One wallet, 27 systems: can the EU build an untraceable Digital ID?
The EU wants every citizen to have a digital identity wallet by the end of 2026. Digital rights groups warn that the safeguards aren’t ready and that a system designed to protect privacy could instead make Europeans easier to track.
By the end of 2026, every EU country must legally provide citizens with a European Digital Identity Wallet, a smartphone app that stores government IDs, driving licenses, diplomas and other verified documents in one place. However, digital rights groups warn that the technology and safeguards required to protect it are not yet ready, and the wallet could become a surveillance tool it was designed to prevent.
Thomas Lohninger, executive director of Austrian digital rights group epicenter.works, states that only 50-60% of the technical standards needed to build the wallet are in place. Centralizing a person's identity, health data, driving license, and financial credentials on one device increases the impact of a security failure, as a stolen phone or malicious app could expose all their information at once.
The regulation mandates technical defenses such as tamper-resistant cryptographic hardware, credentials bound to specific devices, authentication for organizations requesting data, and notification within 24 hours of a revoked credential. The European Data Protection Supervisor emphasizes the importance of secure hardware elements as a safeguard against theft.
However, losing a phone still poses a risk, requiring users to race to freeze and recover their wallet before a criminal can exploit it. The wallet's core privacy promise is selective disclosure, allowing users to share only necessary information when proving their age. Lohninger warns of "over-identification," where the fast, cheap, and widespread identification enabled by the wallet could lead to the stripping away of anonymity on social networks and email sign-ups.
He also raises the "panopticon" risk, where all areas of life could become linked through one system, creating a surveillance risk. The technology for a secure and private wallet doesn't exist yet, with zero-knowledge proofs being the frontier of cryptographic science. This leaves room for information leakage about a person's behavior if the same identifier or attribute is reused across services.
Due to the reliance on mutual recognition, the wallet's security depends on the robustness of national implementations, which may not be equally strong by the deadline. Lohninger advises caution and an independent investigation before adopting the system widely.
Written by urgent.news from Euronews's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
