Digital identity wallets explained the EU wallet the UK plans and what comes next

[NatureBoy_Dev]

TL;DR

• A digital identity wallet is an app that stores verified credentials, such as identity documents, driving licences or qualifications, and lets you share only the details needed for a given purpose
• Under the revised eIDAS Regulation (EU) 2024/1183, every EU member state must offer at least one European Digital Identity Wallet by late December 2026, free to citizens and voluntary to use
• Public bodies must accept the wallets once notified, and many regulated private sector services, including banks and very large online platforms, are expected to follow by around the end of 2027
• The UK announced a national digital ID scheme in September 2025, dropped plans in January 2026 to make it mandatory for right to work checks, and launched a public consultation in March 2026
• Key debates concern privacy, security, inclusion and trust, and wallets will need crypto agility as signatures move to post quantum algorithms

Why digital identity is changing

Proving who you are online has long been awkward. People upload photos of passports, type in card numbers, answer security questions and create dozens of accounts with different providers. Each method leaks more information than necessary and creates copies of sensitive documents on servers that can be breached. Fraud, identity theft and friction are the results

Digital identity wallets aim to change that. Instead of handing over a full document, you hold verified digital credentials on your phone and share specific attributes, such as being over 18 or holding a valid driving licence, directly with a service. The service can check cryptographically that the credential is authentic and unaltered. Ideally, you reveal only what is needed and nothing more

This thread explains how digital identity wallets work, describes the EU's ambitious programme and the UK's evolving plans, and sets out the privacy, security and inclusion questions they raise. Digital identity is a politically sensitive topic, and views differ widely on how far governments should go. The aim here is to describe the facts and the main arguments fairly. Readers can form their own views

How digital identity wallets work

Three parties are involved. An issuer, such as a government agency, university or bank, creates a credential and signs it digitally. A holder, the person, stores the credential in a wallet app on their device. A verifier, such as a website, shop or employer, requests proof and checks the issuer's signature to confirm the credential is authentic

Selective disclosure is a central feature. Rather than sharing a whole credential, the holder can reveal only specific attributes, such as date of birth or nationality. Some systems support proofs that reveal even less, for example confirming that someone is over 18 without revealing their exact age. Techniques such as salted hashes and zero knowledge proofs make this possible

Standards underpin interoperability. The ISO/IEC 18013-5 standard defines mobile driving licences, the W3C Verifiable Credentials data model provides a general format for digital credentials, reaching version 2.0 as a W3C Recommendation in 2025, and OpenID for Verifiable Credentials specifications define how wallets and services exchange credentials. Formats such as SD-JWT support selective disclosure. Using common standards lets wallets and verifiers from different providers work together

Security relies on cryptography and device protection. Credentials are bound to keys stored in secure hardware on the device, and the wallet is unlocked with a PIN or biometric. Verifiers check both the issuer's signature and proof that the credential is held by the right device. If a phone is lost, credentials can be revoked and reissued

Revocation and status checking deserve attention. Verifiers need to know whether a credential has been revoked, for example after a licence suspension or a lost phone, without the issuer learning every place the credential is used. Status lists and similar techniques aim to balance these needs. Getting revocation right is essential for trust

The EU Digital Identity Wallet

The European Union has set out the most ambitious programme. The revised eIDAS Regulation, Regulation (EU) 2024/1183, entered into force on 20 May 2024 and established the European Digital Identity framework. It requires each member state to provide at least one European Digital Identity Wallet to citizens and residents, with the deadline falling in late December 2026, two years after key implementing acts were adopted. Wallets must be free for individuals and voluntary to use

The wallets are designed to hold personal identification data plus other credentials, known as electronic attestations of attributes, such as driving licences, diplomas, professional qualifications, health insurance cards and bank account details. Users should be able to sign documents with qualified electronic signatures free of charge for non professional use. The regulation includes privacy safeguards, such as preventing wallet providers from tracking how wallets are used and giving users a dashboard of transactions. Wallet components must be certified and source code for user facing components published as open source, with limited exceptions

Acceptance obligations extend beyond government. Public sector services that require identification must accept notified wallets. Private sector services that are legally required to use strong user authentication, including banking, telecommunications, transport, energy, health and education, along with very large online platforms designated under the Digital Services Act, must accept wallets when users request it, with most such obligations expected to apply from around the end of 2027. This combination aims to make wallets widely useful

Preparation has involved large scale pilots run from 2023 involving hundreds of organisations across member states, testing uses such as opening bank accounts, travelling, accessing health services and proving qualifications. The European Commission published an architecture and reference framework and a reference wallet implementation. Some member states have moved early, with Italy running its IT-Wallet in public beta since October 2024. Analysts have suggested that not every member state may have a notified wallet ready by the December 2026 deadline

Age verification has emerged as an early use. In 2025, the European Commission piloted an age verification app blueprint in several member states, designed to let users prove they are over a threshold age without revealing other personal data. It is intended to be compatible with future EU wallets. This reflects growing regulatory interest in protecting minors online

