GOV.UK ID Check Security & Privacy Scorecard

GOV.UK ID Check

Version: 1.25.0
Package ID: uk.gov.documentchecking
Scan Date: 5 March 2026

What This Means for You

Identity documents are processed using ReadID and iProov for verification, with Google ML Kit handling on-device scanning. Firebase Core is present for app infrastructure. Data sharing with third parties is minimal, focused on the verification process itself rather than advertising or analytics.

Recommendation: Very Secure

Best For: UK residents verifying identity for government services

Key Findings

Data Security - 1 finding (1 medium)

Network Security - 0 findings

Code Safety - 0 findings

Privacy - 1 finding (1 low)

Privacy Concerns

What Data is Collected

The app collects identity document information and biometric data (face imagery) during the verification process. Document scanning is performed on-device via Google ML Kit, which means document images are processed locally before any data is sent externally. Firebase Core may collect basic device stability and diagnostic information to support app infrastructure.

Third-Party Data Sharing

Data sharing is tightly limited to the services required for identity verification. ReadID and iProov receive document and biometric data as part of the government identity-checking process. No advertising networks or behavioral profiling services receive user personal information. Google Play Services handles standard device functions only.

Understanding the Scores

Positive Security Features

• Document scanning is performed on-device using Google ML Kit, keeping identity document images local during initial processing rather than transmitting them to remote servers immediately
• No advertising networks, behavioral analytics platforms, or data brokers appear among the third-party services, meaning user personal data is not used for profiling or targeting
• Network communications achieved a perfect score of 100/100, reflecting strong protection of data while it travels between the app and government verification services
• Data collection is scoped narrowly to what the identity verification process requires, with a Data Collection score of 99/100

Areas for Improvement

• Some data written to device storage could be accessed under specific conditions by other apps on the same device, a minor concern worth noting on shared or older devices
• Modest hardening improvements to the app's internal code protections could further reduce the risk of the app being interfered with on a compromised device

About This Analysis

This scorecard is based on automated static analysis of the app's code and configuration. It reflects the app's technical implementation of security and privacy practices at the time of scanning and is intended to help everyday users make informed decisions.

App Details