How does eIDAS 2.0 support age verification online?

eIDAS 2.0, which amends Regulation (EU) 910/2014, supports online age verification by enabling users to share a verified age attribute directly from their European Digital Identity (EUDI) Wallet through selective disclosure, without revealing their full date of birth or any other personal data. This makes age checks faster, more privacy-respecting, and legally reliable across all EU member states. The sections below explain exactly how this works, which sectors benefit most, and what organizations need to do to prepare.

What changes does eIDAS 2.0 bring to online age verification?

eIDAS 2.0 introduces a standardized, legally recognized way to verify age online across the European Union. Users can present a verified age attribute from their EUDI Wallet that carries the same legal weight as a government-issued document. This is a fundamental shift from fragmented, unreliable age checks to a single, trusted framework.

Under the original Regulation (EU) 910/2014, member states could notify their national electronic ID schemes for cross-border recognition, but there was no obligation to do so. This led to a patchwork of solutions that rarely worked well outside their home country. eIDAS 2.0 closes that gap by requiring every EU member state to make an EUDI Wallet available to all citizens, residents, and businesses by 24 December 2026. Age verification is one of the core use cases built into this infrastructure from the start. That legal deadline is an outer limit, not a predicted launch date. Not every national wallet will have reached the same level of maturity on that date, and not every cross-border use case will be fully operational throughout Europe immediately. Practical interoperability and national rollout are expected to develop in phases, and organizations should plan accordingly.

The practical result is that online services across the EU can rely on a consistent, interoperable method for online age verification. Instead of building separate verification flows for each country, organizations can accept a single wallet-based age credential that is designed to work across Europe, with the understanding that availability and maturity will vary by member state during the rollout period.

How does the EUDI Wallet prove age without sharing personal data?

The EUDI Wallet proves age by releasing a selective disclosure, meaning it shares only the specific attribute a service needs, such as “user is 18 or older,” without revealing the underlying date of birth or any other personal information. Selective disclosure of an age attribute of this kind does not require zero-knowledge proofs. The wallet architecture uses cryptographic techniques that allow it to generate a tamper-evident proof without exposing raw data.

When you buy a cinema ticket for an 18-rated film, the service does not need to know your exact birthday, your name, or where you live. It only needs to know that you meet the age requirement. The EUDI Wallet makes exactly that kind of minimal disclosure possible, and the receiving service gets a cryptographically signed confirmation that the attribute is genuine and issued by a trusted authority.

Selective disclosure and minimal data sharing are core design principles of the EUDI Wallet. Users stay in control of what they share and with whom, approving each individual presentation request in the wallet. The wallet does not transmit more than what is strictly necessary for the transaction. This directly supports GDPR principles of data minimisation and purpose limitation, making compliance easier for the organizations that accept these credentials. Organizations still need a valid legal basis under the GDPR for processing the data they receive, and approving a request in the wallet is distinct from giving consent as a GDPR legal basis.

Which sectors and use cases benefit most from eIDAS 2.0 age verification?

Several sectors stand to gain significantly from standardized eIDAS age verification, particularly those that currently rely on manual, inconsistent, or easily bypassed age checks. The combination of legal reliability, privacy protection, and cross-border interoperability makes this a compelling solution for a wide range of industries. Cross-border interoperability operates at the framework level: a certified wallet from one member state is designed to work with a registered relying party in another member state, but national registration requirements under CIR (EU) 2025/848 and sector-specific legislation still apply in each jurisdiction.

• Online retail and entertainment: Streaming platforms, gaming services, and online shops selling age-restricted goods such as alcohol or tobacco can replace self-declaration with a verified, legally recognized age attribute.
• Financial services: Banks and insurers that need to confirm a customer meets minimum age requirements for certain products can integrate wallet-based age checks into their digital onboarding flows without collecting unnecessary data.
• Healthcare: Platforms offering services that differ by age, such as consent for medical procedures or access to specific health information, can use EUDI Wallet credentials to confirm eligibility securely.
• Government services: Public sector portals that restrict certain services to adults, such as voting tools or legal applications, benefit from a standardized and legally sound verification method.
• Education and social platforms: Schools, universities, and social networks required by regulation to verify user age can do so without building or maintaining their own identity infrastructure.