The UK's approach

The UK has taken a different path. It has built a digital identity and attributes trust framework that certifies private sector identity providers, and the Data (Use and Access) Act 2025 placed digital verification services on a statutory footing. Many people already use certified apps to prove their identity for right to work checks, rental checks and some financial services. GOV.UK One Login provides a single sign in for many government services

In January 2025, the government announced GOV.UK Wallet, an app to hold government issued digital credentials, starting with a digital veteran card and planning a digital driving licence. In September 2025, the government announced plans for a national digital ID, initially proposed as mandatory for proving the right to work by the end of the parliament. In January 2026, it dropped the plan to make digital ID mandatory for right to work checks, saying digital ID would be one option among others while digital right to work checks remained a commitment. A public consultation on the scheme launched in March 2026

Views on the UK scheme are divided. Supporters argue a national digital ID could reduce fraud, simplify access to public services and help enforce employment rules. Critics, including civil liberties groups, raise concerns about privacy, surveillance, cybersecurity, cost and exclusion of people without smartphones. The consultation and subsequent legislation will shape the final design

Elsewhere in the world

Other countries are developing digital identity in different ways. In the United States, many states issue mobile driving licences based on ISO/IEC 18013-5, and the Transportation Security Administration accepts them at a growing number of airports. Apple and Google wallets can store state IDs in participating states. There is no national identity card, and approaches vary by state

Countries such as Estonia have operated national digital identity systems for decades, enabling online voting, digital signatures and access to most public services. India's Aadhaar programme provides biometric identity numbers to over a billion people, supporting welfare payments and banking. These systems show both the benefits of digital identity and the importance of strong safeguards. Debates over Aadhaar's privacy implications reached India's Supreme Court

Privacy and security considerations

Privacy depends on design choices. Selective disclosure, minimal data sharing and preventing issuers and wallet providers from learning where credentials are used all protect users. Unlinkability, making it hard to connect a person's activity across different services, is an important goal that some cryptographic approaches support better than others. Researchers have urged that wallets avoid creating new tracking possibilities

Security challenges include protecting devices, keys and back end systems. If attackers compromise an issuer's signing keys, they could create fraudulent credentials. If they compromise a device, they might misuse credentials until revoked. Phishing style attacks, where fake verifiers request credentials, require careful user interfaces and verifier authentication

Inclusion matters too. Not everyone has a modern smartphone, reliable internet access or the skills and confidence to use digital tools. Most frameworks keep physical documents and offline alternatives available. Voluntary use and accessible design help prevent digital identity from excluding vulnerable people

Governance and oversight complete the picture. Independent supervision, clear rules on data use, transparency reports and routes for complaints help ensure systems serve citizens rather than surveil them. The EU framework assigns supervisory bodies in each member state. Public trust depends on visible accountability

The post quantum dimension

Digital credentials depend on digital signatures, today mostly elliptic curve schemes such as ECDSA. Some credentials, such as identity documents and qualifications, remain valid for many years. As quantum computers advance, signatures that are vulnerable to Shor's algorithm will need replacing, and the EU's post quantum roadmap expects high risk use cases to be protected by the end of 2030. Digital identity infrastructure will almost certainly fall within its scope

Crypto agility is therefore essential. Wallet architectures, standards and issuers must be able to move to post quantum signatures such as ML-DSA, and verifiers must be able to check them. Device secure elements need to support new algorithms, or credentials need to be reissued as devices change. Building that agility now is far easier than retrofitting it later

What to watch

• How many EU member states notify wallets by the December 2026 deadline
• Private sector acceptance of EU wallets from around the end of 2027
• The outcome of the UK digital ID consultation and any legislation
• Adoption of age verification tools compatible with digital identity wallets
• Privacy preserving cryptography such as zero knowledge proofs in production wallets
• Post quantum migration plans for credential signatures and secure elements

Closing thoughts

Digital identity wallets could make proving who we are online simpler, safer and more private, replacing document uploads with cryptographically verified, minimal disclosures. The EU's programme is the most ambitious, with a legal deadline in late 2026 and wide acceptance obligations to follow. The UK is shaping its own approach through consultation, amid lively debate. Design choices on privacy, security, inclusion and crypto agility will determine whether these systems earn public trust

Please share your experiences with digital identity apps and your views on the policy questions in the replies. Respectful disagreement is welcome on a topic where reasonable people differ. Links to official documents will help keep the discussion accurate


Key references for citation

• Regulation (EU) 2024/1183 amending the eIDAS Regulation, entered into force 20 May 2024
• European Commission, European Digital Identity Wallet Architecture and Reference Framework
• UK Government, GOV.UK Wallet announcement, January 2025; national digital ID consultation, March 2026
• UK Data (Use and Access) Act 2025
• ISO/IEC 18013-5 mobile driving licence standard; W3C Verifiable Credentials Data Model 2.0, 2025