Mobile driver's license (mDL) verification: a business guide
What a mobile driver's license is, the 22 states and territories TSA accepts, ISO/IEC 18013-5 and 18013-7, what a verifier receives, NIST SP 800-63-4, and how a US business accepts mDLs today.
In short
A mobile driver's license (mDL) is, as the American Association of Motor Vehicle Administrators (AAMVA) defines it, a driver's license provisioned to a mobile device.[6] Mobile driver's license verification, or mDL verification, means a reader or a website authenticates that data instead of looking at plastic.[6] As of 5 October 2026, the Transportation Security Administration (TSA) accepts digital IDs from 22 US states and territories.[1]
- ISO/IEC 18013-5 covers in-person checks and ISO/IEC 18013-7 covers online ones.[7][12]
- A business receives signed data, and only the fields it asked for.[5][6]
- Coverage is partial, so keep a document route next to it.
Digital identity in the United States is a patchwork. States issue their own mobile driver's licenses, to a state app or to a phone wallet, and the standards for checking one online are still settling.
This guide covers where an mDL works, what data arrives, and how to accept one as an electronic ID (eID) without turning away customers who lack one.
What a mobile driver's license is
AAMVA's definition adds that the license on the device can be updated in real time. It carries the same data elements as the physical card, but the data is transmitted electronically to the relying party's reader and authenticated there.[6]
The relying party is the business that asks for the ID. The international standard, ISO/IEC 18013-5, uses the British spelling: mobile driving licence.[7]
Mobile driving licence (mDL)
A state-issued driver's license held in a phone wallet or a state app
Where mobile driver's licenses work in 2026
The best public map of US coverage is the TSA list, because TSA says it only accepts an mDL from a state approved for federal use.[3] On 5 October 2026 it names 22 states and territories, and TSA says digital IDs work at more than 250 airports.[1][2]
| Where the license is held | Count | Jurisdictions on the TSA list |
|---|---|---|
| Apple Wallet[4] | 17 | Arizona, Arkansas, California, Colorado, Georgia, Hawaii, Illinois, Iowa, Maryland, Montana, New Mexico, North Dakota, Ohio, Oklahoma, Puerto Rico, Virginia, West Virginia |
| Google Wallet | 12 | Arizona, Arkansas, California, Colorado, Georgia, Iowa, Maryland, Montana, New Mexico, North Dakota, Ohio, Puerto Rico |
| Samsung Wallet | 8 | Arizona, Arkansas, Colorado, Georgia, Iowa, Maryland, North Dakota, West Virginia |
| State app only | 5 | Alaska, Kentucky, Louisiana, New York, Utah |
Eligible digital IDs by issuing authority, read on 5 October 2026. Rows overlap: every Google and Samsung Wallet jurisdiction is also in the Apple Wallet row; Apple Wallet's 17 plus the 5 with a state app only make TSA's 22.[1]
TSA also accepts four digital IDs derived from a US passport, not from a driver's license.[1]
Watch out
An mDL does not replace the card yet. TSA tells travelers to keep carrying an acceptable physical ID, and since 7 May 2025 it no longer accepts state licenses that are not REAL ID compliant.[2][3]
Outside airports, Apple says an ID in Wallet can prove age or identity at select businesses and venues, online and in apps.[4] For other states, AAMVA keeps a map of every US and Canadian jurisdiction's stage of implementation.[6]
The standards behind an mDL: ISO/IEC 18013-5 and 18013-7
Two parts of one ISO standard do most of the work. AAMVA publishes its own mDL Implementation Guidelines, version 1.6 of July 2026.[6]
| Standard | What it covers | Status in October 2026 |
|---|---|---|
| ISO/IEC 18013-5:2021 | The mDL and its interface with a reader, in person | Published September 2021; a revision is at draft stage[7] |
| ISO/IEC TS 18013-7 | Presenting an mDL to a reader over the internet | The 2024 first edition is withdrawn, replaced by a later edition; a third edition is under development[8][9] |
| OpenID for Verifiable Presentations (OpenID4VP) 1.0 | A protocol to request and present credentials online | Final Specification, July 2025[15] |
| W3C Digital Credentials API | The browser interface that passes a request to the user's wallet | Working Draft of 4 September 2026; on by default from Chrome 141 (3 October 2025)[13][14] |
Part 5 lets a verifier, including one in another country, obtain the mDL data by machine, tie the mDL to its holder, authenticate the origin of the data, and verify its integrity.[7]
In person, the phone and the reader connect through near-field communication (NFC) or a QR code, and the data travels over Bluetooth Low Energy, NFC or Wi-Fi Aware.[12]
Online is less settled. The US National Institute of Standards and Technology (NIST) describes two protocol families inside ISO/IEC 18013-7. One uses OpenID4VP. The other, Annex C, builds on the Part 5 exchange. According to NIST, having two presentation protocols has created complexity and cost, and an OpenID Foundation working group is being chartered to harmonise them.[12]
Note
Older guides also cite ISO/IEC 23220. The EU's Architecture and Reference Framework names ISO/IEC 23220-2 next to 18013-5 for the same credential format.[17] We did not verify the status of each part of that series.
