Germany has taken another step toward rolling out its own version of the EU Digital Identity Wallet after the Bundestag passed the Digital Identities Act (DIdG) on Thursday. The revised legislation provides the legal framework needed to establish digital identity credentials in the country, following modifications made by the governing coalition to address concerns raised by opposition parties.
The federal government intends to launch the d-you wallet on January 2, 2027. Among the legislative changes is a requirement to make all credentials available within a year of launch. However, the Act lacks an enforcement mechanism for the issuance of "electronic attribute attestations," and unfinalized EU specifications for technical implementation mean the wallet will not fully meet EUDI Wallet requirements when it goes live, according to reporting by Heise.
Technical specialists had already described Germany's planned digital ID wallet as a "Minimalkonstrukt" in August. The revised Act now permits individuals to decide whether to include a facial photograph as part of their credentials. A Greens opposition representative characterized this change as an improvement, though some observers have cautioned that making biometrics optional could fragment the wallet ecosystem. The same representative objected to the absence of pseudonymous functionality in the digital ID system.
An AfD opposition lawmaker contended that the EUDI Wallet represents an authoritarian surveillance initiative, pointing to experiences in neighboring Austria as evidence that the digital ID would become practically mandatory for citizens.
Security architecture and device compatibility raise alarm
A Digital Affairs Committee hearing last week surfaced fresh concerns about the wallet's current design and future development trajectory. Officials from the Federal Commission for Data Protection reiterated criticism about the missing pseudonymous option, while experts highlighted that Germany's approach relies on a highly centralized model compared to other EU member states.
Committee-invited specialists identified fraud risks stemming from unpublished sections of the wallet's security architecture and the prevalence of older devices in circulation. They emphasized the need for explicit liability rules and questioned whether existing safeguards adequately prevent organizations from aggregating individual transactions to monitor user behavior.
Thomas Lohninger of Epicenter.works recommended that Germany adopt the licensing authority model used in other EU countries, where service providers must obtain approval for their usage scenarios before accessing user data, thereby blocking malicious actors from querying personal information.
Torsten Lodderstedt, managing director at d-you operator Common Codes and former head of the German Wallet Project at SPRIND, countered that limited disclosure capabilities—such as age verification—serve a critical pseudonymity function. He also stated that integrating a built-in mechanism for users to report suspected data misuse directly through the app is not feasible at the present stage.
The widespread use of older phones influenced Germany's Federal Office for Information Security (BSI) to position a cloud security anchor as the processing location for cryptographic proofs and data presentations.
