Utah's landmark Senate Bill 275 creates SEDI, a state-endorsed digital identity system built on a legally binding "Duty of Loyalty." A World Cup hackathon at UVU on June 17–18 invites global teams to help build it
Orem, Utah — June 1, 2026
Utah has passed a digital identity law unlike any other in the country. Using a new legal idea called a Duty of Loyalty, which says that any company or government agency holding a person's identity data cannot use that data against the person's best interest.
The law, Senate Bill 275, creates the State-Endorsed Digital Identity, or SEDI. It passed both chambers of the Utah Legislature unanimously and took effect May 6, 2026.
Christopher Bramwell, Utah's Chief Privacy Officer and Director of the Office of Data Privacy, explained the system in a roundtable discussion at UVU on May 29. He was joined by George McEwan, a Privacy Architect with the state; Justin Jones, Executive Director of UVU's Gary R. Herbert Institute for Public Policy, which hosted the roundtable discussion; George Rudolph, Professor and Chair of Computer Science at Utah Valley University; and Barclay Burns, Chief AI Officer and Assistant Dean of the Smith College of Engineering and Technology.
The conversation comes just ahead of a two-day HITLAB World Cup hackathon and pitch event at UVU on June 17 and 18, where startups, students, and researchers will work on real problems in digital identity, healthcare, and security.
What is SEDI?
SEDI is a digital identity that a person owns and controls. Instead of proving who you are by handing over multiple documents or scanning your face for a private company, you could share only the specific facts a situation requires, and nothing more.
Bramwell said the goal is to fix a problem that is already causing real damage.
"One of the biggest problems I'm trying to solve immediately is the harm caused by all the data that's been breached," Bramwell said. "A lot of people think, what's the point of privacy? My data's already out there, I don't care, people already have it. Well, your data could be used to cause real harm."
That harm takes many forms. Stolen or leaked data can be used to profile people, commit fraud, impersonate them, and extort them. Once personal information is loose, criminals can open loans in someone's name, file fake documents, or pose as a trusted contact. SEDI is built so that having a person's data is not the same as being able to act as that person.
The Harms SEDI Aims to Prevent
Bramwell laid out several of the most serious harms the system is meant to address.
"I want to highlight a couple of those," Bramwell said. "Sextortion, that's one of the fastest growing crimes facing young men in the United States. We've had multiple young men commit suicide in Utah because they engaged with somebody online who was pretending to be a girl of their age, and they sent inappropriate pictures back and forth. Young men, they're still growing, they have strong hormones, so they're going to do things like that. But they don't know how to talk to their family about this. When these individuals turn out not to be a girl of their age, but some grown man in another country, and that person tells them, 'Hey, send me money, or I will send these pictures to everyone you're connected to on social media.' That's a really tough situation for young men to be in, so they're committing suicide. That is an impersonation and fraud issue that we can solve."
A verified digital identity, Bramwell said, would let people prove facts about themselves, like their age, without revealing everything else. That would also give parents a tool they do not have today.
"Right now, parents have no tool to be in control of their children's digital identity to then empower them to manage what they're doing online," he said. "You're currently having to scan your face and they're doing an AI check, or you're loading all your documentation. With this type of digital identity, the parent can be the guardian of their children's identity, and then they can authorize what they can or cannot do online."
He pointed to elder fraud as another target. Bramwell described cases where criminals "file fake property records, pretending to be the person, and transfer property from under them." A verified identity, he said, would let people confirm their identity in person or online, confirming whether someone is who they claim to be.
These problems can be solved, Bramwell said, "in a privacy-preserving way, with no tracking, no surveillance."
The cost of weak identity systems became clear during the pandemic, said George McEwan.
"If you think about it in practical terms, in government, we look back on the COVID era," McEwan said. "The government broke badly when it went online to do these services. It lost $120 billion in unemployment fraud across the United States."
Much of that fraud, McEwan said, came from people making up identities or borrowing real ones.
The Duty of Loyalty
The heart of SB 275 is the Duty of Loyalty. The idea did not start in government.
"The concept of duty of loyalty, this was introduced in 2021 by Neil Richards and Woodrow Hartzog," Bramwell explained. "They created it because they identified there seems to be a big issue in the current privacy approach, which is just notice and consent. What you're currently seeing in both the public and private sectors is you'll get a really long notice statement, some terms, conditions, privacy policy. It could be a couple pages, or it could be hundreds of pages and people will just agree to it. They don't quite understand what they're agreeing to. And because of this, you now have very exploitative practices by entities that get all this data, they aggregate it, they sell it, and now we're seeing the harms that are coming from it."
