Millions of European Union citizens should soon have access to digital wallets, as member states roll out their implementations of the European Digital Identity Regulation ahead of an end of the year deadline. But the digital identity wallets, which are intended to provide a secure and private place to store identifying information such as bank account information, diplomas, and government IDs such as driver’s licenses, could leave behind a trail of cryptographic clues that makes it possible to recognize someone across services. Cryptographers warn that the technology protecting individual privacy may not yet go far enough to stop people from being tracked.
Advances in cryptographic techniques since the law was passed in 2024 means this problem could be solved. However, the law doesn’t require that these techniques be used, and cryptographers that IEEE Spectrum spoke with are split as to whether the wallets should be rolled out at all without such a requirement in place, and whether they’ll be secure enough without it.
With digital wallets, when someone is asked to provide their ID, a digital, verifiable form of the ID can be transmitted, via a QR code for example. When scanned with a verification app, it would show basic identifying user information, according to Anna Lysyanskaya, a professor of computer science at Brown University.
The EU’s digital identity regulation already includes a requirement for selective disclosure, which allows people to share only the attributes requested by the person checking identification rather than handing over an entire document. A bar checking someone’s age, for example, could request a simple confirmation that a person is over 18 and not need their full name or address..
Tracking Risks in EU Digital Wallets
When the person who requested the ID scans it, they still record some personal information, such as the digital signature and identifiers that are required to check the ID. This additional information can serve as a way of tracking a user even if the attributes shared are quite common. Two requesters could share this information to show they had interacted with the same person, says Johannes Schönrich, the director at the FIM Research Center for Information Management at the Augsburg Technical University of Applied Sciences in Germany
If two parties can share that information, that would be a problem: EU legislation specifies that the wallets should also be unlinkable, which means that “tracking a user by means of [these] digital attestations should not be possible,” says Schönrich.
One way to address the problem is to issue multiple versions of a user’s credentials, each with different cryptographic information attached, says Lysyanskaya. The wallet could keep track of which certificates have already been used, ensuring that a different one is presented during each interaction.
“If you allow a service provider to say, look, I’m not supporting the Google protocol, I want a traditional verification, you essentially allow the service provider to do a kind of downgrade.” —Jaap-Henk Hoepman, Raadboud University
This approach has limitations. If the issuer—the government department that creates and digitally verifies that the credential is authentic—can identify who a credential was originally issued to, it could potentially help link the different versions back to the same person, according to Lysyanskaya.
“Now anybody you’ve ever interacted with has some kind of way of tracking you,” she says.
“If this kind of interaction becomes really ubiquitous … then unless we place a tremendous amount of trust in both issuers and verifiers to guard our privacy, we may encounter a situation where everybody knows at all times what everybody else is up to, by just leaving these little digital crumbs of information about yourself.”
Lysyanskaya was one of sixteen cryptographers who were invited to provide feedback for the European Commission when the law was passed in 2024. They recommended using anonymous credentials, which use zero-knowledge proofs to let people demonstrate their identity or eligibility without revealing unnecessary personal information.
How Zero-Knowledge Proofs Work
Zero-knowledge proofs allow one party to convince another that something is true without needing to send any additional information beyond the fact that it is true. For example, they would allow someone to demonstrate that they hold a valid government-issued credential, or meet a particular requirement, without revealing the underlying personal information or creating the same linkable record of the interaction, says Lysyanskaya.
If these two people, the person checking the ID and the person being asked for it ever meet again, there will be no record of any earlier encounters.
The service provider could still verify that the credential is authentic, has not expired or been revoked, and has not been manipulated. However, it would receive less information than it does under traditional verification methods.
“You learn exactly what you need, but not a single bit more about anything that might accidentally be disclosed but is not that necessary,” says Schönrich.
Zero-knowledge proofs have existed in cryptography since the 1980s, but teams of researchers have only recently developed techniques to run them on more constrained devices like smartphones. Shortly after the EU’s digital wallets regulations were passed in 2024, for example, a research team at Google found a way to generate zero-knowledge proofs using credentials signed with the elliptic curve digital signature algorithm, which generates and authenticates digital signatures efficiently enough to be used in a digital wallet.
Those kinds of credentials allow individuals to prove that a credential is valid without revealing the cryptographic signature that could otherwise make separate interactions linkable, according to Jaap-Henk Hoepman, an associate professor of computer science at Radboud University in the Netherlands.
The European Commission wants to conduct more research on implementing zero-knowledge proofs before making them a mandatory requirement for wallet operators from day 1. Because of that, it considers the proofs to be “a core roadmap item,” according to the universal digital blueprint for the wallets. EU governments are free to implement them on a per-country basis if they so choose.
The Commission said on its GitHub page for the wallets that zero-knowledge proofs are not yet mandatory because “there is currently no clear, certifiable approach agreed at EU level,” and that it needs to do more pan-European consultation with cryptographers and groups such as the European Cybersecurity Certification Group (ECCG) that oversee the profession.
“Refinement at this stage focuses on establishing common understanding and boundaries, rather than immediate deployment to secure and privacy-preserving future integration,” their GitHub post from June 2026 reads.
Schönrich says he understands the Commission’s position, but wants them to commit to a binding timeline for introducing zero-knowledge proofs in the next few years for a second version of the wallets.
Karsten Wildberger, Germany’s Federal Minister for Digitalization and State Modernization, unveils the country’s version of the European Union’s EUDI digital wallet in September 2026.Bernd von Jutrczenka/picture alliance/Getty Images
Zero-Knowledge Proofs in EU Digital Wallets
The cryptographers that IEEE Spectrum spoke with are split on whether the EU should ask states to roll out digital wallets without adding in zero-knowledge proofs. The regulation does not specify what type of cryptographic protocols should be used as each country implements its version of the digital wallet, just the privacy requirements.
Hoepman argues that zero-knowledge proofs should be mandated by law so that wallets have to implement this technology. Otherwise, the wallet will not have strong enough privacy protections.
“If you allow a service provider to say, look, I’m not supporting the Google protocol, I want a traditional verification, you essentially allow the service provider to do a kind of downgrade,” Hoepman says. (Some of the cryptographers IEEE Spectrum spoke with advocate for another protocol called the BBS Signature scheme.)
Schönrich believes the EU should proceed with the initial rollout rather than delay the wallets, as even without offering the strongest unlinkability guarantees the wallets are still privacy-friendly. Using lessons from their deployment could also inform a second generation that incorporates the newer cryptographic methods.
However, Hoepman says that online service providers will not want to migrate to a second version because “it will cost them money,” so many will still use the initial version.
Even if a second version becomes available, Lysyanskaya argues that some users may never update their digital wallets unless it becomes mandatory, so the first version needs to be private enough as to not put their IDs at risk.
Hoepman argues that any decision to delay the rollout should be made before the wallets become widely available across Europe. Once businesses and governments have built systems around the first generation, he says, it will be difficult to reverse course.
From Your Site Articles
Related Articles Around the Web
