The European Union has committed every one of its 27 member states to issuing citizens a digital identity wallet by the end of 2026. The wallet is meant to hold driving licences, health records, banking credentials, tax documents and social media logins in a single app that can be used across borders. An investigation by Euronews, published on 17 September 2026, found that the technical safeguards the underlying regulation promised are not in place with the deadline months away.
The European Digital Identity Regulation, adopted in 2024, includes a legal requirement for what the text calls unobservability: the ability to present a credential to a service provider without that provider, or any central authority, being able to log or link the transaction to a person’s broader activity. According to the Euronews report, the implementing rules that member states are actually building to fall short of that standard, because the technical specifications published so far allow more linkage between transactions than the regulation’s own wording suggests should be possible.
Twenty-seven systems built on one shared standard
Each member state is responsible for building and operating its own wallet infrastructure, then connecting it to a shared EU interoperability framework so that a credential issued in one country can be verified in another. Euronews reported that this mutual-recognition system is the piece officials themselves describe as unfinished, since national wallets are being built on different timelines and with different technical choices before the common rules have been finalised.
Thomas Lohninger of the digital rights group EDRi told Euronews that the current draft rules on selective disclosure and unlinkability, if not tightened, create conditions closer to what he called a panopticon than to the privacy pledge in the regulation’s text. Lohninger’s warning is Euronews’s characterisation of EDRi’s position, attributed to him directly rather than presented as established fact.
Convenience framing versus the readiness gap
EU institutional communications quoted within the same Euronews piece describe the wallet chiefly as a convenience measure, allowing a citizen to prove a single fact, such as being over eighteen, without handing over an entire identity document. That framing rests on a feature called selective disclosure, which lets a user present a minimal credential rather than a full record. The gap Euronews identifies is between that pledge, on the books since 2024, and the draft implementing rules EDRi says have not yet built the cryptographic protections needed to make selective disclosure genuinely unlinkable at scale.
The stakes extend past convenience. A wallet built to carry banking access, tax filings, health data and government-issued identity in one place concentrates verification power that is currently split across separate national agencies and private providers. If the interoperability layer logs metadata about when and where a credential is checked, a wallet marketed as protecting privacy could instead produce a more complete record of a citizen’s movements and transactions than the paper and card systems it replaces. Euronews’s reporting does not allege that any specific member state is doing this deliberately, but it documents that the technical means to prevent it are not yet confirmed to exist ahead of the 2026 deadline.
How the outlets framed it
Euronews frames the wallet rollout as a readiness problem, built around Thomas Lohninger’s warning that current draft rules risk producing a system of pervasive tracking rather than the privacy protection the law promises. The EU’s own institutional messaging, quoted within that same Euronews piece, frames the wallet purely as a convenience upgrade centred on selective disclosure, with no acknowledgement of the unlinkability gap EDRi has raised. The difference between those two framings shows a mismatch between how Brussels describes its own project and what the people building the technical standards say is actually achievable before the deadline arrives.
No date has been set for a formal revision of the implementing rules, and Euronews’s reporting suggests the timeline for the 2026 deadline itself is not expected to move even if the privacy protections remain unresolved.