What the user sees
In Apple Wallet the user selects the state, scans both sides of the card, confirms it is them, and the request goes to the state for approval.[4] Online, the wallet shows what is requested, and nothing is shared until the user authorises it with Face ID or Touch ID.[4][5]
Choose how to verify
Mobile driver's license
Scan an ID document instead
1Illustration: a website offers the mDL next to a document check.
Scan to continue
2On a desktop, a QR code links the browser to the phone.[13]
Review the request
- Over 21Shared
- Full nameNot shared
- AddressNot shared
3The wallet lists what the business asked for; these fields are an example.[5]
Confirm it is you
Authorise
4The user approves with the phone's biometrics.[4]
Age confirmed
5The site receives a signed answer, not a photo of the card.
According to Google's Chrome for Developers blog, scanning the QR code sets up an end-to-end encrypted, phishing-resistant connection between desktop and phone, and proximity is verified over Bluetooth Low Energy.[13]
The user reviews and approves
Decrypt, check signature and validity
A simplified online presentation through the Digital Credentials API.[13]
What a verifier receives, and what it must check
An mDL response is data, not an image: the requested fields, covered by the issuing state's signature.
| What arrives | What it means for you |
|---|---|
| Requested data elements | The same elements as the physical license, but only the ones you asked for and the user approved[5][6] |
| An age answer | A reader or a website can ask an over-21 question and receive only yes or no[12] |
| The issuer's signature | You authenticate the origin of the data and verify that it was not altered[7] |
| A link to the holder | The standard lets you tie the mDL to its holder; Apple Wallet shares data only after Face ID or Touch ID[4][7] |
NIST puts the risk on verifiers: they are responsible for making sure a presented mDL is valid at the time of presentation.[12]
- Keep an up-to-date set of trusted issuer public keys. AAMVA's Digital Trust Service gives relying parties one place to obtain them.[6][12]
- Reject a credential that is expired or whose signature does not verify.[12]
- Decide when you need extra status information: a revoked credential can stay active for a short period.[12]
- Plan for wallets that cannot answer: not all mDLs issued today sit in wallets that handle both in-person and online presentation.[12]
Apple states that neither Apple nor the issuing state can see when or where a user shares an ID from Wallet.[4]
NIST SP 800-63-4, age checks and KYC
NIST Special Publication 800-63-4 is the US government's digital identity guideline; it superseded NIST SP 800-63-3 on 1 August 2025. It is written for government information systems, so for a private business it is a reference point, not a rule. SP 800-63-4 adds a model in which the user's own wallet presents signed attributes.[10]
- Identity assurance level 2 (IAL2) has a Digital Evidence Pathway: the applicant proves possession with a local activation factor and presents a cryptographically verifiable attribute bundle, a method NIST ties to subscriber-controlled wallets.[11]
- At IAL3, one listed method names the mobile driver's license: the applicant authenticates to it, and a digitally protected facial portrait is compared to the applicant.[11]
Age checks. NIST lists age verification for digital services as an online mDL use case.[12] In Louisiana's LA Wallet, the user types a code shown by the website, reviews the business and the reason, and approves or denies.[16] According to the Free Speech Coalition's tracker of state bills, a secondary source, 25 US states require age verification for sites with material harmful to minors.[23]
Know Your Customer (KYC). NIST lists online financial account creation as a use case, and its National Cybersecurity Center of Excellence has demonstrated an mDL presented during account opening.[12] That is a reference build, not a regulatory approval.
