eIDAS 2.0 enables privacy-preserving identity proofing by giving individuals control over exactly which personal data they share, with whom, and when. A user can disclose only the specific attributes a service requires, without presenting a full identity document. This approach is built directly into the European Digital Identity Wallet and the technical standards that underpin it. The sections below explain how each privacy mechanism works and what it means in practice.
What does privacy-preserving identity proofing actually mean under eIDAS 2.0?
Privacy-preserving identity proofing under eIDAS 2.0 means verifying who someone is, or confirming a specific attribute about them, without exposing more personal data than is strictly necessary for the transaction. A person proves only what is needed, and the relying party receives only that. This is a fundamental departure from traditional identity verification, where a full document scan or data set is typically required.
Under the original eIDAS framework, Regulation (EU) 910/2014, privacy protections were limited and inconsistently applied across Member States. eIDAS 2.0, Regulation (EU) 2024/1183, amends that regulation and embeds data minimisation directly into the architecture of the European Digital Identity Wallet. The regulation aligns closely with GDPR principles, making minimal disclosure a technical and legal requirement.
For organisations in sectors such as finance, healthcare, and government, this matters enormously. Identity proofing processes that once required collecting and storing large amounts of personal data can now be redesigned around verified attestations. A user can prove they are over 18, that they hold a valid professional qualification, or that they are a resident of a particular country, without revealing their date of birth, full name, or home address.
How does selective disclosure work in the EUDI Wallet?
Selective disclosure in the EUDI Wallet allows a user to share individual attributes from an attestation rather than the entire attestation. When a service requests proof of a specific fact, the wallet presents only that fact, with a tamper-evident cryptographic signature, while keeping all other stored data private. The user sees exactly what is being shared before confirming.
This works through the use of verifiable attestations, a standardised format for digital claims. A government-issued identity attestation stored in the wallet might contain dozens of data fields. Selective disclosure means a user can respond to a request for age verification by releasing only a yes or no confirmation, without sharing their full date of birth or passport number.
The technical foundation relies on credential formats that support attribute-level disclosure. The EUDI Wallet Architecture and Reference Framework (ARF) references formats such as SD-JWT VC (Selective Disclosure JSON Web Token Verifiable Credential) and mdoc, both of which allow individual fields within an attestation to be revealed or withheld independently. The ARF provides the technical elaboration of requirements set out in the implementing acts adopted by the European Commission, and it is those implementing acts that carry legally binding force. This is a significant technical advancement over traditional document-based verification, where presenting a physical ID card reveals everything on it.
For organisations building digital identity solutions, this means onboarding flows can be redesigned around minimum viable data. A financial services provider performing a KYC check does not need to receive and store a full identity document scan if a verified attribute from a trusted wallet issuer is sufficient to meet the regulatory requirement.
What role do zero-knowledge proofs play in eIDAS 2.0?
Zero-knowledge proofs (ZKPs) allow one party to prove to another that a statement is true without revealing the underlying data that makes it true. In the context of eIDAS 2.0 and digital identity privacy, this means a user can prove they meet a condition, such as being above a certain age or holding a valid attestation, without disclosing the actual value behind that condition.
ZKPs represent the most privacy-preserving end of the selective disclosure spectrum. Where standard selective disclosure still reveals the specific value of a chosen attribute, a zero-knowledge proof reveals nothing except the truth of the claim. A user can confirm they are over 21 without the verifier ever learning their actual date of birth. It is worth noting that age verification without a date of birth can also be achieved through straightforward selective disclosure of an attribute such as “age over 18”, which does not require ZKPs.
The eIDAS 2.0 technical framework does not mandate zero-knowledge proofs for all use cases, but the Architecture and Reference Framework for the EUDI Wallet accommodates ZKP-compatible credential formats, providing wallet providers and relying parties with the option to implement a high level of privacy protection where the use case requires it. The ARF elaborates the technical requirements that flow from the legally binding implementing acts and is not itself legislation.
For regulated sectors such as healthcare and pharmaceuticals, where sensitive personal data carries significant legal and ethical weight, ZKPs offer a path toward compliance with reduced data exposure. The technology is maturing rapidly, and organisations planning their implementation approach should consider where ZKPs can complement attribute-level disclosure in their verification flows.
How does eIDAS 2.0 address identity tracking across services?
eIDAS 2.0 addresses cross-service identity tracking by requiring that wallet interactions do not allow different relying parties to correlate a user’s activity with each other. This is achieved through the use of unlinkable pseudonyms and the prohibition of shared identifiers that could be used to build a profile of a user’s behaviour across services.
One of the core privacy risks in digital identity systems is the creation of a global identifier, a single ID that every service receives, which can be used to track a person’s interactions across the internet. eIDAS 2.0 explicitly addresses this by requiring that the EUDI Wallet generates different pseudonymous identifiers for different relying parties. These pseudonyms are generated by the wallet and stored locally. Two services cannot determine that the same person used both of them, unless the user explicitly approves that linkage in the wallet. This does not eliminate all risk of tracking or profiling, but it removes a significant structural enabler of it.
