What a digital ID actually is, and why you've probably already got one

I want to start a conversation out here before the end of November, because something is changing then and I haven't seen a word about it at the post office, the saleyards or the newsagent. Not a letter, not a flyer, nothing. I first heard about it from a bloke on YouTube, and I don't like getting my news that way, so I went and read the government's own pages. This is the first of five Monday posts. By the fifth one, a few weeks out from the date, I'll tell you what I'd do about it. Today is just what the thing is.

You've probably already got one. If you've ever logged into myGov from your phone with that little app that asks for a code, or scanned your face to prove it was you, that's it. That app is myID. It used to be called myGovID. The government's own numbers, from December last year: 15 million myIDs, and 80 million times in a year somebody used one to prove who they were to a government service. Forty-two million of those in the last four months alone. Out here that's the Centrelink login, the ATO, the business portal, the NDIS. If you did your tax online, you've got one.

So when people say "digital ID is coming", the honest answer is that for most of us it came a while ago, quietly, one login at a time. What's coming now is the next bit.

What it actually is. A digital ID is a way of proving who you are online without handing over the documents themselves. The government's page says it plainly: "an online method of confirming your ID that does not require physical documents." Instead of photocopying your licence and emailing it to a stranger, you prove once, to one provider, that you are you. Then, when a service needs to know, the provider tells them "yes, that's Brian", and the service doesn't get to keep your licence. That's the idea, and I'll say now that as an idea I don't hate it. Every photocopy of your licence sitting in some business's filing cabinet, or in a scanned folder on a computer in town, is a licence waiting to be stolen. I've written about that before.

The three levels. myID comes in Basic, Standard and Strong, and the level decides what you can get into. Basic is just your details typed in, and it opens very little. Standard needs two of your documents checked in the app (licence, passport, Medicare card, birth certificate and the like), and it opens most government services. Strong needs the documents and a face check as well, so the app knows it is the right person holding the phone. If you set yours up in a hurry at the Centrelink office and it's never worked for something, that's probably why. Mine is Strong. It took ten minutes and a cuppa.

It's voluntary, in writing. The government's page says, in its own words, "The decision to create and use a Digital ID is up to you." You have to be fifteen to make one. Nobody has to use a digital ID to deal with a government service; there has to be another way, even if the other way is a phone queue or a drive to town. I'm going to hold the government to that sentence through this whole series, because the voluntary part is the part worth watching.

So what changes on 30 November? Here's the bit nobody sent us a letter about. The system has been rolling out in four phases. Phase one was myID for government services. Phase two, from December 2024, let the states and territories bring their own ID apps into the system. Phases three and four are the big ones, and the government's own page puts both at "by December 2026": private businesses can apply to use the system to verify their customers, and private companies can apply to become digital ID providers themselves. The Finance Minister's release puts the date at 30 November 2026.

In plain words: today, your digital ID is a thing between you and the government. From the end of November, a bank, a phone company, a real estate agent or a website can apply to plug into the same system, and companies other than the government can apply to be the one that holds your identity. That's not a rumour; it's on the Digital ID System's own website, with the phase numbers.

Whether that turns out good, bad or just different is the question for the next four Mondays. I'll tell you now where I sit: the idea of proving yourself once instead of handing your licence to everyone is sound. The questions are who gets to hold the key, what they're allowed to do with it, and what happens to the person out here with a cracked phone, a flat battery and a Telstra tower that drops out when it rains. The rules say there has to be another way. I want to see what the other way looks like in Tara.

Next Monday: myID and ConnectID. Two very different jobs on the same rails, and why your bank has been quietly building one of them.

What I'd do this week, and why. Not what you should do. What I'd do.

• Open myID on your phone and look at your identity strength (it's under Settings). If it says Basic, that's why things don't work. Decide whether you want Standard or Strong before somebody at a counter decides for you.
• If you don't have myID at all, don't rush. Nothing changes for you on 30 November. Read the next four and then choose.
• Have a look at the government's own page, linked below. Ten minutes. Then you've read the source, not the headline, and that's most of what cyber awareness is.