Not yet known
Whether an mDL counts as a documentary method under the US bank Customer Identification Program rule is not settled in the sources we reviewed (5 October 2026). Treat mDL acceptance for anti-money-laundering (AML) onboarding as a decision for your own risk assessment and counsel.
Outside the US: driving licences in European wallets
The same ISO format travels. Version 3.0.0 of the Architecture and Reference Framework, the technical blueprint of the EU Digital Identity (EUDI) Wallet, makes the ISO/IEC 18013-5 format mandatory for wallets, with the mDL as its example for in-person use.[17]
| Country | App | Digital driving licence, as published |
|---|---|---|
| Italy | IT-Wallet in the IO app | 8.5 million driving licence activations, out of 10.1 million IT-Wallet activations, by 17 February 2026[18] |
| Poland | mObywatel | Mobile driving licence used by 6.2 million people (2025 figures)[20] |
| France | France Identité | More than 1.7 million (1 October 2026)[19] |
| United Kingdom | GOV.UK Wallet | Private trial since December 2025; not downloadable yet (5 October 2026)[21][22] |
These sources give counts, not protocols; see eID schemes by country for each scheme. Elsewhere the model differs: Singpass and UAE PASS are account-based national sign-in services, as what is eID verification explains.
How a US business accepts mDLs today
In person
mDL reader
- The user taps the phone or shows a QR code
- Fits a counter, a gate or a point of sale
ISO/IEC 18013-5
Online
mDL in the browser
- Signed fields come back, with no image upload
- Only for states and wallets you can verify
ISO/IEC 18013-7, OpenID4VP
Everyone else
Document and selfie
- A photo of the license or passport, liveness and a face match
- Works in every state, with or without an mDL
Document route
1Decide what you need
An age answer or a full identity check.
2Choose the states and wallets you trust
Start from the TSA list and load each issuer's public keys.
Does the user hold an mDL your verifier can check
Request the mDL
Verify the signature, validity and fields.
Use the document route
Document capture, liveness and face match.
3Screen and decide
The onboarding decision stays with you.
NIST says wallets and verifiers may support overlapping but not identical capabilities, so test each wallet you plan to accept. The Digital Credentials API is still a draft: NIST reports it in Chrome and Safari, with Firefox planned.[12][14]
How Didit helps with mobile driver's license verification
Didit adds mobile driving licence acceptance on request.
What works in the United States today is the document route: ID verification of a driver's license, state ID or passport, with NFC chip reading where the document has a chip, passive liveness and a face match. A full KYC check costs $0.33, AML screening $0.20 and age estimation $0.10 for age verification. National eIDs run in the same workflow: see digital ID wallets.[24]
Didit provides
- The document route for US licenses, state IDs and passports
- Liveness, face match and AML screening in one workflow
- The evidence of every check, by webhook or API
Stays with you
- The risk assessment and the policies
- Which states, wallets and documents you accept
- The onboarding decision
Ask for mDL acceptance
Didit adds it on request. Tell us which states matter to you, and start with the document route today.
Talk to us about mobile driving licenceStart freeRead the docs
Key takeaways
- TSA accepts digital IDs from 22 states and territories; 17 are in Apple Wallet.
- ISO/IEC 18013-5 is the in-person standard. Online, the 2024 first edition of ISO/IEC TS 18013-7 is withdrawn and a later edition replaced it.
- Every mDL flow needs a document route for the users and states it does not cover.
Frequently asked questions
Which states have a mobile driver's license in 2026?
On 5 October 2026, TSA accepts digital IDs from 22 states and territories; 17 of them are in Apple Wallet.[1][4] AAMVA's map shows which of six implementation stages each US and Canadian jurisdiction has reached.[6]
Is a mobile driver's license a valid ID at the airport?
Yes, at more than 250 airports, if the state is on the TSA list. According to TSA, the mDL must be based on a REAL ID, an Enhanced Driver's License or an Enhanced ID.[2][3] TSA still tells every traveler to carry an acceptable physical ID.[2]
Can a website verify an mDL online?