Utah's law turns that academic idea into a binding rule. Bramwell said the timing is no accident.
"There's some nuance, but the intent is essentially they shouldn't use this data to cause harm to you," Bramwell said. "As we look at state-endorsed digital identity, we realize there's a unique opportunity here over the next few years. We know the private sector and public sector are struggling with fraud, with impersonation, some real issues that AI is going to make more prevalent and much easier to commit like impersonation fraud, or creating synthetic identities. So the market is going to demand verifiable identity."
Once a person uses SEDI, Bramwell stated, the data that flows from it carries the duty along with it.
"That data now is encumbered with this duty of loyalty, and what that means then is you can actually get privacy in the future," he said. "You can get companies that from that point on have to be acting in your best interest, and this means that they shouldn't be doing things that exploit you, that may cause you physical harm or financial harm like using that data and selling it to third parties that would then do these things to you. And if they do those actions, then you can actually bring action and enforcement to protect your interest."
Bramwell compared the new duty to the trust people already place in other professionals.
"Our view is that duty of loyalty, then, is a rebalancing of the market, similar to the relationship you have with your financial institutions, or with your doctors," he said. "Anybody that has this data, great things can be done with it, but they can't use it to do harm to you. We'll have a healthier, free market because of this."
Data Privacy in the Age of AI
The officials said the timing matters because artificial intelligence is making old risks worse. Tools that can copy a voice, a face, or a writing style make it easier than ever to pretend to be someone else.
Bramwell said the technology cuts both ways. AI, he noted, will make impersonation fraud and "synthetic identities" — fake people built from real, scattered data — far easier to create. That, he argued, is exactly why a verified identity that people control is becoming necessary.
SEDI is built to share as little information as possible. A person could prove they are old enough to buy a product without revealing their birth date, name, or address. That design runs against the way many AI systems work, since those systems often improve by collecting and linking as much data about a person as they can.
George Rudolph said the people who build the technology carry a responsibility.
"From a technological standpoint, we know that technology can be used for evil purposes or bad purposes or commercial purposes," Rudolph said, "and we do have a responsibility to make sure that the technology protects and guarantees rights that are ours and that are protected by the Constitution."
A Hackathon to Build It
Policy alone will not build the system. That is part of why UVU is hosting the two-day event on June 17 and 18, 2026.
"On June 17 and 18th, we're having what we're calling a World Cup hackathon and pitch event, so thousands of people are applying to pitch companies that are trying to solve for problems surrounding digital identity, healthcare, security, and finance," said Barclay Burns. "And then hackathons where people are saying, 'Hey, there's a problem here, let's get together for 24 hours and see if we can come up with solutions to this problem.' So the goal is to just create this remarkably rich policy environment, practical environment, technological environment, where Utah ends up inviting the world to come and to learn how to do this."
The event is run through a partnership between UVU's Kahlert Applied AI Institute, UVU's Smith College of Engineering and Technology, the Governor's Office of Economic Development, and HITLAB, a New York City-based digital health research organization. It includes two programs: a university hackathon and the Healthcare Innovation World Cup.
The Healthcare Innovation World Cup features three categories:
Several companies are also offering cash "bounties" for solutions to real technical problems.
For UVU, the payoff is also about students. Justin Jones said the work will shape the next generation of workers.
"I think that ten years from now, we're going to have a group of students leaving UVU and going out into the world and into the workforce that understand how much policy drives and can either work or incentivize the private sector in a positive way," Jones said.
What's Next
SEDI is still being built. The state is targeting small beta releases in early 2027, with a broader rollout expected in late 2027 and 2028. Using a SEDI will be voluntary, and Utahns will not be required to have one.
The law's bigger bet is cultural. Utah is wagering that people can be trusted to manage their own identity, and that companies can still profit while being held to a duty not to cause harm. The first real test comes in 2027, when the system moves from paper to practice.
On June 17-18, 2026, Kahlert Applied AI Institute, HITLAB, Utah Valley University's Scott Smith College of Engineering and Technology, and the Governor's Office of Economic Development will hold the Healthcare Innovation World Cup and Hackathon, a global competition designed to fast-track healthcare breakthroughs from lab to patient care. The initiative targets the widening gap between innovation and implementation, where promising solutions stall before reaching the people who need them most.
Applications for the competitions opened May 12 and will close this week on June 3. Finalists will be announced June 10, and the live final pitch competition and hackathon will take place June 17 and 18 at Utah Valley University.
More information is available at HITLAB World Cup. It will be held in the new Smith Engineering Building (SE) on UVU's campus.
