As online privacy and safety threats continue to grow, so do the measures to safeguard online users. AAMVA is committed to ensuring the safety and security of mobile driver’s license (mDL) holders by continuously refining guidelines that enhance digital identity protection.

In May of 2025, AAMVA released version 1.5 of the mDL Implementation Guidelines, further refining guidance for online identity verification. Previously, the guidelines only referenced the international standard of ISO/IEC 18013-5, which outlined how mDLs could be validated in person, such as at a counter or kiosk. The latest update introduces ISO/IEC 18013-7, which extends mDL verification to internet-based transactions.

“Rather than a full standard, 18013-7 is a technical specification that allows for more rapid evolution than a standard would, and it provides the framework for interoperability when verifying ISO/IEC 18013-compliant digital credentials over the internet,” says Tim Roufa, manager of Identity Management for AAMVA. This update is particularly relevant for industries including online banking, e-commerce, car rentals and ride-sharing services, where secure identity verification is critical. Major online retailers, for example, are exploring mDL integration for account recovery, providing a more secure alternative to traditional identity verification methods.

“This standard was built to ensure privacy and security while ensuring interoperability across state and international borders.”

Michael McCaskill, AAMVA Vice President of Identity Management

The implementation guidelines included two major updates:

• The over-the-internet appendix was revised to align with the published ISO 18013-7 specification, ensuring consistency with the latest technical developments.
• A new section describes an application programming interface (API) currently being tested by the Worldwide Web Consortium (W3C). The W3C Digital Credential (DC) API is a proposed method for online mDL authentication. While the W3C DC API is not yet included in ISO standards, it is currently under consideration.

Historically, online identity verification has relied on users uploading images of their physical IDs—an approach that poses security and privacy concerns. The 18013-7 update allows for a more secure and privacy- respecting method, reducing identity fraud risks and enhancing the security within the mDL ecosystem.

“This standard was built to ensure privacy and security while ensuring interoperability across state and international borders,” says Michael McCaskill, AAMVA vice president of Identity Management. “These are crucial components for ensuring trust not only among mDL holders but also the relying parties.”

The mDL rollout is being handled on a jurisdiction-by-jurisdiction basis, with each one determining its own approach. Jurisdictions collaborate with vendors to develop and deploy mDL solutions for residents.

While mDLs are still relatively new, their implementation is evolving alongside technology and security requirements. The complexity of ensuring privacy, data security and interoperability over the internet necessitates periodic updates to the specifications to ensure they incorporate the evolving technology in this space. The potential of the W3C DC API represents a forward-looking approach to address some of the limitations of the current protocols.

By incorporating the credential API into the updated implementation guidelines, jurisdictions are able to explore this emerging technology with guidance for ensuring compatibility with the published specification.

“We built the standards and technical specifications from the ground up to respect privacy, secure user data and ensure interoperability between jurisdictions,” says McCaskill. “We’ll continue to update specifications as safer options become available. I like to say that we built it this way to protect my mother and my grandchildren—protecting their identities to make their lives safer.”