Correction — October 28, 2026: The earlier article presented compulsory participation, universal biometric storage and transaction tracking as established consequences of the EU framework. Those claims were not supported. We removed two unattributed quotations and unrelated UK and Singapore claims. This replacement distinguishes the legal requirements from implementation questions; the original publication date is preserved.
EU Digital Identity Wallets are intended to let people prove identity or share credentials across borders. The obligation to provide a wallet belongs to Member States. Using one remains a choice for the individual.
That distinction is explicit in Regulation 2024/1183, which amended the eIDAS framework. A government requirement to offer an identification option is not the same as a requirement that everyone enrol.
What is required, and for whom?
The European Commission’s overview says Member States should issue wallets within 24 months of the relevant implementing acts entering into force, with provision expected by the end of 2026. It describes possible uses including qualifications, driving credentials and access to public or private services.
Those are examples of credentials and transactions, not a requirement that every wallet contain a person’s complete medical, financial and biometric history. The framework also supports proving a specific attribute without revealing every other identity detail.
The Commission’s wallet FAQ explains that wallets can be provided directly by a Member State, under its mandate or by an independent provider it recognises. National identities continue to exist. This is not a single replacement identity issued by one EU-wide authority.
Some service providers must accept wallets in defined circumstances. An acceptance obligation on a provider does not turn into a universal usage obligation on its customers.
Voluntary use has a legal safeguard
Article 5a(15) expressly makes wallet use voluntary. It says access to public and private services, the labour market and business activity must not be restricted or disadvantaged because someone does not use a wallet. Other existing identification and authentication methods must remain possible.
Whether people encounter obstacles in practice is a legitimate subject for reporting. It requires evidence about a particular service or implementation. Predicting that everyone will be excluded from society without a wallet misstates what the legal framework requires.
Tracking is restricted, not mandated
Article 5a(14) limits unnecessary collection of wallet-use information and combinations with data from other services, subject to its stated conditions. Paragraph 16 requires a technical framework that restricts tracking, linking or correlation after an attestation is issued unless the user explicitly authorises it.
The Commission’s security and privacy explanation describes selective disclosure and a dashboard showing data-sharing interactions. It also describes ways to request deletion or report concerns. A user-visible activity record should not be confused with permission for the provider to build an unrestricted profile of every transaction.
These are requirements and design descriptions. They do not prove that every implementation will be free from defects, excessive requests or misuse. Equally, the existence of identity infrastructure is not proof that the regulation requires a central surveillance dossier.
Questions to ask when a wallet is offered
Before installing an app, verify its provider through your national authority. Read which credentials are available, what a relying service requests and what the wallet says it will disclose. Ask whether a narrower proof, such as an age attribute, meets the service’s purpose.
Check recovery and revocation instructions before relying on the wallet for important transactions. Keep track of alternative access methods. If a service says the wallet is compulsory, record the exact requirement and ask how it complies with voluntary-use protections rather than assuming the restriction is authorised by EU law.
The useful test is how the actual service handles choice, disclosure and remedies. A framework promising privacy needs evidence of implementation; an allegation of compulsory tracking needs evidence too.