eIDAS 2.0 affects digital identity for minors, but it does not establish a single, uniform framework specifically designed for children. The regulation, which amends Regulation (EU) 910/2014, establishes a broad digital identity infrastructure that Member States must implement. Questions around minors, such as age verification, parental consent, and data protection, are addressed through a combination of eIDAS 2.0 requirements, the GDPR, and national law. For organizations serving younger users, this creates both obligations and opportunities worth understanding in detail.
What does eIDAS 2.0 say about age verification for minors?
eIDAS 2.0 enables reliable, privacy-preserving age verification across the EU by making the European Digital Identity Wallet available to all citizens and residents. The wallet allows users to prove specific attributes, such as whether they are above a certain age threshold, without sharing their full identity. Through selective disclosure, a user can confirm an age attribute without revealing their name, address, or other personal details. This makes age verification for minors more accurate, less invasive, and technically consistent across Member States.
Under the previous eIDAS framework, age verification was inconsistent across the EU. Some countries had strong national eID systems, while others had very little. eIDAS 2.0 addresses this by requiring every Member State to provide a digital identity wallet that supports selective disclosure. A service requiring age confirmation receives only the relevant attribute, such as “older than 18”, and nothing more. Zero-knowledge proofs are not required for this: selective disclosure of a single age attribute is sufficient.
For organizations that operate age-restricted services, such as online platforms, gaming services, or financial products, this is a meaningful shift. Instead of relying on self-declaration or credit card checks, they can request a cryptographically signed age attribute from a trusted source. The result is both more tamper-evident and more respectful of user privacy.
How does parental consent work under eIDAS 2.0?
eIDAS 2.0 does not define a specific parental consent mechanism, but it creates the digital infrastructure through which consent processes can be made more reliable and verifiable. The regulation works alongside the GDPR, which requires parental or guardian consent for the processing of personal data belonging to children under 16, with Member States able to lower this threshold to 13. Together, these frameworks push organizations toward consent flows that are genuinely verifiable.
In practical terms, the EUDI Wallet could support parental consent by allowing a parent or guardian to authenticate their own identity and formally authorize a digital action on behalf of a minor. This kind of delegated authorization is technically possible within the wallet architecture, though how exactly it is implemented will vary between Member States, wallet providers, and relying parties. Governance of this process is a shared responsibility: the European Commission sets the legal framework and adopts implementing acts, Member States provide or mandate wallet solutions and supervise actors within their jurisdiction, and relying parties are responsible for ensuring their consent flows meet applicable requirements.
For organizations, parental consent under eIDAS 2.0 is a matter of building consent flows that meet both eIDAS identity assurance standards and GDPR requirements simultaneously. It is also worth noting that approving a data request in the wallet is a separate action from giving consent as a legal basis under the GDPR. A relying party needs its own GDPR legal basis for any processing that follows. Organizations that align these requirements early will be better positioned as enforcement and expectations tighten.
Can minors hold and use an EUDI Wallet?
Yes, minors can hold and use an EUDI Wallet. The regulation states that the wallet must be made available to any EU citizen or resident who wants one, and it does not exclude children. Whether and how a minor accesses a wallet in practice will depend on national implementation rules, including any age thresholds or guardian involvement requirements set by individual Member States.
The wallet itself is designed to be flexible. It can store a range of digital documents and credentials, from a national identity card to educational qualifications, and it supports selective disclosure so users share only what is needed for a given interaction. For minors, this could be especially useful in contexts like:
- Accessing age-appropriate public digital services
- Proving eligibility for student discounts or youth programs
- Confirming age for online platforms without sharing full identity data
- Storing educational credentials or participation certificates
- Accessing healthcare information relevant to their age group
Member States are legally required to make wallets available to citizens and residents by 24 December 2026. This is the legal deadline for Member States’ wallet obligations. It does not mean that every national wallet will have reached the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe at that point. Practical interoperability and national rollout are expected to develop in phases. Guidance on minor access and guardian oversight will become clearer through national legislation and technical specifications as rollouts progress.
What privacy protections does eIDAS 2.0 provide for children’s identity data?
eIDAS 2.0 builds strong privacy protections directly into its architecture, and these apply to all users, including children. The most important protection is the principle of minimal disclosure: users share only the data that is strictly necessary for a given transaction. For minors, this means that a service requiring age confirmation does not need to receive a full identity profile, only the relevant attribute.
The wallet is also user-controlled by design. Individuals decide what data is shared, with whom, and when. Each time a relying party requests data, the user approves that specific presentation from the wallet. This applies regardless of age, though in practice, minors may exercise this control with parental involvement depending on national rules.
Beyond eIDAS 2.0 itself, children’s identity data is protected by the GDPR, which applies additional restrictions on processing the personal data of minors. Organizations must have a valid legal basis for processing, and for children, that often means explicit parental consent. For health-related data, a separate legal ground under Article 9(2) GDPR is also required. The combination of eIDAS 2.0’s technical privacy architecture and GDPR’s legal requirements creates a layered protection framework.
One important point: organizations that receive identity data through the EUDI Wallet are still responsible for how they handle and store that data. The wallet protects the transmission. Compliance obligations apply to everything that happens after.
