How does eIDAS 2.0 affect e-commerce identity verification?

eIDAS 2.0 directly affects e-commerce identity verification by raising the bar for how online businesses must confirm who their customers are. The regulation, formally Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and introduces the European Digital Identity Wallet (EUDI Wallet) while strengthening requirements for trusted digital identity across the EU. It applies to both public and private sector services, including online retail. This article walks through the most important questions e-commerce businesses are asking right now.

What changes does eIDAS 2.0 bring to online identity checks?

eIDAS 2.0 amends the original eIDAS framework by making digital identity verification more standardized, more secure, and more widely applicable across the EU. Where the original regulation focused primarily on public sector services, eIDAS 2.0 extends its scope to private sector platforms, including e-commerce. This means online businesses can no longer treat digital identity as an optional consideration.

The most significant change is the introduction of the EUDI Wallet, a digital identity solution that EU Member States must make available to citizens and businesses. Each Member State is responsible for providing or mandating a wallet solution, certifying and notifying it, and supervising the actors within its jurisdiction. The European Commission manages the legal framework and adopts implementing acts, while the European Digital Identity Cooperation Group supports cross-border alignment and cooperation between Member States. Alongside this governance structure, eIDAS 2.0 tightens the assurance levels required for certain types of online interactions, meaning that a simple username and password is no longer sufficient for transactions that carry meaningful risk.

For e-commerce businesses, this translates into a need to support identity verification methods that are interoperable across EU borders, privacy-preserving by design, and aligned with defined assurance levels. The regulation also gives users greater control over their personal data, which means businesses must rethink how they collect, store, and use identity information during onboarding and checkout.

Which e-commerce transactions require stronger identity verification under eIDAS 2.0?

Not every online purchase requires enhanced identity verification under eIDAS 2.0, but several transaction types do. The regulation targets interactions where there is meaningful risk, a legal obligation, or a need to confirm specific attributes about the user, such as their age, identity, or professional status.

Transactions that typically require stronger identity checks include:

• Age-restricted purchases such as alcohol, tobacco, gambling services, or adult content, where verifying the user’s age is a legal requirement
• High-value financial transactions where payment initiation or account access must meet strong customer authentication standards
• Regulated product sales such as prescription medications or controlled substances, where the buyer’s identity must be confirmed before fulfillment
• Account creation on platforms that are classified as very large online platforms with more than 45 million users in the EU, or services subject to sector-specific rules
• Cross-border purchases where identity attributes need to be recognized and trusted across EU Member States

For many of these use cases, the EUDI Wallet offers a practical solution. A user can share only the necessary attribute, such as proof of being over 18, without revealing their full identity. This selective disclosure is one of the key innovations eIDAS 2.0 brings to online age verification and identity checks in e-commerce. Proving age this way does not require a zero-knowledge proof: selective disclosure of a single attribute such as “age over 18” is sufficient.

How does the EUDI Wallet work for e-commerce checkout?

The EUDI Wallet works as a secure digital app on a user’s smartphone that stores verified identity attestations issued by trusted sources, such as national authorities or qualified trust service providers. During e-commerce checkout, a user can share specific verified attributes with the retailer in a few steps, without having to fill out forms or upload documents manually.

Here is how the process works in practice:

1. The e-commerce platform, acting as a relying party, requests a specific identity attribute from the customer, for example proof of age or a verified name and address.
2. The customer receives a prompt in their EUDI Wallet app and reviews what is being requested.
3. The customer approves the share, releasing only the requested information and nothing more.
4. The relying party receives a cryptographically signed response confirming the attribute. Verifying that response involves checking the issuer’s signature against the relevant national trusted list, checking the revocation status of the attestation, and checking the wallet unit attestation to confirm the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
5. The transaction proceeds based on the verified response.

This process is faster and more privacy-friendly than traditional document uploads or manual KYC flows. Because wallet credentials are issued by recognized authorities, including national issuers of Person Identification Data and qualified trust service providers, the assurance level is high, meaning retailers can rely on the result. The first four Large Scale Pilots ran from April 2023 to 2025 and tested this flow in real-world scenarios. The EWC consortium covered digital travel credentials, payments, and organisational digital identity. POTENTIAL focused on government services, bank account opening, SIM registration, mobile driving licences, remote qualified signatures, and e-prescriptions. NOBID concentrated on payments, and DC4EU addressed education and social security. The findings from those pilots are shaping the final implementation. A second wave of pilots started in 2025: WE BUILD covers business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.

What is the difference between eIDAS 2.0 and existing KYC or age verification methods?

The key difference lies in trust, interoperability, and privacy. Existing KYC and age verification methods vary widely in quality, legal recognition, and cross-border validity. eIDAS 2.0 establishes a common EU-wide standard that any compliant organization can rely on, regardless of which Member State the user comes from.

Traditional KYC processes in e-commerce often involve collecting documents, running automated checks, and storing personal data. These flows can be slow, prone to fraud, and privacy-invasive. Age verification methods used today range from simple self-declaration to credit card checks, none of which provide a high level of assurance.

eIDAS 2.0 and the EUDI Wallet change this in three important ways:

• Higher assurance: Wallet attestations are issued by recognized authorities, including national issuers and qualified trust service providers, making them far more reliable than self-reported data or document scans
• Selective disclosure: Users share only what is necessary, for example a yes or no answer to “is this person over 18,” without disclosing their full date of birth
• Cross-border recognition: The EUDI Wallet framework is designed so that a certified wallet from one Member State can be used with a registered relying party in another Member State, reducing friction for international e-commerce. Sector-specific legislation and national registration requirements continue to apply, and not every use case will be immediately available in every country.

