I agree it needs to be well defined. But there are government and private services that require identification and uploading selfies and passport pictures onto random websites is worse than a regulated ID service that can provide a trusted API.

There are tons of risks though: data gathering, privacy invasion, censorship, disproportionality…

That’s why I prefer good regulation. One that also defines when it’s “necessary” and when it’s inappropriate to the point of illegal.

Let’s add more conditions: privately owned or managed brings the risk to open up the “service” to more and more websites that don’t need or shouldn’t require your identity. If it has no monetary interests that risk is reduced. Not when you live in an oligarchy though…