What are the eIDAS 2.0 obligations for very large online platforms?

Under eIDAS 2.0, Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014, very large online platforms (VLOPs) are required to accept the European Digital Identity Wallet as a means of user authentication. This obligation applies specifically to platforms designated as VLOPs under the EU’s Digital Services Act, and it represents one of the most significant new requirements introduced by the updated regulation. Below, this article walks through exactly what that means, who it affects, and what your organization needs to do about it.

Which platforms are classified as very large online platforms under eIDAS 2.0?

Very large online platforms under eIDAS 2.0 are platforms that have been formally designated as VLOPs under the EU Digital Services Act (DSA). The DSA defines a VLOP as an online platform with at least 45 million average monthly active users in the EU. The European Commission is responsible for making these designations, and the list includes major social media networks, search engines, and app stores operating at scale across Europe.

Examples of platforms that have received VLOP designation include services such as Facebook, Instagram, TikTok, YouTube, LinkedIn, X (formerly Twitter), and Google Search, among others. VLOP status is not self-declared. It is assigned by the Commission based on user data, and once designated, a platform must comply with the obligations that flow from both the DSA and eIDAS 2.0.

For organizations wondering whether they fall into this category, the starting point is the DSA designation process. If your platform has not been formally designated as a VLOP, the specific eIDAS 2.0 VLOP obligations do not currently apply to you, though broader eIDAS 2.0 requirements may still be relevant depending on your sector and services.

What specific obligations does eIDAS 2.0 impose on very large online platforms?

The core obligation eIDAS 2.0 places on very large online platforms is set out in Article 5f. VLOPs must accept the EUDI Wallet for user authentication where the user voluntarily requests it and only for the minimum data necessary for the service. This means platforms cannot restrict users to proprietary login systems or third-party social sign-in options alone. The VLOP obligation applies wherever the platform requires user authentication, and it is distinct from the obligation that applies to regulated private-sector relying parties, which is tied to contexts where strong user authentication is required by law or contract.

More specifically, this obligation covers the following areas:

• Wallet acceptance: VLOPs must technically support authentication via the EUDI Wallet, enabling users to prove their identity using wallet-stored credentials.
• Selective disclosure: The integration must respect the wallet’s privacy-by-design principles, meaning platforms can only request the data attributes that are strictly necessary for the service.
• Non-discrimination: Platforms cannot treat users who authenticate via the EUDI Wallet less favorably than users who authenticate through other methods.
• Interoperability: The technical implementation must align with the standards and specifications defined in the eIDAS 2.0 framework, the implementing acts adopted by the European Commission, and the Architecture and Reference Framework (ARF), which provides the technical elaboration of those legally binding requirements.

These obligations are designed to shift control back to users. Users can authenticate with a verified, government-issued digital identity and share only what is needed for the specific interaction, without being required to create additional accounts or disclose more personal data than necessary.

Why must very large online platforms accept the EUDI Wallet?

Very large online platforms must accept the EUDI Wallet because they represent the access points where the vast majority of Europeans interact with digital services. Without an obligation on these dominant platforms, the EUDI Wallet would risk becoming a niche tool used only in public sector contexts, undermining the EU’s goal of creating a genuinely interoperable digital identity ecosystem across both public and private sectors.

The reasoning behind singling out VLOPs is straightforward. These platforms have the market power to set de facto standards for how identity and authentication work online. If they are not required to accept the wallet, they have little commercial incentive to do so, and users would continue to rely on fragmented, privacy-invasive login methods. By mandating wallet acceptance at this level, eIDAS 2.0 creates the critical mass needed to make the EUDI Wallet a practical reality for everyday digital life.

There is also a data minimization dimension to this requirement. Many large platforms currently collect far more personal data during login and onboarding than is strictly necessary. The EUDI Wallet’s selective disclosure mechanism gives users the ability to share, for example, proof that they are over 18 without revealing their full name or date of birth. This works through selective disclosure of individual attributes and does not require zero-knowledge proofs. The VLOP obligation accelerates the adoption of this more privacy-respecting approach at scale. For organizations in regulated sectors such as financial services or government, this shift also aligns with existing data protection obligations under GDPR.

What is the compliance timeline for very large online platforms?

The Article 5f obligation for VLOPs is tied to the deadline of 24 December 2027, by which point the relevant private-sector relying parties, including VLOPs, must accept notified EUDI Wallets where the conditions of that article are met. Separately, 24 December 2026 is the deadline by which Member States must make EUDI Wallets available and by which public-sector bodies must accept notified wallets for online services requiring electronic identification. These are legal deadlines, not predicted launch dates.

It is important to understand that compliance does not arrive as a single event across all of Europe. There are several distinct stages: the legal deadlines themselves, the actual availability of each national wallet, its certification and notification under the eIDAS 2.0 framework, the achievement of operational interoperability, and acceptance by relying parties such as VLOPs. Each of these stages may occur at different times in different Member States.

