A mobile driver’s license (mDL) is a digital version of a driving license stored on a smartphone or similar device, issued and cryptographically signed by the licensing authority, and presented to verifiers electronically instead of as a plastic card. In digital identity, the mDL is one of the first government-issued credentials widely deployed in a phone wallet, and it is defined mainly by the international standard ISO/IEC 18013-5.
An mDL is not a photo of a card. Its data is signed by the issuer and checked by a reader, so the verifier can trust it without inspecting physical security features. It also supports selective disclosure, which lets the holder share only the data a situation requires.
How a mobile driver’s license works
The issuing authority first performs identity proofing, then provisions the credential to the holder’s device. The credential contains data elements such as name, date of birth, portrait, license categories and expiry, together with a mobile security object: a list of cryptographic digests of every data element, signed with the issuer’s key.
During in-person presentation, the holder starts device engagement by showing a QR code or tapping the phone on an NFC reader. Data then moves over Bluetooth Low Energy, NFC or Wi-Fi Aware. The reader requests specific elements, the holder approves the request on the phone, and the reader verifies the issuer signature and the digests of the returned elements.
A second check prevents copying. The credential is bound to a device key held in secure hardware, and the phone signs each session with it. A copied credential without that key fails verification, which is a decisive advantage over a screenshot or scan.
| Step | What happens | Purpose |
|---|---|---|
| Device engagement | QR code or NFC tap starts the session | Exchange keys and connection details |
| Request | Reader asks for specific data elements | Data minimization |
| Holder consent | User approves on the phone | Control over disclosure |
| Issuer verification | Reader checks signature and digests | Proves authenticity and integrity |
| Device authentication | Phone proves possession of device key | Prevents cloning and replay |
Standards and trust framework
The mDL ecosystem rests on a small set of standards and a public key trust infrastructure. Verifiers must know which issuer certificates to trust, so issuing authorities publish their root certificates, and in North America these are aggregated in a shared digital trust service run by the motor vehicle administrators’ association.
| Standard or element | Scope | Main content |
|---|---|---|
| ISO/IEC 18013-5 | In-person presentation | Data model, engagement, transport, security |
| ISO/IEC 18013-7 | Online presentation | Remote verification over the internet |
| ISO/IEC 23220 series | Generic mobile identity documents | Building blocks for other mobile credentials |
| Issuer certificate lists | Trust distribution | Which issuing authorities are trusted |
The data format, called mdoc, uses compact binary encoding and is designed to work offline. The verifier does not need to contact the issuer during the check, which protects privacy because the issuer does not learn where the license was shown.
Selective disclosure and privacy
The mDL design directly supports data minimization. Because each element has its own digest, the holder can reveal only some elements while the reader still verifies them. Issuers also provide age attestations, such as over 18 or over 21, as separate yes-or-no elements, so a venue can confirm age without seeing the birth date or address.
| Situation | Data typically requested | Data not needed |
|---|---|---|
| Age check at a store | Portrait and over-21 attestation | Name, address, birth date |
| Traffic stop | Full license data and driving privileges | None withheld by design |
| Airport identity check | Name, portrait, document validity | Address, license categories |
| Car rental | Name, driving privileges, expiry | Address in some cases |
Privacy still depends on implementation. Verifiers could store more data than needed, and readers that log transactions can create tracking records. Good deployments combine the technical design with clear legal limits on retention and use.
mDL compared with related identity credentials
The mDL belongs to a wider family of digital credentials. It shares goals with verifiable credentials and wallets based on decentralized identity, but it comes from a different standards tradition and is optimized for in-person checks by trained verifiers.
| Credential | Issuer | Typical format | Main context |
|---|---|---|---|
| Mobile driver’s license | Licensing authority | ISO mdoc | Driving and in-person identity |
| Physical license card | Licensing authority | Plastic card | Visual and barcode checks |
| Verifiable credential | Any trusted issuer | W3C data model | Online and cross-domain use |
| EUDI Wallet credentials | EU member states and others | mdoc and other formats | Cross-border identity in the EU |
In Europe, the EUDI Wallet framework under eIDAS 2.0 uses the same mdoc format for several credentials, and revised EU rules plan digital driving licenses on mobile devices as a standard option in the coming years.
Adoption, limits and common misconceptions
Adoption grows unevenly. Some regions issue mDLs through their own apps, others through platform wallets on popular phones, and acceptance varies by verifier. Many places still require the physical card to be carried while driving, so the mDL often complements rather than replaces the card.
- A screenshot is not an mDL; without issuer and device signatures, it proves nothing.
- Handing over the phone is unnecessary; data moves wirelessly while the holder keeps the device.
- A dead battery can prevent presentation, so backup arrangements matter.
- Verifier readiness is the main bottleneck, because a credential is useful only where readers exist.
Understanding it simply
A mobile driver’s license is your driving license inside your phone. The authority that issued it signs it, so a reader can confirm it is real. Instead of handing over a card, you tap your phone or show a code.
The best part is choice. When a shop only needs to know that you are old enough, you can share just that fact without revealing your name or address.
Applied in practice
A traveler arrives at an airport security checkpoint that accepts mobile licenses. Instead of handing over a card, she taps her phone on the reader. The phone shows which data the checkpoint requests: name, portrait and document validity. She confirms with her fingerprint.
The reader verifies the issuer signature and the device key in a few seconds and displays her portrait for the officer, who compares it with her face. Her home address and license categories are never transmitted. The check takes about the same time as a card check, and the officer no longer has to judge whether a plastic card might be forged. The outcome is stronger verification with less data shared.