SPID: Italy's Digital Identity System, What It Is and How to Get It

What SPID is and who runs it

According to spid.gov.it, Italy’s Public Digital Identity System is the key to logging into services run by local and national government bodies: one single username-and-password pair, in place of the different credentials every Italian government website used to require separately. SPID also opens the digital public services of other European Union countries, and it works with businesses and merchants that have chosen it as a login method for their own online services — the same underlying idea behind identification on the internet more broadly, where a single set of credentials can open more than one door.

The system is run by AgID, the Agency for Digital Italy, together with the Department for Digital Transformation. The identities themselves, though, are not issued directly by the state: several accredited digital identity providers, called Identity Providers, are accredited by AgID, and a user picks one of them when signing up.

The three security levels

The three SPID levels follow the ISO/IEC 29115 standard, and the level required for a given service is decided by the public or private body offering it, based on the kind of data involved.

What you need to sign up

To activate SPID you need to be 18, hold a valid Italian ID document (identity card, driving licence or passport), a health card — or a tax-code card, or a tax-code certificate — an email address and a mobile phone number.

A practical example: someone logging into Italy’s INPS social-security portal for the first time to check their contribution record needs SPID at least at level 2: they gather their ID document and health card, choose a provider, complete identity verification, and receive a username and password plus the one-time-code mechanism.

How identity verification works

To prove who you are the first time, spid.gov.it lists several routes: in person at a desk run by the chosen provider, by video call with an operator, through an audio-video procedure paired with a bank transfer, or by using an electronic ID card, a national services card, or a digital signature the person already holds. Once active, the same SPID account can also enable digitally signing documents — a separate service, with its own rules.

People who focus on digital rights also look at the flip side of a single identity that gives access to everything: the more central one credential system becomes, the more it matters who handles that data and under what safeguards, a question that comes up in areas like mass surveillance and human rights.

SPID with CIE

One of the identity-verification methods is “SPID with CIE”: a person uses their own electronic ID card to be verified by the chosen provider and receive SPID credentials. This is different from using the CIE directly to log into a service through the “Login with CIE” option: in that case no SPID is being activated at all, it is a separate credential system belonging to the CIE itself (see the comparison between the two further down).

SPID is free

Using SPID to log into Italian government services and private services is free for citizens, according to spid.gov.it. Any cost applies only to the identity-verification procedures needed to sign up, which — depending on the provider chosen — can be free or paid for: it is worth comparing providers’ terms before picking one, rather than assuming a free option does not exist.

Renewing the credentials

SPID credentials expire. An accredited provider such as InfoCert, for example, lists a two-year validity for personal-use credentials, renewable free of charge before expiry, while professional-use accounts last twelve months with no automatic renewal at all. This is the practice of one provider, not a general rule set by AgID: the exact terms of any SPID account should always be checked in the account area of the provider it was activated with.

How it works when logging into a service

Once active, SPID is used by choosing “Login with SPID” on the website or app of the desired service: the user is redirected to their provider’s page, enters their username and password and, if the service requires it, the second or third security factor. SPID’s cross-border recognition is a concrete case of how the European Union works: it lets an Italian citizen use national credentials to reach certain digital services in another member state.

SPID and CIE, two separate systems

SPID and Italy’s electronic ID card are often confused, but they are two different systems. According to the official portal of the Ministry of the Interior, the CIE is “the only physical and digital identity certified by the Italian State”: it gives access to government services through “Login with CIE” and allows electronic document signing, with its own two levels of credentials. SPID, by contrast, is a digital identity issued on request by an accredited private provider, with three security levels. Someone who already holds a CIE can use it either directly to log into services or as a verification method to activate SPID: either way, the two remain separate tools, each with its own rules — one example of how the rules governing access to public services connect with the rights and duties set out in the Italian Constitution.