This design principle reflects the broader philosophy of digital identity privacy embedded in the regulation. Users maintain meaningful control over their own data trail, and the wallet acts as a privacy-preserving intermediary.
Organisations that currently rely on shared identity tokens or centralised identity brokers should note that eIDAS 2.0 requires a rethink of how identity data flows through their systems. Sectors such as government services and financial services, where cross-referencing user data across platforms has been common, will need to adapt their architectures to align with these unlinkability requirements. It is also worth noting that governance of the EUDI Wallet is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts, while EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. No single central European authority operationally manages all EUDI Wallets.
What are the limits of privacy protection under eIDAS 2.0?
eIDAS 2.0 provides strong privacy protections by design, but it does not make identity transactions completely anonymous. Wallet issuers, which are typically government bodies or officially recognised providers operating under national supervision, have visibility into the attestations they issue. Relying parties still receive the attributes they request. And legal obligations such as AML and KYC can require disclosure that goes beyond minimal sharing.
It is worth being clear about what eIDAS 2.0 does and does not protect:
- It does not guarantee anonymity. Verified identity proofing inherently requires that someone knows who the user is at the point of issuance. The wallet issuer holds that knowledge.
- It does not override legal disclosure requirements. Regulated sectors such as banking and healthcare may be required by law to collect and retain specific identity data, regardless of what the wallet’s minimal disclosure settings allow.
- It depends on correct implementation. Privacy guarantees only hold if relying parties and wallet providers implement the technical standards correctly. A poorly integrated service could still request more data than necessary, and users may not always recognise when this happens.
- Device security matters. The privacy of wallet data depends in part on the security of the device on which the wallet is stored. A compromised device undermines privacy protections at the technical level.
Understanding these boundaries is important for organisations building compliance frameworks around eIDAS 2.0. Privacy-by-design is a genuine structural improvement, but it is not a blanket solution to all identity privacy challenges.
How should organisations prepare for privacy-by-design identity proofing?
Organisations should prepare for privacy-by-design identity proofing by auditing their current data collection practices, identifying where they collect more identity data than their processes actually require, and redesigning verification flows around verifiable attestations and selective disclosure. The shift from document-based to attribute-based identity verification is both a technical and a process change.
A practical preparation roadmap looks like this:
- Map your current identity data flows. Understand what personal data you collect during onboarding and verification, why you collect it, and what you actually use it for.
- Identify minimum viable data requirements. For each verification step, define the minimum set of attributes you need to meet your legal and operational obligations.
- Assess your systems for verifiable attestation readiness. Check whether your identity infrastructure can receive and validate attestations in EUDI Wallet-compatible formats such as SD-JWT VC or mdoc.
- Review your legal basis for data processing. Ensure your GDPR documentation reflects the shift to attribute-based data collection, including updated data retention policies. Note that approving a data request in the wallet is distinct from consent as a GDPR legal basis. Relying parties need their own legal basis for processing, which for KYC is typically a legal obligation under AML regulation.
- Engage with your sector’s regulatory guidance. Sectors such as financial services and healthcare may have specific guidance on how eIDAS 2.0 interacts with existing AML, KYC, or patient data regulations. National competent authorities in your jurisdiction are the appropriate starting point for understanding how implementing acts apply to your sector.
It is also important to understand the timeline realistically. The legal deadline for Member States to make wallet solutions available and for public sector bodies to accept notified wallets for online services requiring electronic identification is 24 December 2026. For relevant regulated private sector organisations, the acceptance obligation under Article 5f applies from 24 December 2027. This obligation covers sectors including banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros, are exempt. Very large online platforms are subject to a separate provision under Article 5f, which applies where the platform requires user authentication, on a voluntary basis at the user’s request and for the minimum necessary data.
These dates mark legal obligations, not predicted launch dates. Practical interoperability and national rollout are expected to develop in phases, and organisations should plan accordingly.
Organisations that treat this transition purely as a compliance exercise will miss the opportunity it represents. Privacy-preserving identity proofing reduces the data you hold, which reduces your risk exposure. It also removes friction for users, who no longer need to repeatedly prove the same things to different services.
How TrustTech supports privacy-preserving identity proofing
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of privacy-preserving identity proofing, the ID Connector handles several of the technical requirements that organisations face when moving to attribute-based verification:
- Verifying issuer signatures against the relevant national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL)
- Checking revocation status through issuer-provided status information
- Validating wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution
- Enforcing the registered attribute scope, so that only the attributes a relying party has registered under CIR (EU) 2025/848 are requested and processed
- Supporting selective disclosure and verifiable attestations in formats aligned with the EUDI Wallet architecture, including SD-JWT VC and mdoc
- Connecting identity proofing, qualification checks, and qualified digital signing through an integrated platform
TrustTech serves organisations in financial services, healthcare, pharma, and government that need to move from understanding eIDAS 2.0 to operating within it. If your organisation is ready to take that step, get in touch with TrustTech to discuss how privacy-preserving identity proofing can work for your specific context.