# Security & Privacy Scorecard

## GOV.UK ID Check

**Version:** 1.25.0  
**Package ID:** uk.gov.documentchecking  
**Scan Date:** 5 March 2026

## What This Means for You

Identity documents are processed using ReadID and iProov for verification, with Google ML Kit handling on-device scanning. Firebase Core is present for app infrastructure. Data sharing with third parties is minimal, focused on the verification process itself rather than advertising or analytics.

## Recommendation: Very Secure

**Best For:** UK residents verifying identity for government services

## Key Findings

**Data Security** - 1 finding (1 medium)

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 1 finding (1 low)

## Privacy Concerns

### What Data is Collected

The app collects identity document information and biometric data (face imagery) during the verification process. Document scanning is performed on-device via Google ML Kit, which means document images are processed locally before any data is sent externally. Firebase Core may collect basic device stability and diagnostic information to support app infrastructure.

### Third-Party Data Sharing

Data sharing is tightly limited to the services required for identity verification. ReadID and iProov receive document and biometric data as part of the government identity-checking process. No advertising networks or behavioral profiling services receive user personal information. Google Play Services handles standard device functions only.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 94/100 |
| Privacy | 98/100 |
| Data Security | 96/100 |
| Network Security | 100/100 |
| Code Safety | 94/100 |
| Data Collection | 99/100 |
| Data Sharing | 100/100 |
| User Control | 99/100 |

## Positive Security Features

- Document scanning is performed on-device using Google ML Kit, keeping identity document images local during initial processing rather than transmitting them to remote servers immediately
- No advertising networks, behavioral analytics platforms, or data brokers appear among the third-party services, meaning user personal data is not used for profiling or targeting
- Network communications achieved a perfect score of 100/100, reflecting strong protection of data while it travels between the app and government verification services
- Data collection is scoped narrowly to what the identity verification process requires, with a Data Collection score of 99/100

## Areas for Improvement

- Some data written to device storage could be accessed under specific conditions by other apps on the same device, a minor concern worth noting on shared or older devices
- Modest hardening improvements to the app's internal code protections could further reduce the risk of the app being interfered with on a compromised device

---

## About This Analysis

This scorecard is based on automated static analysis of the app's code and configuration. It reflects the app's technical implementation of security and privacy practices at the time of scanning and is intended to help everyday users make informed decisions.

### App Details

| Field | Value |
|---|---|
| App Name | GOV.UK ID Check |
| Package ID | uk.gov.documentchecking |
| Version | 1.25.0 |
| Scan Date | 5 March 2026 |
| Platform | Android |