Digital ID reversal exposes a fragmented legal framework