Germany’s Bundestag on Thursday passed the Digitale Identitätengesetz (DIdG) — the legal framework for the country’s state-issued digital identity wallet — while the privacy architecture that the EU mandate underpinning the law explicitly requires as mandatory will be absent when the wallet goes live. Every user of “d-you,” Germany’s EUDI Wallet launching January 2, 2027, will disclose their full civil identity to commercial services with each interaction until pseudonymous login arrives — on a timeline described in a non-binding resolution as “as quickly as possible,” with no target date attached.
The vote passed on a majority of CDU/CSU and SPD coalition votes, with the opposition — AfD, the Greens, and Die Linke — voting against. The legislation sets the legal framework for Germany’s implementation of the European Digital Identity (EUDI) Wallet under the EU’s eIDAS 2.0 regulation, with a hard launch date of January 2, 2027, for the free, voluntary app developed by SPRIND, the Federal Agency for Disruptive Innovations, on behalf of the Federal Ministry for Digital and State Modernization (BMDS, Bundesdigitalministerium). SPD member Parsa Marvi, who sits on the Bundestag’s Digital Affairs Committee and spent a decade working at telecoms carrier 1&1 Telecommunication before entering politics, put it plainly on the floor Thursday: “the real test for the wallet” was only now beginning.
What Is d-you?
D-you is Germany’s government-built smartphone app for the EUDI Wallet — a mobile system through which residents can store, manage, and present digital identity documents to government bodies and private services, both online and in person. Developed by SPRIND and free to download on Android and iOS, the wallet uses Germany’s existing Personalausweis (national ID card) and its embedded eID chip as the initial trust anchor, binding d-you credentials to an identity that has already been verified against the physical document.
At launch, d-you will be the first electronic means of mobile identification in Germany certified to the EU’s highest “high” assurance level under the eIDAS 2.0 framework. Roughly 40 launch partners from industry and public administration are lined up, including Deutsche Post, Vodafone, Rossmann, and the Sparkassen savings banks network. Existing physical ID documents will not be withdrawn, and the government has pledged explicitly that services cannot require d-you use or deny access to users who decline it.
The wallet will support digital identity cards only at launch. Driver’s licenses and biometric passport photos are planned for later phases; qualified electronic signatures are planned during 2027.
Wallet Without Its Privacy Engine
The central flaw that privacy researchers, data protection authorities, and civil liberties advocates flagged in the committee process is not a bug — it is an architectural absence baked into the January 2 launch.
The eIDAS 2.0 regulation (Regulation EU 2024/1183), which came into force in May 2024, explicitly envisions pseudonymous login as a mandatory EUDI Wallet function. Pseudonymous login means a user can prove specific attributes — “I am over 18,” “I hold a valid driver’s license,” “I am a licensed pharmacist” — without disclosing their legal name, address, or any other civil identity data to the service receiving the proof. The underlying cryptographic mechanism that makes this possible is called a zero-knowledge proof: a mathematical construction in which one party demonstrates a statement is true without revealing any information beyond the truth of the statement itself.
Without zero-knowledge proofs, the alternative — selective disclosure using a format called SD-JWT (Selective Disclosure JSON Web Token) — offers partial improvement over sending a full identity document but still falls short of genuine pseudonymity. A user sharing “age_over_18 = true” via SD-JWT suppresses unneeded fields from the credential, but the underlying credential can still be linked across transactions if a persistent identifier is not suppressed. With zero-knowledge proofs implemented via BBS+ signatures or similar constructions, each age-verification presentation is computationally indistinguishable from the last: the relying party learns the user is over 18, and nothing else — not which credential was used, not whether this is a repeat visitor.
D-you at launch supports the SD-JWT-level selective disclosure but not zero-knowledge proof-based pseudonymous login. The technical implication: every d-you wallet interaction in January 2027 will link to a legally identified credential and reveal that identity to the relying party, creating a cross-service identity trail that GDPR data-minimization principles cannot eliminate once the data has left the wallet.