This means VLOPs need to plan for a phased rollout of compliance across different national markets. Organizations that have not yet begun their technical and legal preparation should act now. Starting the integration process early gives platforms the runway they need to test, iterate, and align with the evolving technical specifications as national wallets come online.

What happens if a very large online platform fails to comply with eIDAS 2.0?

If a very large online platform fails to comply with its eIDAS 2.0 obligations, it faces enforcement action under the regulatory framework. Enforcement sits with national supervisory authorities and national competent authorities in each Member State, and non-compliance can result in significant financial penalties. Given that VLOPs are already under heightened scrutiny from both the DSA and GDPR enforcement bodies, non-compliance is a high-visibility risk.

Beyond financial penalties, there are broader reputational and operational risks to consider. VLOPs that fail to support the EUDI Wallet may find themselves unable to serve users who choose to authenticate via their wallet, effectively excluding a growing segment of the European user base. As wallet adoption increases, this exclusion becomes an increasingly significant commercial disadvantage.

There is also a compounding risk for platforms operating across multiple regulated sectors. A VLOP that also provides services in areas such as healthcare or finance may face overlapping regulatory scrutiny from sector-specific supervisors in addition to the eIDAS 2.0 enforcement framework. Non-compliance in one area can draw attention to compliance gaps in others.

How should very large online platforms prepare for eIDAS 2.0 compliance?

Very large online platforms should prepare for eIDAS 2.0 compliance by starting with a gap analysis of their current authentication infrastructure against the technical requirements for EUDI Wallet integration. This means reviewing existing identity and access management systems, understanding the OID4VP and SD-JWT VC standards that underpin wallet-based authentication, and identifying where changes are needed in user flows, data handling, and backend systems.

A structured preparation approach typically involves the following steps:

1. Map your current authentication landscape: Document all existing login and identity verification methods across your platform and identify which user journeys will be affected by the wallet obligation.
2. Review the Architecture and Reference Framework (ARF) and the implementing acts: The implementing acts adopted by the European Commission contain the legally binding requirements for EUDI Wallet interoperability. The ARF provides the technical elaboration of those requirements. Understanding both is essential before any integration work begins.
3. Review the large-scale pilot findings: The EU ran four large-scale pilot programs from April 2023 to 2025, testing the EUDI Wallet across real-world scenarios. These covered areas including government services, mobile driving licences, qualified remote signing, payments, education, and social security. The findings from these pilots are publicly available and provide practical guidance on what integration looks like in practice. A second wave of pilots started in 2025, covering business wallets, payments, travel, ticketing, and vehicle registration.
4. Assess legal and compliance implications: Wallet acceptance has implications for your privacy policy, data processing agreements, and GDPR compliance. Legal and compliance teams need to be involved early. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of their Member State of establishment before requesting wallet data. Registration is per intended use and specifies which attributes and attestations will be requested. The wallet checks requests against this registered scope.
5. Plan for phased rollout: Since national wallets will reach certification, notification, and operational readiness at different times, build a country-by-country implementation plan.
6. Test and iterate: Integration with a new identity standard requires thorough testing. Build in time for user testing, security review, and technical validation before going live.

Organizations that approach this as a strategic opportunity will be better positioned. Supporting the EUDI Wallet can reduce onboarding friction, improve data quality, and build user trust, all of which have measurable business value beyond regulatory compliance. Exploring the available resources on digital identity implementation can help teams get up to speed quickly.

How the ID Connector supports eIDAS 2.0 compliance for very large online platforms

The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

For VLOPs preparing for the Article 5f obligation, the ID Connector addresses the core technical and compliance requirements directly:

• Wallet acceptance across Member States: The ID Connector handles acceptance of every notified EUDI Wallet, regardless of the issuing Member State or wallet provider. A relying party does not choose a wallet provider; it must accept every relevant notified wallet, and the ID Connector is built around that requirement.
• Verification against trusted lists: Presented credentials are verified against the relevant national trusted lists, which are aggregated in the EU List of Trusted Lists (LOTL). This covers issuer signature verification, revocation status checks, and validation of the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution.
• Registered attribute scope enforcement: The ID Connector enforces the attribute scope registered under CIR (EU) 2025/848, so that only the attributes and attestations declared in the relying party’s registration are requested from the wallet.
• Selective disclosure support: The integration supports selective disclosure of individual attributes, enabling use cases such as age verification without exposing the user’s full date of birth or name.
• Qualified signing: Where a use case requires a qualified electronic signature, the ID Connector connects to an accredited QTSP. TrustTech does not itself issue qualified electronic signatures.
• Reusable identity infrastructure: Identity verification and authentication flows built on the ID Connector work across onboarding, qualification, and signing, avoiding duplicate integration work as requirements evolve.

The ID Connector is relevant across the sectors where eIDAS 2.0 intersects with additional regulatory requirements, including financial services, healthcare, pharma, and government. For VLOPs facing the 24 December 2027 compliance deadline under Article 5f, starting integration work now provides the time needed to test against national wallets as they come online and to align with the implementing acts as they are finalized. Contact TrustTech to discuss your eIDAS 2.0 integration requirements and next steps.