Australia's digital identity infrastructure just cleared two thresholds at once. The myGov app has surpassed 10 million users, with roughly 6 million of them (about 60%) now authenticating via biometrics rather than passwords. At the same time, the Department of Finance confirmed that the Australian Government Digital ID System (AGDIS) will open to accredited private-sector Digital ID providers from December 1, 2026 — and that businesses relying on the government's own myID credential will begin paying to use it from January 1, 2027 (Digital ID System expansion).
What Actually Changes
Under the Digital ID Act 2024, which commenced November 30, 2024, the system is co-regulated by the Australian Competition and Consumer Commission (ACCC), which accredits providers and approves AGDIS participants, and the Office of the Australian Information Commissioner (OAIC), which polices privacy safeguards layered on top of the Privacy Act 1988 (ACCC Digital ID regulation). The ACCC's own guidance states plainly: "Participation in the AGDIS is being phased. It will open to the private sector from December 2026." From that date, banks, telcos, insurers and other accredited entities can plug into the same government-run identity-verification rails that Services Australia and the ATO already use, rather than each building its own KYC stack from scratch.
The business model shift is just as consequential as the technical one. Individuals will keep creating and using myID for free, and government agencies remain exempt from charges — but businesses that rely on myID to verify a customer will start contributing to its running costs from January 1, 2027, at the latest, likely via a per-transaction fee with invoices issued in arrears. Exact pricing awaits a public consultation the government has flagged for later in 2026.
Why the Timing Matters
The expansion isn't happening in a vacuum. Digital ID usage has scaled fast: system-wide, Australians completed more than 113 million authenticated transactions between May 2025 and April 2026, up sharply from 36.5 million the year before, across 264 government services. The Australian Banking Association has been pushing for federal Digital ID integration into know-your-customer and income-verification workflows for years, arguing it beats every bank running redundant, costly identity checks in parallel.
The Case for Caution — Steelmanned
Critics have a legitimate starting point. The Digital ID system has already cost over AU$1 billion to build across more than a decade, and the Australian National Audit Office opened a review in mid-2026 into whether the Department of Finance's oversight — governance, risk management, evaluation — has kept pace with the program's rapid growth, with findings due by December 2026, the same month private accreditation begins. Civil liberties groups, including the NSW Council for Civil Liberties and Digital Rights Watch, have separately warned about "function creep": a nominally voluntary credential that becomes a de facto requirement once enough banks and businesses build workflows around it, and a biometric honeypot that concentrates verification data in ways a breach would make far more damaging than today's scattered password logins. Those are not paranoid objections — a single, high-assurance identity layer is exactly the kind of infrastructure where a design flaw or a lax accredited provider does outsized damage, and an audit landing the same month private accreditation opens is a legitimate signal to watch, not dismiss.
Why the Expansion Is Still the Right Call
That said, the legislative architecture chosen here is closer to the proportionate end of the spectrum than the alarmist framing suggests. The Digital ID Act's privacy safeguards go beyond the Privacy Act baseline — banning single persistent identifiers across services, prohibiting disclosure of Digital ID data for marketing, and restricting biometric collection and use — and the OAIC has independent enforcement power over accredited providers, not just an advisory role. Crucially, the government is not mandating the credential: physical documents and existing verification channels remain available, and businesses, not individuals, bear the new fees. That funding structure is itself a sound incentive design — it makes commercial relying parties internalize the cost of a shared verification utility instead of taxpayers subsidizing bank and telco compliance overhead indefinitely.
For the open-internet, pro-innovation case, federated digital ID solves a real and expensive problem: identity verification currently exists as dozens of siloed, incompatible systems across banks, telcos and government portals, each an independent attack surface and an independent cost center. A single accredited, audited rail with statutory privacy floors — overseen by two separate regulators with actual enforcement teeth — is a more defensible design than the status quo of ad hoc KYC vendors with no equivalent statutory privacy regime at all. The ANAO audit due in December 2026 is the right pressure valve: if it finds oversight has genuinely lagged growth, that's grounds to slow the private-sector rollout, not abandon it. Regulators built the accountability mechanism into the calendar; the sensible response is to let it run and act on what it finds, not to treat the private-sector opening itself as the failure mode.