Germany’s coalition’s own non-binding resolution (Entschließungsantrag) passed alongside the main law acknowledges this plainly: “the pseudonym function is mandatory under EU law.” CDU rapporteur Markus Reichel, the Union caucus’s point person on the bill, said pseudonymous use should come “as quickly as possible.” But the resolution carries no legal force and sets no target date.
Parliamentary State Secretary Gitta Connemann (CDU) of the BMDS told the committee Wednesday that her ministry was working “in close collaboration with the BfDI” to deliver pseudonymity features, and linked the delay partly to pending implementing acts still owed by the European Commission.
The Federal Data Protection Commissioner (BfDI), represented at the October 6 expert hearing by senior official Andreas Hartl, was unambiguous: the absence of pseudonymous identification is “unfortunate from a data protection standpoint.” Hartl also called for consolidated privacy oversight of the entire wallet ecosystem under the BfDI — a recommendation the passed law did not fully adopt.
Bianca Kastl, a digital health researcher from the Innovationsverbund Öffentliche Gesundheit who testified at the same hearing, was blunter: “Pseudonyms become nothing more than a statement of intent in this law. When they will arrive remains unclear and non-binding.” Kastl argued the January 2 launch date should be pushed back until data-minimizing core functions are in place, and warned of a “Cookie-Banner 2.0 scenario” — the same failure mode that produced ubiquitous consent-theater on the web, now replicated at the identity layer: relying parties requesting maximum data on registration, with no authority empowered to challenge them upfront.
Thomas Lohninger of the Austrian digital rights group epicenter.works, who testified against the DIdG on October 6, rated the bill overall “tendenziell negativ” (leaning negative) and cited missing “essential safeguards.” After the committee vote, he maintained that position, adding that the law still lacks a non-discrimination clause protecting users who choose not to share their biometric photograph in the wallet — meaning people could face de facto disadvantage for withholding biometric data, even though the law now permits the opt-out. Lohninger has argued publicly that pseudonymity is what prevents companies from compelling users to reveal their legal names — an issue of particular sensitivity for any service where users have a legitimate interest in not being identified.
EU Mandate and the Race to January
The DIdG is Germany’s statutory response to eIDAS 2.0 member state obligations, which require every EU member state to issue or certify at least one EUDI Wallet for citizens and residents. The goal is cross-border interoperability: a credential issued in Berlin should be verifiable in Lisbon or Tallinn without friction. Germany’s Bundestag completed that legal framework on Thursday, roughly ten months after the EU regulation entered force in May 2024.
Germany is not alone in racing toward the January deadline. Italy has been operating its IT Wallet in pilot form since late 2024, and the EU Digital Identity Wallet Consortium (EWC) large-scale pilot has been testing cross-border use cases — travel, payments, organizational identity — across Germany, Sweden, Finland, Iceland, and Norway. Other member states are at varying stages of development.
The Bundesnetzagentur (Federal Network Agency) is designated as Germany’s supervisory body for trust services under the eIDAS framework. All businesses operating in the EU must accept the EUDI Wallet for identity verification by December 2027 — an obligation that makes Germany’s January launch not only a domestic policy action but a reference point for the entire continent.
Key Amendments Bundestag Added
After the October 6 expert hearing, the Digitalausschuss amended the government’s draft before recommending it to the full chamber. The revised version passed the committee Wednesday on coalition votes and cleared the Bundestag floor Thursday. Changes include:
Biometric photo opt-out: Users may refuse inclusion of their biometric photograph in their digital identity data. The original draft had made photo inclusion mandatory; the amendment aligns Germany with the EU-level framework, which already permits opt-outs. Lohninger noted the amendment still lacks an accompanying non-discrimination protection.
Federal citizen account preserved: A central Bürgerkonto (citizen account) will remain available as a voluntary gateway to digital government services, alongside d-you.
Faster federal credential delivery: Federal authorities must make electronic identity documents and attestations available within 12 months of the law’s promulgation — down from the originally proposed 24 months.
Digital sovereignty in procurement: Under §5, procurement of wallet infrastructure must explicitly weigh EU and German digital sovereignty, including assessment of critical dependencies and exit strategies — a provision with implications for which vendors can compete for d-you infrastructure contracts.
