximalism in credential requests without breaking risk controls. For buyers, a voluntary code can become a shorthand for what responsible credential use should look like – and, over time, a de facto requirement in RFPs.
Even without binding legal force, voluntary guidance can shape what gets built into wallet UX and verifier workflows: what data is requested by default, how requests are justified to users, whether logs are retained and shared, and what recourse exists when a credential holder believes a request is inappropriate. Those choices are likely to be scrutinized as credentials move from pilots into consumer-facing programs.
Sources: Center for Cybersecurity Policy and Law
–
By Cass Kennedy
