CITT

    Scan results

    GOV.UK ID Check

    Android

    GOV.UK ID Check is a government identity verification app that proves your identity for HMRC services and GOV.UK One Login by matching your face to photo ID. Requires Android 10+.

    CITT SCORE
    96
    out of 100
    TRUSTED

    Quick Verdict

    Best for: UK residents verifying identity for government services

    What It Means For You

    Identity documents are processed using ReadID and iProov for verification, with Google ML Kit handling on-device scanning. Firebase Core is present for app infrastructure. Data sharing with third parties is minimal, focused on the verification process itself rather than advertising or analytics.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (4)

    Data Security

    1 total
    1 Medium

    Code Security

    2 total
    1 Medium
    1 Low

    Privacy

    1 total
    1 Low

    Third-Party Services

    ReadID, iProov, BouncyCastle, Firebase Core, Google ML Kit, Ktor Client, Google Play Services, Tinder Scarlet, Budiyev QR Code

    Security Strengths

    • ✓Certificate pinning implemented for backend API with 5 backup pins
    • ✓Cleartext traffic globally disabled
    • ✓BiometricToken stored in memory only (not persisted)
    • ✓Firebase Analytics/Crashlytics disabled by default
    • ✓Consent-first analytics architecture (no pre-consent tracking)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    government
    identity verification
    biometric
    sensitive data
    nfc
    camera
    privacy focused

    Package

    uk.gov.documentchecking

    Version

    1.25.0

    Analysis Date

    Mar 4, 2026

    Classes Analyzed

    16,948

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Key Findings

    Data Security - 1 finding (1 medium)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 1 finding (1 low)

    Privacy Concerns

    What Data is Collected

    The app collects identity document information and biometric data (face imagery) during the verification process. Document scanning is performed on-device via Google ML Kit, which means document images are processed locally before any data is sent externally. Firebase Core may collect basic device stability and diagnostic information to support app infrastructure.

    Third-Party Data Sharing

    Data sharing is tightly limited to the services required for identity verification. ReadID and iProov receive document and biometric data as part of the government identity-checking process. No advertising networks or behavioral profiling services receive user personal information. Google Play Services handles standard device functions only.

    Understanding the Scores

    CategoryScore
    Security94/100
    Privacy98/100
    Data Security96/100
    Network Security100/100
    Code Safety94/100
    Data Collection99/100
    Data Sharing100/100
    User Control99/100

    Positive Security Features

    • Document scanning is performed on-device using Google ML Kit, keeping identity document images local during initial processing rather than transmitting them to remote servers immediately
    • No advertising networks, behavioral analytics platforms, or data brokers appear among the third-party services, meaning user personal data is not used for profiling or targeting
    • Network communications achieved a perfect score of 100/100, reflecting strong protection of data while it travels between the app and government verification services
    • Data collection is scoped narrowly to what the identity verification process requires, with a Data Collection score of 99/100

    Areas for Improvement

    • Some data written to device storage could be accessed under specific conditions by other apps on the same device, a minor concern worth noting on shared or older devices
    • Modest hardening improvements to the app's internal code protections could further reduce the risk of the app being interfered with on a compromised device

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. It reflects the app's technical implementation of security and privacy practices at the time of scanning and is intended to help everyday users make informed decisions.

    App Details

    FieldValue
    App NameGOV.UK ID Check
    Package IDuk.gov.documentchecking
    Version1.25.0
    Scan Date5 March 2026
    PlatformAndroid

    Right of Reply

    Developer not yet contacted