Lower age threshold: The online ID function is usable from age 13, down from 16.
Age Verification Without Privacy-Preserving Verification
The DIdG’s reduction of the online ID threshold to 13, combined with the wallet’s missing zero-knowledge proof architecture, creates a particular tension for the EU’s stated vision of privacy-preserving age verification.
The EUDI Wallet’s design, per published interoperability specifications, uses ISO mDoc (ISO/IEC 18013-5) as the credential format and OpenID4VP (OpenID for Verifiable Presentations) as the exchange protocol. In its complete form — with zero-knowledge proofs — a user would present a proof of “age ≥ 18” or “age ≥ 13” that reveals nothing beyond the threshold result: no name, no birthdate, no persistent identifier. Services requesting age verification could confirm the threshold without learning who asked.
At launch, d-you will support selective disclosure of attributes (revealing only “age ≥ 18” rather than the full birthdate), but without the cryptographic unlinkability that zero-knowledge proofs provide. An age-verification transaction via d-you in January will still tie to an identifiable credential, creating a record of which services the user accessed and when.
This gap is more acute for sensitive age-gated services — adult content platforms, gambling, health information for minors — where pseudonymous age verification is not merely a convenience but a meaningful protection. The DIdG’s experimentation clause, discussed below, extends wallet access to children as young as 12 in government-authorized pilots. Without privacy-preserving age verification, those pilots will also generate full-identity transaction records.
Experimentation Clause: State Identity as Pilot Project
The second major locus of expert criticism is a broad “experimentation clause” in the enacted law that grants the BMDS authority to pilot new identification methods — including extending wallet access to children as young as 12 — subject only to notifying the Digitalausschuss with a two-week lead time.
The BfDI had specifically asked, before and during the legislative process, that such experiments require the involvement of either the BfDI Commissioner or the Federal Office for Information Security (BSI). The final law does not mandate this. Moritz Hennemann, the new BfDI Commissioner who took office October 1 after being elected by the Bundestag in June, introduced himself to the Digitalausschuss this month by describing digital identities as capable of making “digital sovereignty tangible for citizens” and calling data protection a “Vertrauenskatalysator” (trust catalyst) — a framing centered on enabling use rather than imposing constraints.
Hennemann, a University of Freiburg professor of civil, information, media, and internet law who published extensively on the GDPR before his appointment, will oversee the wallet ecosystem’s data protection compliance. His economically-oriented approach to data protection — he has described data as an economic good that should enable innovation — contrasts with the structural guarantees BfDI’s predecessor sought in the legislation.
Die Linke’s Sonja Lemke warned in the plenary debate: “State identity is not a playground to just try things out on.”
Relying Parties: Appeal, Not Rule
A third oversight gap runs through the entire relying-party framework. The DIdG does not establish advance scrutiny of data requests by “relying parties” — the businesses and agencies that will query the wallet.
Consumer rights organization Verbraucherzentrale Bundesverband (vzbv) called for advance scrutiny of relying-party data requests at the October 6 hearing, seeking a supervisory authority empowered to verify upfront that data requests are proportionate to stated purposes. The enacted text instead invokes the existing GDPR data-minimization principle, effectively appealing to relying parties to limit their data requests on registration. There is no mandated public registry disclosing which entities may request which data fields, and no explicit sanction mechanism — up to and including ecosystem exclusion — for proportionality violations.
This is the mechanism Kastl’s “Cookie-Banner 2.0” analogy targets. In the web cookie consent ecosystem, websites present consent banners but the practical default routes most users toward maximum data sharing; the consent architecture is technically present but operationally ineffective. Without advance scrutiny, d-you risks replicating that pattern: relying parties request broad data sets on registration, users approve transaction-by-transaction but rarely inspect which fields are requested, and the GDPR data-minimization principle operates as a theoretical backstop rather than a technical constraint.
The government estimates the DIdG will reduce annual administrative costs by €121.7 million (approximately $136 million USD) through digitized identity processes. Those savings arrive upfront; the privacy architecture that would justify public trust in the system is still pending.
