Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:
EU-Canada Digital Partnership Zeroes In on Digital Identity Wallets
The European Union and Canada have placed interoperable digital identity wallets at the center of their formalized digital partnership, following the first meeting of the Canada-EU Digital Partnership Council in Montreal. A new Memorandum of Understanding on Digital Credentials and Trust Services commits both sides to standards alignment, technical interoperability, and joint pilot projects. The move links Canada’s digital credential efforts with the EU’s EUDI Wallet initiative and signals growing momentum toward cross-border wallet interoperability.
Outpost24 Acquires Infinipoint to Push Into Zero-Trust Workforce Access
Outpost24 has acquired device-identity startup Infinipoint, expanding its identity security portfolio into device posture-aware access control. Infinipoint’s technology assigns identities to endpoints and continuously validates device health before granting access, closing a common zero-trust gap where users are verified but devices are not. The deal positions Outpost24 to compete more directly in workforce access markets where conditional, user-and-device-based policies are becoming standard.
SailPoint’s Navigator – Digital Identity Flex Targets Machine and Agent Identities
SailPoint has introduced Navigator – Digital Identity Flex, a bundled offering focused on governing machine identities and AI agents. The package combines Machine Identity Security and Agent Identity Security, allowing organizations to shift coverage as non-human identities proliferate. SailPoint is framing the offer as a way to bring certificates, service accounts, and autonomous agents into the same governance fabric as human users, with auditable access and least-privilege controls.
Moca Network’s MocaProof Beta Blends Web3 Reputation, Digital ID, and Loyalty
Moca Network has launched MocaProof Beta, a digital identity and reputation platform that uses zero-knowledge proofs and on-chain storage to let users present verified attributes without exposing raw data. The system combines identity assertions with NFT-based loyalty mechanics and token rewards, targeting Web3 communities and collectors. While rooted in crypto ecosystems, the model reflects broader experimentation with decentralized identity and privacy-preserving credential presentation.
California’s Identity Gateway: CIO Calls Vendors and Agencies to Plug In
California’s Chief Information Officer is urging agencies and vendors to integrate with the state’s Digital Identity Gateway as it moves from pilot to shared platform. The Gateway acts as a federated hub connecting residents, agencies, and identity providers, and is already in production for transit discount programs. State officials describe it as the preferred backbone for future identity and eligibility verification, clarifying a single integration path for agencies and vendors alike.
React2Shell RCE Puts Identity Data and Access Platforms on High Alert
A newly disclosed React Server Components vulnerability, CVE-2025-55182, has been added to CISA’s Known Exploited Vulnerabilities catalog after active exploitation was confirmed. The bug allows unauthenticated remote code execution in React 19 Server Component environments, creating serious risk for identity portals, authentication services, and access management consoles. Security teams are being urged to patch immediately, deploy updated WAF rules, and reassess how secrets and identity data are protected in affected stacks.
Ireland Prepares MyGovID Age-Verification Scheme for Social Media
Ireland is preparing a government-run age-verification framework for social media built on its MyGovID digital identity system. The proposal would require platforms to rely on a state-backed wallet to verify under-16 access, triggering strong opposition from privacy and civil liberties groups. Critics warn that linking social media use to a government ID could enable large-scale tracking and concentrate risk in a single identity provider, with implications extending beyond Ireland under EU digital regulation.
DHS/CBP “Mobile Identify” Facial Recognition App Quietly Pulled from Google Play
A facial recognition app developed by U.S. Customs and Border Protection for local law enforcement, known as Mobile Identify, has disappeared from the Google Play Store weeks after its existence became public. The app allowed officers to scan faces and query federal biometric databases tied to ICE operations. Its quiet removal, without public explanation from CBP or Google, has intensified scrutiny of law-enforcement biometric tools, oversight, and the role of app stores as de facto governance chokepoints.
—
By the ID Tech Editorial Team