EU's Digital ID Wallet Deadline Hits Reality: 24 of 27 Countries Won't Make It, and the Privacy Rules Are Still Being Written

The European Union set a hard deadline: every one of its 27 member states must offer citizens a European Digital Identity Wallet by December 24, 2026. That's the law under Regulation (EU) 2024/1183, which amends the older eIDAS framework, according to lawandtechnology.eu. The wallet is supposed to hold your national ID, driver's license, diplomas, medical prescriptions and more, all in one smartphone app that works across every EU country.

According to Brussels Signal, 24 of the 27 member states haven't made a wallet available to citizens and are expected to miss that deadline. Italy is the lone success story, with almost eight million people using its wallet monthly. Germany isn't launching until January 2, 2027, nine days late. The Netherlands pushed its rollout to late 2027 after a pilot program attracted a grand total of 57 users. Bulgaria is still drafting the legislation it needs just to issue a wallet at all.

The technical rulebook isn't finished either

The substance side presents another challenge. Thomas Lohninger, executive director of the Austrian digital rights group epicenter.works and a board member of European Digital Rights (EDRi), told Euronews that only 50 to 60 percent of the technical standards needed to build a secure wallet actually exist. "The other 40% are not there yet," he said. "They do not exist."

The European Commission has been publishing implementing regulations in waves: five in December 2024, four more in May 2025, and updated technical specifications as recently as July 2026, according to lawandtechnology.eu. The rulebook for a system with a hard legal deadline is still being written months before that deadline hits.

Lohninger's core worry is straightforward. Putting a person's ID, driver's license, health records and financial credentials into one app creates a single point of failure. "If you put all your eggs in one basket, then that basket hopefully never fails," he said. Unlike a leaked password, a compromised digital credential carries a cryptographic signature of state authenticity, meaning a breach doesn't just expose data—it hands over something that can be misused as genuine.

Who's watering down the privacy protections?

The regulation's answer to that risk is a trio of safeguards: selective disclosure, unlinkability, and issuer blindness. Together they're supposed to mean a shop checking your age learns nothing else about you, and the government that issued the wallet can't see where you've used it.

EDRi and epicenter.works allege that the European Commission is weakening those protections through implementing acts, drafted outside the normal legislative process and outside the scrutiny that comes with it, according to Brussels Signal. Their claim: the current text now requires only that revocation mechanisms "hinder" linkability rather than prevent it, and a facial image has been added to the minimum data set every wallet must carry. Member states settled part of that dispute at a eIDAS committee meeting on June 18, agreeing national authorities may make the facial photo optional. Campaigners counter that nothing actually obliges any country to do so.

These are allegations from named advocacy groups, not findings from a court or regulator, and no response from the European Commission appears in the available reporting. The European Data Protection Supervisor, for its part, has publicly backed the selective-disclosure model as "authorization without identification" and points to secure hardware elements as a real safeguard against theft, per Euronews.

The strongest case for the wallet, and the strongest worry against it

Proponents have a real argument. Europe Says notes the wallet is meant to fix a genuine headache: opening a bank account, renting a car, or enrolling in university abroad currently means navigating separate national paperwork systems. A single EU-standard credential could make that faster and cheaper, and selective disclosure beats a physical ID card that reveals your full name and address just to prove you're over 18.

But Streamline Feed flags a fair counter-concern: online identity verification today is slow and expensive because of anti-money-laundering rules, and that friction is part of what preserves anonymity online. A wallet that makes verification instant and nearly free could hand private companies a powerful incentive to strip away that anonymity altogether, using the same credential for everything from tax filings to age checks. That's a real trade-off, not a fabricated one, and it's exactly the kind of mission creep critics of centralized government systems warn about.

Under the Digital Services Act's acceptance rules, very large online platforms, banks and telecom providers will be required to accept the wallet once it's rolled out, according to Biometric Update. Separately, an EU-funded research effort called TrustED, backed under Horizon Europe grant 101168467, is testing privacy-preserving identity tech that could eventually feed into this system, but it's a research project, not a deployed fix.

The deadline is December 24, 2026. Twenty-four capitals will miss it. The safeguards meant to keep this from becoming a tracking system are still being negotiated in a technical committee rather than the European Parliament. What happens legally and politically when the deadline passes with three-quarters of the bloc non-compliant is a question none of the current reporting answers.