What Happens Next
With the law enacted, attention shifts immediately to execution. D-you is due on the App Store and Google Play on January 2, 2027. Whether its rollout feels meaningful to users on day one depends significantly on factors outside the BMDS’s control: municipalities and federal states — which issue the bulk of civil-status documents, driving licenses, and certificates German residents actually need — are, by most accounts, far from ready to accept or issue d-you credentials. A CDU/CSU research paper from July flagged this as a major bottleneck: without local acceptance infrastructure, the wallet risks arriving as a solution without a problem to solve.
The BMDS opened a public bug-bounty program inviting independent security researchers to probe d-you’s Android and iOS builds and the broader EUDI Wallet ecosystem components — an encouraging signal for security transparency. Jiska Classen of Potsdam had warned at the October 6 hearing that much of d-you’s security architecture was not yet public, not independently assessed, and not fixed in statute — and that many Android devices no longer receive security updates, creating structural data-extraction risk even before launch.
Abroad, the wider EU digital identity effort is watching. Germany’s wallet is expected to serve as a reference implementation for other mid-sized EU member states still determining their own approaches. How Berlin resolves the pseudonymity deficit — and whether it can do so before users form early trust or distrust impressions around the wallet — may shape national digital ID adoption patterns across the bloc for years.
For now, the law is passed, the clock is running toward January 2, and, as Marvi put it on the Bundestag floor Thursday, “the real test begins.”
Frequently Asked Questions
What is pseudonymous login, and why does its absence matter for d-you users?
Pseudonymous login would allow a d-you user to prove specific attributes — such as being over 18, holding a professional qualification, or meeting a residency requirement — without revealing their legal name or any other civil identity data to the service they’re proving it to. The underlying technology is called a zero-knowledge proof: a cryptographic method by which one party can mathematically demonstrate that a statement is true without disclosing the information that makes it true.
Without this capability at launch, every d-you wallet interaction in January 2027 will tie to the user’s legally identified credential, meaning commercial services — shops, banks, content platforms — will receive and retain the user’s identity with each transaction. The EU’s eIDAS 2.0 regulation explicitly identifies pseudonymous login as a mandatory EUDI Wallet function; Germany’s coalition has acknowledged in a non-binding resolution that it must be delivered but has set no timeline for when.
Is d-you use mandatory, and what happens to people who don’t adopt it?
D-you use is explicitly voluntary — the DIdG provides that existing physical ID documents remain valid and that services cannot require wallet use or discriminate against users who decline to use it. However, the DIdG’s reduction of the online ID threshold to age 13, and the broad “experimentation clause” allowing further age-bracket pilot programs, create pressure toward functional necessity: services that implement age-tiered access via d-you will, in practice, push users toward adoption. The law’s framework — mandatory relying-party registration but no advance scrutiny of data requests — means the ecosystem’s defaults will shape adoption more than the formal voluntariness provision does.
What does the “experimentation clause” allow the government to do?
The experimentation clause grants the BMDS broad authority to pilot new identification methods, including extending wallet access to children as young as 12, with only a two-week notification to the Bundestag’s Digital Committee required — and no mandatory involvement of the Federal Data Protection Commissioner or the Federal Office for Information Security. The clause was designed to allow innovation, but critics including Sonja Lemke of Die Linke and the BfDI’s own representatives argued it hands the government’s digital ministry effectively unchecked power to test identity procedures on children below the law’s own age threshold, without the independent oversight that the sensitivity of that population warrants.
When will pseudonymity features actually arrive in d-you?
No date has been set. CDU rapporteur Markus Reichel said pseudonymous use should arrive “as quickly as possible.” A non-binding resolution passed alongside the DIdG calls on the government to deliver the function but carries no legal force and includes no deadline. BMDS Parliamentary State Secretary Gitta Connemann linked the delay partly to European Commission implementing acts still being finalized at the EU level. Privacy researchers including Bianca Kastl have warned that launching the wallet without pseudonymity, then retrofitting it later, risks allowing user habits and commercial data flows to form around an over-identifying architecture before the privacy-preserving alternative is available.
