Stop Collecting Emirates ID Copies: In-Browser Identity Verification in Dubai (2026)
Chrome 141 and Safari 26 ship the W3C Digital Credentials API — wallet ID checks with no upload. What works for Dubai businesses in 2026, and what does not.
- PUBLISHED
- 05 NOV 2026
- READ TIME
- 12 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
Short answer: a Dubai business can now ask for a government-issued ID straight from a customer’s phone wallet, inside the browser, with no upload, no photo of a document, and no copy left sitting in your storage bucket. The W3C Digital Credentials API shipped enabled-by-default in Chrome 141 on 3 October 2025 and arrived in Safari 26 on iOS 26, iPadOS 26 and macOS 26. The catch in the UAE is rails, not browsers: Emirates ID, your Dubai driving licence and your Mulkiya already live in Apple and Samsung Wallet, but no public path exists yet for requesting them over the web — so the realistic 2026 Dubai build is UAE Pass for residents, the Digital Credentials API for foreign wallet IDs, and a metered vendor check for everyone else.
Dubai is already a wallet-first identity market
The adoption numbers are not speculative. UAE Cabinet figures published in June 2025 put UAE Pass past 11 million users across 322 integrated public and private service providers, with more than 20 million verified digital documents held in its digital ID wallet, over 600 million logins and 2.6 billion digital transactions. Digital Dubai has since cited more than 14 million users in 2026. Identity in this market is already digital, already in a phone, and already something residents expect to tap rather than scan.
The second number is the one that should move your roadmap. IBM’s Cost of a Data Breach 2026 report puts the average breach in the Middle East at USD 8 million — roughly AED 29.4 million, with lost business the single largest component at USD 3.57 million. Financial services and technology both average USD 10.67 million per breach and industrial sits at USD 9.6 million. The study also found 26% of malicious breaches were AI-enabled, with a further 11% of organisations unsure.
The third is the legal one. UAE PDPL — Federal Decree-Law No. 45 of 2021 — states in Article 5(3) that “Personal Data must be sufficient for and limited to the purpose for which the processing is made,” and in Article 5(7) that “Personal Data may not be kept after fulfilling the purpose of Processing thereof.” Read those two clauses against the folder of Emirates ID JPEGs on your server and the problem states itself.
Most Dubai businesses get this exactly backwards. They treat identity verification as the compliance risk. The verification is the cheap part — the risk is the copy you keep afterwards, forever, in a bucket nobody owns.
What the Digital Credentials API actually does
It is a browser API that lets your site request a credential from a digital wallet the user already has, and get back a cryptographically signed response. The user picks the wallet, approves the specific fields, and your server verifies the signature. Nothing is typed, photographed or uploaded.
The spec sits with the W3C Federated Identity Working Group and was still a Working Draft as of 5 November 2026 — shipping in browsers, not yet a finished Recommendation. Two request protocols matter: OpenID4VP and Annex C of ISO 18013-7, the standard that defines mobile driving licence presentation over the internet.
Chrome
Chrome 141 turned the API on by default. On Android the browser shows a native wallet picker; on desktop it presents a QR code so the credential comes from the user’s phone. The requirements are concrete: Android with Google Play services 24.0 or higher, or an iOS device on version 26 or later, plus an installed wallet. Google Wallet is the early adopter, with Samsung Wallet and 1Password flagged as coming. Chrome 143 extends this with an origin trial for credential issuance, not just presentation.
Safari
Safari 26 supports the API with a single protocol, org-iso-mdoc, and two hard conditions: the request must be triggered by a genuine user gesture, and the verifier must register with Apple Business Connect to receive certificates before it can request IDs from Apple Wallet. The first production web verifiers Apple named are Chime, Turo, Uber Eats and U.S. Bank — all US-document flows.
Selective disclosure is the actual win
The API can prove a fact without handing over the document. You can verify that a user is over 18 without receiving their date of birth, and the design is compatible with zero-knowledge proofs — Google’s Longfellow ZK work being the reference implementation. For a Dubai operator that means an age gate, a residency check or a licence check that generates no personal data to lose.
The UAE asymmetry nobody is pricing in
Here is where Dubai diverges from the Silicon Valley demo. Per Gulf News, updated 20 October 2026, Apple Wallet in the UAE already holds your Emirates ID (added through the UAEICP app) and your Dubai driving licence and Mulkiya (through the RTA Dubai app), and Samsung Wallet covers the same set plus digital nol. The credentials exist, in the wallets, on the phones of your customers.
What does not exist is published evidence that any of those UAE-issued documents can be requested by a website as an mdoc or OpenID4VP credential the way a US state mobile driving licence can. Apple’s verifier programme and Google Wallet’s web support have been demonstrated on US documents. Gulf News is also blunt about the offline reality: “digital availability does not automatically mean that a physical card is unnecessary in every situation,” and “acceptance may depend on the authority, service provider or transaction involved.”
So the honest 2026 answer is a split stack. Build the Digital Credentials API path because it is standards-based, free per check, and will light up for UAE documents without a rewrite. Keep UAE Pass as the primary resident rail, because that is where 11–14 million verified identities already are. Keep a vendor check for the rest.
