Keir Starmer’s plan for digital IDs risks creating “an enormous hacking target”, a cybersecurity expert has warned, as technology companies prepared to bid for contracts that could run into billions of pounds.
Amid widespread opposition, the prime minister said the mandatory digital ID – including citizens’ photos, names, dates of birth, nationalities and residency status – would come into use by July 2029.
The government said the ID would sit in a digital wallet on citizens’ smartphones and use state-of-the-art encryption. But Alan Woodward, a professor and cybersecurity expert at the University of Surrey, said that if the data is also held on a vast database to allow for cross-referencing, “it’s painting a huge target on something to say ‘come and hack me’”.
The government has not yet provided detail on how it would make the system work, sparking calls for greater transparency. Woodward’s warning comes amid rising public concern about criminal data breaches, which this week hit a chain of children’s nurseries with photos of infants leaked on to the dark web, and continued to cripple Jaguar Land Rover. Data, including photographs, has previously been criminally exfiltrated from a government ID system in Estonia, according to reports.
Ministers said the new digital ID – which has been dubbed “Britcard” – would tackle small boat crossings by making it tougher to work illegally in the UK. But they also said it could be used for applying for welfare, driving licences, childcare and access to tax records. The plan was criticised by civil liberties campaigners and leaders of the Liberal Democrats, Sinn Féin in Northern Ireland and the SNP in Scotland.
The government said the new digital ID will be held on people’s phones in the gov.uk wallet that is being developed to hold driving licences, “just as millions already use the NHS App or contactless mobile payments”. The scheme would draw inspiration from schemes in Australia, Estonia, India and Denmark, it said.
“Digital ID is an enormous opportunity for the UK,” said Starmer. “It will make it tougher to work illegally in this country, making our borders more secure. And it will also offer ordinary citizens countless benefits, like being able to prove your identity to access key services swiftly – rather than hunting around for an old utility bill.”
Companies including Deloitte, BAE Systems, PA Consulting and Hinduja Global Solutions already have government contracts worth a combined £100m to support the scheme’s IT systems, but industry estimates of the total cost of a national digital ID range from £1.2bn to £2bn.
US tech companies have also been circling the UK government. In February, Starmer was a guest at the headquarters of Palantir, co-founded by the Trump donor Peter Thiel, which already has contracts with the NHS and the Ministry of Defence. OpenAI signed a memorandum of understanding with ministers earlier this year to explore the deployment of advanced AI models in public services. Last week Starmer was the special guest on stage at a corporate event in London for the $4tn chip-maker Nvidia.
Experts in government technology said most of the data needed is already held on government databases including in birth registers, e-visa records for migrants, on passports and driving licences. Data storage companies such as Amazon and Google could provide a vast database for all the data to be gathered, but this would bring a greater security risk, Woodward said.
Starmer’s announcement also sparked concerns that millions of people who lack credentials or suffer from digital poverty could be excluded from public services.
“When things don’t go well it could have serious consequences, especially for those on the margins of society who could be excluded,” said Peter Chamberlin, who developed part of the scheme’s digital architecture and is the senior director of technology at consultancy Public Digital. “In order for this to succeed, transparency is absolutely crucial.”
The campaign group Liberty warned that digital IDs could become “a nightmarish surveillance system”.
“Technological advancements mean that digital ID systems pose an even greater risk to privacy than they did when last proposed in the 2000s,” it said. “A single and unique ‘digital identity’ and centralising databases would remove much of the individual’s agency in managing their data. This information could be used to profile individuals across multiple datasets and would pose particular risks to marginalised communities.”
The Conservative leader, Kemi Badenoch, said her party would oppose any push by the government “to impose mandatory ID cards on law-abiding citizens”. Ed Davey, leader of the Liberal Democrats, called the idea “nonsensical” and said the party will “fight against it tooth and nail”.
John Swinney, the SNP Scottish first minister, said the mandatory ID was an infringement on daily lives and said that by “calling it BritCard, the prime minister seems to be attempting to force every Scot to declare ourselves British”.
In Northern Ireland, both Sinn Féin and the DUP also objected to the proposal, with Sinn Féin first minister Michelle O’Neill calling it an “attack” on the Good Friday agreement.
• This article was amended on 27 September 2025 to correct the spelling of Peter Chamberlin’s surname.