Yes, where the user's wallet and browser allow it. ISO/IEC 18013-7 adds presentation over the internet, and the W3C Digital Credentials API carries the request from the website to the wallet.[8][13] Not every mDL issued today sits in a wallet that can present online, so keep a second route.[12]
What data does a business get from an mDL?
The fields it asked for and the user approved, signed by the issuing state. AAMVA says an mDL has the same data elements as the physical license and lists selective information release among its features.[6] A site that only needs age can receive a yes or no.[12]
Is an Apple Wallet ID accepted for KYC?
That is not settled in the sources we reviewed (5 October 2026): none says whether an mDL counts as a documentary method under the US bank Customer Identification Program rule. NIST lists financial onboarding as an mDL use case.[12] The decision belongs to your risk assessment and your counsel.
Can an mDL prove age without showing a date of birth?
Yes. NIST describes a reader or a website asking an over-21 question and the wallet answering with only yes or no.[12] Louisiana's LA Wallet has a Remote Verify feature for websites, and it needs a Louisiana license or state ID.[16]
What changed in NIST SP 800-63-4 for mobile driver's licenses?
NIST SP 800-63-4 superseded NIST SP 800-63-3 on 1 August 2025.[10] It adds a wallet model and a Digital Evidence Pathway at IAL2, and at IAL3 it names the mobile driver's license as an example of what the applicant authenticates to.[10][11]
Does Didit verify mobile driver's licenses?
Didit adds mobile driving licence acceptance on request. Today, US customers are verified through the document route: a driver's license, state ID or passport, with liveness and a face match. If you need mDLs, talk to us about mobile driving licence.
Sources
- Participating States and Eligible Digital IDs, Transportation Security Administration, read 5 October 2026.
- Digital Identity and Facial Comparison Technology, Transportation Security Administration.
- Acceptable Identification at the TSA Checkpoint, Transportation Security Administration.
- ID in Wallet, Apple, states list read 5 October 2026.
- Apple introduces Digital ID, Apple Newsroom, 12 November 2025.
- Mobile Driver License, American Association of Motor Vehicle Administrators, with the mDL Implementation Guidelines 1.6 (July 2026).
- ISO/IEC 18013-5:2021, Mobile driving licence (mDL) application, ISO catalogue.
- ISO/IEC TS 18013-7:2024, Mobile driving licence (mDL) add-on functions, ISO catalogue, status withdrawn.
- ISO/IEC CD TS 18013-7, third edition, ISO catalogue, under development.
- NIST SP 800-63-4, Digital Identity Guidelines, National Institute of Standards and Technology.
- NIST SP 800-63A-4, Identity Assurance Level Requirements, National Institute of Standards and Technology.
- Verifiable digital credential presentment, NIST Cybersecurity Insights blog, 30 June 2026.
- Digital Credentials API shipped, Chrome for Developers, 3 October 2025.
- Digital Credentials, W3C Working Draft, 4 September 2026.
- OpenID for Verifiable Presentations 1.0 Final Specification Approved, OpenID Foundation, 10 July 2025.
- Using Remote Verify You / Verification, LA Wallet Help Center.
- Architecture and Reference Framework v3.0.0, European Commission, 23 July 2026.
- IT-Wallet passes 10 million activations in the IO app, Italian Department for Digital Transformation, 17 February 2026.
- France Identité passes 5 million users, French Ministry of the Interior, figures at 1 October 2026.
- 11 million mObywatel users and a record year, Polish Ministry of Digital Affairs, 28 January 2026.
- Making the government's first digital wallet a reality, Government Digital Service, 21 January 2026.
- GOV.UK Wallet, GOV.UK, read 5 October 2026.
- Age verification bills tracker, Free Speech Coalition (secondary source).
- Digital ID wallets, Didit documentation.
Compare national eIDs, wallet credentials and the document route on the eID verification page, and read about European wallets on the EUDI Wallet page.
Verify US customers today
Start with documents, liveness and face match, and ask us about mDLs.
Related articles
- PhilSys verification: how businesses check the National ID
- OpenID4VP verifier guide: accepting the EUDI Wallet
- eIDAS regulation explained: what eIDAS 2 (2024/1183) changes
- Smart-ID API: a developer's guide to RP API v3
- National digital identity worldwide: models, leaders, standards
- National eID schemes by country: the 2026 reference list