A year ago we published the article “The identity of Colombian Digital ID” together with the research report on the Colombian digital identity application. This work followed a broader investigation on digital identity and human rights, carried out between 2021 and 2023, and an article published in 2024 that analyzed the contractual relationships between IDEMIA, which developed and currently operates the application, and the National Civil Registry (*Registraduría Nacional del Estado Civil*, RNEC). Fundación Karisma’s interest in analyzing digital identity tools from a human rights and social justice perspective is not new and remains current.
One week before the report was published, we sent the RNEC a more complete version of the research, detailing some digital security vulnerabilities we had found. After publication, on November 20, 2025, we met with the RNEC’s chief technology officer, and were able to confirm that:
- the servers that store the Cédula Digital data are located only in one RNEC data center, but are administered by IDEMIA;
- at the time, no online authentication service had been implemented through the Cédula Digital, and the first such service would be the nationality certificates, which has been in the process of being implemented ever since;
- he acknowledged the accessibility and exclusion problems of the Cédula Digital (for people with visual disabilities or using older devices, issues that remain current), but argued that the application “was not meant for everyone”;
- in order to analyze in more detail the privacy and digital security problems mentioned in our report, the RNEC would commission an audit of the application.
After this meeting we received no further information from the RNEC regarding the Cédula Digital, its eventual audit, or the conclusions of our report.
Looking at the Cédula Digital again
Nevertheless, since last year we have continued to follow, from abroad, how the application has evolved. Besides being a fundamental issue for Colombians, it constitutes a local testing ground for global proposals, as the company IDEMIA itself put it: “A promising playground.” This comes at a time when digital wallets are being promoted as the privileged tools for implementing age verification on the internet.
Through this new research, we realized that during the first half of 2026 several changes were made after our initial report was published, following some of our recommendations. Although this does not resolve fundamental concerns, in particular that of digital sovereignty, it shows that this kind of exercise has significant impact.
We have already presented some of these results at the Colombia 5.0 conference in May 2026 (Bogotá), and more recently at the CIVICERT meetings (Berlin) and at the Global Gathering (Estoril). We considered it important to share them here to keep the debate and constructive criticism going.
Who does Cédula Digital communicate with today?
To find out who the Cédula Digital “talked” to, we analyzed the traffic generated by the application after its activation and during normal use of its different features in 2024 and 2025, using the open-source applications PCAPdroid and Pirogue Tool Suite. In other words, we identified who the application sends data to and who it receives data from. This analysis allowed us to build the following map of the web domains with which the application exchanges data, together with the entities that operate them:
We were particularly concerned about the data sent to the domain “localytics.com,” and we wrote the following in our report:
The integration of Localytics, a marketing and data analytics service from Upland Software, poses a significant risk to privacy. This platform not only collects information about the application and the device, but also its content and various identifiers of the user. Moreover, according to its technical documentation, Localytics allows the export of large volumes of data, including personal data, increasing the risk of data leaks or unauthorized use of the information.
Indeed, in the part of the traffic we managed to decrypt using Pirogue Tool Suite, we showed that the Cédula Digital application was sending information that was displayed on the screen, in addition to metadata and trackers. We could not decrypt the application’s traffic during the facial recognition and Cédula Digital display stages, and we feared that this data could be sent to the marketing and data analytics company, causing leaks of sensitive personal data.
When we mapped the traffic generated by the application again in May 2026, we found significant changes:
The most important change is that the connections to the domain “localytics.com” disappeared. Instead, a new domain appears: “analytics.obs.staging.identity-dev.idemia.io.”. Data analytics was “internalized” to a subdomain of the company IDEMIA, whose corresponding server is hosted on Amazon, in the United States.
This means that, most likely, the RNEC or IDEMIA realized that sending data to “localytics.com” was a serious problem that justified removing this service from the application and replacing it with a more controlled one. However, we must stress that, based on our analyses, we do not know exactly which data is sent to this new IDEMIA subdomain, and we continue to believe that the personal data that make up people’s identity are safer the fewer actors they are shared with.
