GOV.UK One Login Security & Privacy Scorecard

GOV.UK One Login

GOV.UK One Login is the UK government's official identity and authentication app, letting users access government services with a single verified account.

What This Means for You

Identity verification uses biometric checks via iProov and document scanning via ReadID, both purpose-built for secure government ID workflows. Firebase App Check and Google Play Integrity verify the device before granting access to the account. No advertising or marketing services receive user data.

Recommendation: Very Secure

Best For: UK residents managing government identity online

Key Findings

Data Security - 3 findings (3 low)

Network Security - 0 findings

Code Safety - 0 findings

Privacy - 2 findings (2 low)

Privacy Concerns

What Data is Collected

To verify identity, the app processes the user's name, date of birth, and details from identity documents such as a passport or driving licence. Facial biometric data is captured and matched by iProov's regulated service. Device identifiers are assessed by Google to confirm the app is running on a genuine device. No data is collected for advertising, behavioral profiling, or marketing purposes.

Third-Party Data Sharing

User data is shared only with services directly required to verify identity and protect the account:

• iProov - receives facial biometric data to perform identity matching on behalf of the UK government
• ReadID - reads and processes identity document details securely
• Firebase App Check and Google Play Integrity - receive device signals to confirm the device is genuine before granting access to the account
• Google ML Kit - processes document images locally on the device
• AppAuth - handles secure authentication exchanges with government services

No data is shared with advertising networks, data brokers, or marketing platforms.

Understanding the Scores

Positive Security Features

• Data stored on the device is protected with strong encryption via SQLCipher, keeping it inaccessible if the phone is lost or stolen
• Google Crypto Tink provides robust, standards-based cryptographic protections throughout the app
• Firebase App Check and Google Play Integrity block access from modified or untrustworthy devices
• AppAuth implements a secure, standards-compliant authentication flow for connecting with government services
• iProov and ReadID are purpose-built, regulated services designed specifically for government-grade identity verification

Areas for Improvement

• Some local data handling configurations could be made more conservative to further reduce any residual risk of data being read outside its intended context
• A small number of privacy-related settings could be tightened to match the most stringent standards expected of government identity applications
• Controls giving users direct visibility and management over data retained on the device could be made more accessible within the app

About This Analysis

This scorecard reflects the security and privacy posture of GOV.UK One Login based on static analysis of the Android app package. Analysis does not involve live testing of UK government backend systems.

App Details