For businesses already running KYC processes, eIDAS 2.0 does not replace existing workflows entirely. It introduces a higher-quality input that can improve the reliability of identity checks while reducing the burden on users. Note that the reuse of KYC data across institutions is governed by AML regulation, not by eIDAS itself. A relying party also needs its own legal basis under the GDPR for processing the identity data it receives.

When do e-commerce businesses need to be compliant with eIDAS 2.0?

Regulation (EU) 2024/1183 entered into force on 20 May 2024. The first implementing acts, covering technical specifications, security standards, and interoperability rules for the EUDI Wallet, were adopted by the end of 2024. These implementing acts are legally binding. The Architecture and Reference Framework provides the technical elaboration of those requirements. A second wave of implementing acts followed in 2025, addressing areas including qualified electronic archiving, validation, certificates, and qualified trust service providers.

24 December 2026 is the legal deadline by which every EU Member State must have at least one certified EUDI Wallet available to citizens, residents, and businesses. From that date, public authorities and public service providers are required to accept notified wallets as a means of identification for online services that require electronic identification. This legal deadline is an outer limit, not a predicted launch date. It does not guarantee that every national wallet will reach the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe immediately. Practical interoperability and national rollout are expected to develop in phases, and businesses should plan accordingly.

The acceptance obligation for regulated private sector relying parties takes effect on 24 December 2027, under Article 5f of the regulation. This obligation applies within contexts where strong user authentication is legally or contractually required, and covers sectors including banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms with more than 45 million users in the EU fall under a separate provision of Article 5f: for those platforms, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros, are exempt from the Article 5f obligation. General retailers not falling within these categories are not subject to the same mandatory acceptance obligation, though they may still benefit from supporting wallet-based verification.

The compliance timeline is therefore not a single hard deadline for all e-commerce businesses. Obligations differ depending on the type of service, the sector, and the specific rules that apply. Businesses in financial services, healthcare, and other regulated industries face earlier and stricter requirements than general retailers. Any e-commerce platform that handles age-restricted products, high-risk transactions, or user accounts with personal data should treat these deadlines as a planning horizon.

Early preparation matters because integrating EUDI Wallet support into existing checkout and onboarding flows takes time. Businesses that wait until obligations are formally enforced risk rushed implementations, compliance gaps, and a poor user experience. Before a relying party can request wallet data, it must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. Registration covers the intended uses, the attributes requested, and the attestation types involved. The wallet checks incoming requests against that registered scope.

How should online retailers prepare for eIDAS 2.0 identity requirements?

Online retailers should start by mapping which of their transactions and user interactions are likely to fall under eIDAS 2.0 obligations, then assess what changes their current identity verification flows need. This involves compliance, product, legal, and IT teams working together to understand the regulatory requirements and their practical implications.

Practical steps to take now include:

1. Conduct a transaction audit: Identify which products or services require age verification, identity confirmation, or strong authentication under existing or upcoming rules.
2. Review your current identity stack: Understand what assurance levels your current verification methods provide and where they fall short of eIDAS 2.0 requirements.
3. Assess EUDI Wallet readiness: Explore what it would take to accept wallet-based attestations at checkout and whether your technology partners support this. Keep in mind that national wallet availability and certification will develop at different paces across Member States.
4. Update your data minimization practices: eIDAS 2.0 places strong emphasis on privacy and selective disclosure, so review what personal data you collect and whether you can reduce it. Remember that your organization needs its own GDPR legal basis for processing the data received from a wallet presentation.
5. Follow the regulatory timeline: Keep track of national implementation plans in the markets where you operate, as timelines, certification status, and specific obligations may vary by country. Check the registration requirements under CIR (EU) 2025/848 for the Member States where you are established.

Retailers should also look at how eIDAS 2.0 interacts with other regulations they already comply with, such as GDPR, PSD2, and sector-specific KYC rules. In many cases, a well-implemented digital identity strategy can simplify compliance across multiple frameworks at once.

How TrustTech supports eIDAS 2.0 e-commerce identity verification

Connecting an e-commerce platform to the EUDI Wallet ecosystem involves more than reading the regulation. It requires translating compliance requirements into working integrations across checkout flows, onboarding processes, and identity verification logic.

The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

For e-commerce businesses, the ID Connector handles the following:

• Accepting wallet presentations from any notified EUDI Wallet, regardless of the issuing Member State
• Verifying issuer signatures against the relevant national trusted lists, which are consolidated in the EU List of Trusted Lists
• Checking attestation revocation status against issuer-provided status information
• Validating wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution
• Enforcing the attribute scope registered under CIR (EU) 2025/848, so that only the attributes covered by the relying party’s registration are requested
• Supporting qualified signing via a connected qualified trust service provider, for transactions that require a qualified electronic signature

This applies across the sectors most directly affected by eIDAS 2.0 obligations: financial services, healthcare, pharma, and government, as well as e-commerce platforms handling age-restricted products or regulated transactions.

Get in touch with TrustTech to discuss how the ID Connector fits into your identity verification setup.