The removal of the Localytics service and of Google/Firebase data analytics is also confirmed by the analysis of trackers with Exodus Privacy:
 |  |
| Trackers detected with Exodus Privacy (November 2024) | Trackers detected with Exodus Privacy (July 2026) |
In addition, the map shows that a CAPTCHA service (“hcapcha.com”) was added to protect against bots.
Digital security: what changed and what is still missing
We were surprised that certain security recommendations had not been addressed, such as the fact that the application was still recording in its logs all the (decrypted) HTTPS traffic to the main domain, or that certain openly accessible URLs contained technical details of the application’s configuration, including the “LOW” security setting of the facial recognition (analysis from May 2026).
On the other hand, we also noticed a change in the services (ports) opened on the Cédula Digital’s main server. In particular, the BGP service, about which we had a serious question and which was active in January 2025. This service corresponds to the use of the “Border Gateway Protocol,” which is used to exchange routing information between large portions of the internet called autonomous systems (AS). Using it in this context was very strange and unusual, and we thought it could be a configuration error that would needlessly open an entry point into the system, or even that this use might be connected to the routing of information toward one of IDEMIA’s autonomous systems, as the company is one of the few entities in the world to have its own. We mentioned it as follows in the report:
Therefore, it is important that the RNEC explain why and how the BGP port/service is used and, in case it is not used, that it close it in order to comply with digital security best practices and reduce the attack surface.
When we mapped the open services on the server again in October 2026, neither BGP nor another protocol called cadlock (a priori linked to the use of a Fortinet firewall) appeared anymore. Only the HTTPS service/port remained active and open. This can be seen in the results of the port scans conducted in January 2025 and October 2026:
Lack of information and fundamental issues remain
Unfortunately, the RNEC did not improve information and transparency regarding the Cédula Digital. There is still no public information about:
- the purposes of the application,
- what is done with the personal data collected,
- the third parties involved and what data is shared with them (Google, Amazon, Intuition Machine, IDEMIA, etc.),
- the central role of the multinational IDEMIA in data processing. We still believe it should be considered a “data processor” (*encargado de tratamiento*) in the sense of Colombian personal data protection law. That is, its role in the application’s intellectual property should be acknowledged.
None of this is found in the application’s privacy policy or terms of use, which have not changed since the app’s launch in 2022 and remain very poor. Nor is it found in the Google and Apple app stores. At least the RNEC was concise in these documents, which are shown here in their complete versions:
 |  |
| Source: downloaded from the app at https://wapp.registraduria.gov.co/identificacion/cedula-digital/files/pdf/terminos-de-uso_10-05-2022.pdf | Source: downloaded from the app at https://wapp.registraduria.gov.co/identificacion/cedula-digital/files/pdf/politicas-de-privacidad_10-05-2022.pdf |
More fundamentally, the debates that would allow us to answer the questions we left at the end of our report have still not taken place, and these questions therefore remain current:
- Who should define, and based on what criteria, the acceptable level of dependence of a public entity (such as the RNEC) on a private company (such as IDEMIA) for the fulfillment of constitutional and legal functions such as official identification?
- When such dependence is considered excessive or unacceptable, how can it be reduced without affecting the continuity of the service or compromising the security and privacy of people’s data?
- What options exist so that the online identification and authentication associated with the Cédula Digital do not rely on biometric data?
- Which of these alternatives could involve lower risks to people’s fundamental rights, especially in terms of privacy, autonomy and non-discrimination?
- How can external, independent and technically robust audits be institutionalized in state projects that have been outsourced or that involve private intellectual property, so as to generate public trust and guarantee people’s rights?
What we still don’t know
While it is good to share what was found in an investigation, it is also very interesting to highlight what could not be investigated or learned. In our case, there is still work to be done and answers to be obtained, in particular:
- finding out which data is sent to external domains (IDEMIA’s and Google’s) after activation through facial recognition; this traffic could not be decrypted so far,
- being able to analyze the online authentication process in the first service that was activated in April 2026 (obtaining nationality certificates),
- analyzing or investigating the “sister” application of the Cédula Digital, which was called “Verificación de identidad” and is now called “Identificación Colombia”, and which had already begun to be used by the police in Valle del Cauca,
- understanding what the planned future uses of these applications in Colombia are, and contrasting them with other digital identity applications being tested around the world.