Four routes to verifying a customer in Dubai, costed
| Route | What it proves | 2026 cost | Where it breaks |
|---|---|---|---|
| UAE Pass (OIDC) | Verified UAE resident identity, government-sourced | No per-check fee published — cost is integration effort | Residents and UAE Pass holders only; no use for tourists or overseas buyers |
| Digital Credentials API | Signed wallet credential, or a single attribute such as over-18 | AED 0 per check — it is a browser API | No published UAE-document web issuance yet; needs Play services 24.0+ or iOS 26+; Safari needs Apple Business Connect certificates |
| KYC vendor (document + selfie) | Document authenticity plus liveness, with an audit trail | From AED 4.96 per verification (Sumsub Basic, USD 1.35) on a AED 547/month minimum; AED 6.79 per check on the Compliance tier at AED 1,098/month | You now hold the document images — the PDPL Article 5(7) problem, outsourced but not gone |
| Manual Emirates ID upload | Almost nothing — an unverified image | AED 0 per check, unbounded on breach | Against an average Middle East breach cost of AED 29.4m, this is the expensive option |
Converted at AED 3.6725 to the dollar from Sumsub’s published pricing. The arithmetic that matters: a Dubai platform running 20,000 verifications a month on a mid-tier vendor is spending roughly AED 136,000 a year on checks it could progressively shift to a zero-marginal-cost browser API as wallet coverage lands.
The boundary: when you must still keep the copy
Data minimisation is not absolute. If your business sits in a regulated category — financial services, real estate brokerage, dealers in precious metals and stones, corporate service providers — UAE anti-money-laundering law requires customer due diligence and the retention of those CDD records, identity documents included. That regime was reset by Federal Decree-Law No. 10 of 2025, in force 14 October 2025, which repealed the 2018 law and raised penalties substantially, with reported ceilings up to AED 100 million or the value of the criminal property. Confirm your current retention term with your MLRO before deleting anything.
For everyone else — e-commerce, clinics, gyms, property viewings, delivery platforms, marketplaces, age-gated content — no retention duty is manufacturing those folders. You built the upload form because it was the only pattern available in 2019. It is not any more. Our UAE PDPL compliance checklist for websites and apps covers the retention and consent side, and the goAML and KYC compliance software guide covers the regulated case properly.
How Aquarius builds this
Progressive enhancement, never a single path. Feature-detect the Digital Credentials API, offer the wallet flow where it exists, drop to UAE Pass for residents, drop again to a metered vendor check, and keep an assisted manual route for edge cases — while logging which branch served each user so you can watch coverage improve instead of guessing. The retention clock is built in from day one: verify, store the result and the timestamp, never the image.
Our published pricing starts at AED 2,500 for a Business Site and AED 10,000 for custom app work — AED-first, fixed scope, and you own the code and the accounts at handover. A verification layer on an existing Dubai site is typically a two-to-three week engagement, and the first week is usually spent deleting things.
The risk-reversal is plain arithmetic. Every ID copy you stop storing is a line removed from the breach-exposure sheet that IBM prices at AED 29.4 million on average in this region, and the single largest slice of that figure — about AED 13.1 million — is lost business, not fines or forensics. Deleting data is the cheapest security project you will run this year.
FAQ
Can I verify an Emirates ID through the browser today?
Not as a wallet credential over the web — no published mdoc or OpenID4VP web-verifier path exists for UAE-issued documents as of November 2026, even though Emirates ID can be added to Apple and Samsung Wallet for in-person use. Use UAE Pass for verified resident identity today and build the Digital Credentials API path alongside it.
Which browsers support the Digital Credentials API?
Chrome 141 and later, on by default since 3 October 2025, and Safari 26 on iOS 26, iPadOS 26 and macOS 26. Chrome needs Android with Google Play services 24.0+ or an iOS 26+ device, plus an installed wallet; desktop Chrome routes the request to the phone over a QR code.
Do I need to register with anyone to use it?
For Apple Wallet, yes — verifiers must register with Apple Business Connect to obtain the certificates needed to request IDs. Chrome does not gate presentation requests the same way, but the credential issuer still controls which verifiers it will respond to.
Is this cheaper than a KYC vendor?
Per check, dramatically — AED 0 against AED 4.96 to AED 6.79 plus a monthly minimum of AED 547 to AED 1,098. Coverage is partial in 2026, so the real saving comes from routing the covered share of traffic to the browser and paying per check only for the remainder.
What should I do with the ID copies I already hold?
Classify them first. If an AML or sector-specific retention duty applies, keep them under that duty and document it. If none applies, PDPL Article 5(7) points one way: the purpose is fulfilled, so the data should not be kept — or should be anonymised. Most Dubai businesses find the majority of their stored copies fall in the second bucket.
The move
You do not need to wait for Emirates ID to become a web credential to act. Turn off the uploads you never needed, put UAE Pass in front of resident flows, and wire the Digital Credentials API in behind a feature check so that the day UAE documents land, your site already supports them. Tell us what you currently collect and we will tell you what you can delete this month.
Sources: Chrome for Developers, “The Digital Credentials API has shipped in Chrome” (Chrome 141, enabled by default 3 October 2025; OpenID4VP and ISO 18013-7 Annex C; Play services 24.0+ / iOS 26+; Chrome 143 issuance origin trial); WebKit, “Online identity verification with the Digital Credentials API” (Safari 26, org-iso-mdoc, Apple Business Connect certificates, user-gesture requirement); W3C Digital Credentials, Working Draft 5 November 2026, Federated Identity Working Group; UAE Cabinet and u.ae UAE Pass figures, June 2025 (11m+ users, 322 service providers, 20m+ verified documents); Digital Dubai, 2026 (14m+ users); Gulf News on Emirates ID, driving licence and Mulkiya in Apple and Samsung Wallet, updated 20 October 2026; IBM Cost of a Data Breach Report 2026, Middle East figures (USD 8m average, USD 3.57m lost business, 26% AI-enabled malicious breaches); UAE Federal Decree-Law No. 45 of 2021 (PDPL), Article 5(3) and 5(7), UAE Data Office; UAE Federal Decree-Law No. 10 of 2025 on anti-money laundering, in force 14 October 2025; Sumsub published pricing (USD 1.35 and USD 1.85 per verification; USD 149 and USD 299 monthly minimums), converted at AED 3.6725.