Which sectors are most affected by eIDAS 2.0 identity rules for minors?
Several sectors face direct and immediate implications when it comes to digital identity for minors under eIDAS 2.0. The sectors most affected are those where age verification, parental consent, or youth-specific services play a significant role in daily operations.
- Healthcare: Minors access healthcare services, require consent for treatments, and may need to store or share health-related credentials. Secure, privacy-preserving identity verification is essential in this context, and identity solutions must align with both eIDAS 2.0 and medical data protection rules, including the requirement for a legal ground under Article 9(2) GDPR for health data.
- Education: Schools, universities, and online learning platforms need to verify student identity and age. The EUDI Wallet supports education credentials and can simplify enrollment and access to digital learning environments.
- Financial services: Banks and fintech providers must verify age before offering certain products. eIDAS 2.0 makes this verification more reliable and reduces friction in onboarding for younger customers.
- Government services: Public digital services increasingly require verified identity. For minors accessing benefits, social services, or civic platforms, the wallet enables secure access without unnecessary data sharing.
- Online platforms: Very large online platforms, as defined under the Digital Services Act, are addressed by a specific provision within Article 5f of eIDAS 2.0. Where a platform requires user authentication, it must accept the EUDI Wallet on a voluntary basis at the user’s request and for the minimum data necessary. Age-restricted services more broadly benefit from the wallet’s tamper-evident age attributes as a more robust alternative to current self-declaration methods.
Each of these sectors must evaluate their current identity processes and assess where eIDAS 2.0 creates new obligations or opportunities related to younger users. Sector-specific legislation continues to apply alongside eIDAS 2.0, and relying parties remain subject to the national registration frameworks relevant to their sector and jurisdiction. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of their Member State of establishment before requesting wallet data, specifying per intended use which attributes and attestations they will request.
How should organizations prepare for minor identity compliance under eIDAS 2.0?
Organizations should start by mapping every point in their services where a user’s age or identity is relevant, and then assess whether their current approach meets the standards eIDAS 2.0 and GDPR together require. Preparation is an ongoing process of aligning technical systems, legal frameworks, and operational workflows.
Key steps to take now include:
- Audit existing age verification and parental consent processes for legal and technical gaps
- Assess readiness to accept EUDI Wallet-based identity attributes as they become available
- Review data minimization practices to ensure only necessary data is collected from or about minors
- Engage legal and compliance teams to align consent flows with both eIDAS 2.0 and GDPR requirements, including the distinction between wallet approval and GDPR legal basis
- Monitor national implementation guidance from your Member State on wallet rollout timelines and minor access rules
- Register as a relying party under CIR (EU) 2025/848 before requesting wallet data, specifying the attributes and attestations required per intended use
Organizations in regulated sectors should also consider how their current onboarding and verification infrastructure will need to evolve. Digital identity processes need to shift toward reusable, standards-based verification that can adapt as regulation develops.
Waiting for full regulatory clarity before acting carries its own risk. 24 December 2026 is the legal deadline by which Member States must make wallets available and public authorities must accept notified wallets for online services requiring electronic identification. This deadline marks a legal obligation, not a guarantee that all national wallets will be fully mature or that every cross-border use case will be immediately operational on that date. National rollouts and practical interoperability are expected to develop in phases. Separately, regulated private sector organizations, including those in financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services, face an obligation under Article 5f of the regulation to accept notified wallets by 24 December 2027, where strong user authentication is legally or contractually required. Very large online platforms are addressed by a separate provision within Article 5f, under which they must accept the wallet where they require user authentication, on a voluntary basis at the user’s request and for the minimum data necessary. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from the Article 5f obligation. Organizations that have not adapted their systems in time may face compliance gaps, user friction, or competitive disadvantage.
How TrustTech supports digital identity for minors under eIDAS 2.0
Navigating eIDAS 2.0 compliance for minors requires aligning technical infrastructure, legal obligations, and real-world user flows, often across multiple sectors and jurisdictions. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations serving minors, the ID Connector handles the technical layer of wallet acceptance, including verification of issuer signatures against national trusted lists, checking revocation status via issuer-provided status information, and validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution. It also enforces the registered attribute scope defined under CIR (EU) 2025/848, so only the attributes and attestations specified in the relying party’s registration are requested.
Working with TrustTech, your organization can:
- Accept EUDI Wallet-based age attribute disclosures without requesting unnecessary identity data
- Build consent flows that align eIDAS 2.0 identity assurance requirements with GDPR parental consent obligations
- Enable reusable identity verification so minors and their guardians do not have to repeat the same checks across services
- Integrate qualified signing and identity-linked authorization into workflows where minor or guardian authorization is required, via a connected qualified trust service provider
- Prepare for cross-border interoperability so your services work reliably for users across EU Member States, accounting for the phased nature of national rollouts and the sector-specific rules that continue to apply in each jurisdiction
Whether you are in healthcare, financial services, government, or education, the ID Connector gives you a single, standards-based integration point for EUDI Wallet acceptance and verified identity data. Explore our identity solutions or get in touch to discuss your organization’s specific situation.