The four Large Scale Pilots that ran from April 2023 to 2025 tested age verification as part of broader EUDI Wallet use cases. The DC4EU consortium covered education and social security use cases, while POTENTIAL tested government services and related scenarios. The insights from those completed pilots have shaped the implementation guidelines, giving organizations a clearer picture of what to expect.

How does eIDAS 2.0 age verification compare to existing methods?

eIDAS 2.0 age verification is significantly more reliable, privacy-friendly, and legally robust than most existing methods. Current approaches range from simple self-declaration tick boxes to credit card checks and document uploads, each with clear weaknesses. eIDAS 2.0 replaces these with a tamper-evident, user-controlled credential that is recognized across the EU.

Here is how the main methods compare:

1. Self-declaration: The user simply clicks “I am 18 or older.” There is no verification at all. It is easy to bypass and carries no legal weight.
2. Credit card checks: Assumes that having a card implies adulthood. This is unreliable, excludes many legitimate users, and shares financial data unnecessarily.
3. Document upload: More reliable, but creates friction, requires storing sensitive data, and raises significant privacy and security concerns for the organization handling it.
4. National eID systems: More trustworthy, but limited to users in a specific country and not consistently available across the EU.
5. EUDI Wallet (eIDAS 2.0): Cryptographically signed, privacy-preserving, cross-border by design, legally recognized across the EU, and fully under user control.

The key advantage of the eIDAS 2.0 approach is that it removes the trade-off between security and privacy. Organizations no longer need to collect and store sensitive personal data to confirm a user’s age. The verification happens at the wallet level, and only the result, a confirmed attribute, reaches the service provider.

Verifying a wallet-based age credential involves more than one step. A relying party checks the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). It also checks the revocation status of the attestation using the issuer’s status information, and it validates the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Only the signature check against the trusted list can be performed fully offline. The revocation and wallet unit attestation checks require a connection.

What do organizations need to do to accept eIDAS 2.0 age credentials?

To accept eIDAS 2.0 age credentials, organizations need to register as a relying party under CIR (EU) 2025/848, adopted on 6 May 2025, with the national authority of their member state of establishment before they can request wallet data. As part of that registration, a relying party declares the intended use and specifies which attributes and attestations it will request. The wallet checks incoming requests against this registered scope. Organizations operating across multiple member states need to account for national registration requirements in each jurisdiction alongside the EU-level framework.

The steps involved require deliberate preparation. Organizations that start now will be better positioned as wallet rollout progresses toward and beyond the 24 December 2026 legal deadline for public sector acceptance. For relevant regulated private sectors, the obligation under Article 5f of eIDAS 2.0 applies from 24 December 2027. Micro and small enterprises, meaning those with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from that private sector obligation. Key actions include:

• Understanding the relying party requirements under eIDAS 2.0 and CIR (EU) 2025/848, including national registration obligations and the requirement to declare the intended use and attribute scope before requesting wallet data.
• Reviewing current age verification flows to identify where wallet-based attributes can replace existing checks.
• Ensuring that internal systems can handle selective disclosure attributes and do not inadvertently request or store more data than is registered and necessary.
• Aligning with GDPR requirements around data minimisation, since the wallet architecture is designed to support this but organizations still need to configure their processes accordingly and maintain a valid legal basis for processing.
• Monitoring legally binding requirements set out in implementing acts adopted by the European Commission, as well as guidance from national competent authorities, as technical specifications continue to be finalized.

For organizations in regulated sectors, this preparation also intersects with broader compliance obligations such as AML, KYC, and sector-specific rules. Integrating eIDAS 2.0 readiness into an existing compliance roadmap is more efficient than treating it as a separate project.

How TrustTech supports eIDAS 2.0 age verification

Implementing eIDAS 2.0 age verification touches compliance frameworks, user experience, and organizational readiness across the board. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

For age verification specifically, the ID Connector handles the verification steps that a relying party needs to perform: checking the issuer’s signature against the relevant national trusted list, validating the revocation status of the age attestation, and confirming the wallet unit attestation of the presenting wallet. It also monitors the registered attribute scope so that requests stay within what the relying party has declared to the national authority. This is relevant for organizations in financial services, healthcare, pharma, and government, where the combination of legal reliability and data minimisation is central to compliance.

If your organization is preparing for eIDAS 2.0 and wants to understand what wallet-based age verification means in practice, get in touch with TrustTech to discuss the right next steps for your situation.