Digital Identity: What It Is and Who Controls It

Most people picture a password when they think of their digital identity. The login that stands between them and their inbox each morning. That is not wrong, but it falls far short. Your digital identity is the sum of every marker by which a computer, an authority or a corporation recognises you as one specific person, and it runs from your email address all the way to a state app that carries your ID card in data form.

The term is gaining new weight right now, because Europe is in the middle of formalising it. By the end of 2026 every EU country must offer its citizens a digital wallet, the EUDI wallet. This piece sorts out what digital identity actually means, what changes with the wallet, whether you have to use it, and how you keep control.

Two meanings that keep getting mixed up

When people talk about digital identity, they usually mean two different things, and confusing them causes a lot of muddle.

The first is your everyday digital identity. It consists of every account you have ever created, your usernames, your credentials, and the traces you leave while browsing. Nobody assigned it to you, it grew over years, scattered across dozens of services, and that is exactly where its risk lies. Anyone who wants to know how much of it sits out in the open will find a good starting point in our piece on digital traces.

The second is your official digital identity, the state-confirmed proof that you are the person you claim to be. In Germany this function has lived in the ID card since 2010, as the so-called eID. With it you can log in to public offices online, without posting a letter or turning up in person. The technology is old, uptake stayed thin for a long time, because card readers, software and government portals rarely worked together smoothly.

The EUDI wallet picks up both threads. It is meant to lift the official identity out of the card and into an app, while extending it with things that used to lie around loose: driving licence, diplomas, insurance records. That pulls it closer to the everyday identity than many people realise.

How the eID already works today

Before the wallet arrives, it is worth looking at what already sits in many wallets. Every German ID card issued since 2010 carries a chip with an online identification function. Switch it on, and you can prove who you are to authorities and some companies without leaving the house. You hold the card to a reader or an NFC-capable phone, enter a six-digit PIN, and the other side receives exactly the details released for that particular process.

The procedure is built to be remarkably data-thrifty. The card transmits only the fields a service has requested and that you confirm, and the rest stays on the chip. Even so, uptake stayed low for years, and the reasons are instructive. Many did not know the function existed, others never had it activated when the card was issued, and still others gave up on readers and portals that would not quite cooperate. These are precisely the hurdles the wallet wants to remove, by making the reader unnecessary and moving the whole thing into an app that most people already find familiar.

What the EUDI wallet is and when it arrives

Behind the clunky acronym sits the European Digital Identity Wallet, a smartphone app. Its basis is the eIDAS 2.0 regulation, which came into force in April 2024 and obliges all 27 member states to provide such a wallet, free of charge, by the end of 2026. Germany is building its own state variant, whose source code is meant to be publicly visible so that experts can audit the security independently.

The idea behind it is a single trustworthy place for every proof. Instead of uploading copies of your ID or filling out forms at every sign-up, you show the other side a digitally signed attribute they can verify cryptographically. At its core the wallet works with two kinds of data: the person identification data from the ID, and the electronic attestations of attributes, meaning individual proofs such as an age check or a driving entitlement.

One technically appealing part is selective disclosure. It is meant to let you reveal only what a situation truly needs. At the till of a corner shop you would no longer hand over your whole ID to prove you are over eighteen, but only the single statement: yes, of age. Date of birth, name and address would stay hidden. On paper that is a genuine privacy gain, provided the implementation lives up to the concept.

Does digital identity become mandatory?

That is the question on most people’s minds, and the answer has two sides.

For you as a citizen, use stays voluntary. The eIDAS regulation creates no obligation to install or use the wallet. You can ignore it, run your official business the analogue way, or keep using the eID in your ID card. It is free on top of that, so there is no compulsion to buy anything.

The obligation lies on the other side of the counter. Certain providers will have to accept the wallet when you want to present it, among them banks, telecoms companies and large online platforms, as well as public bodies. These acceptance duties kick in gradually, the first ones already around the end of 2026, further ones in the years after. For you that means an extra tool that opens many doors, but nobody forces you to walk through them.

A glance at Estonia

Anyone wanting to understand where this could lead should look to Estonia. The small Baltic state has digitised its administration consistently since the late nineties and is now held up as a model. Almost every dealing with the state runs online, from the tax return to founding a company, and at the centre stands a state digital identity that every Estonian holds.

The Estonian model shows both faces of the matter. On one side it saves an enormous amount of time and paper, because a secured identity serves as the foundation for hundreds of services. On the other it demands great trust in the state and in the technology behind it, because whoever controls the central identity controls access to almost everything. Estonia meets this with a decentralised data exchange, where authorities query data only when needed rather than pooling it in one big pot, and with every citizen’s right to see who accessed their data and when. That traceability is the real lesson for Europe.

The criticism you should know

As appealing as the concept sounds, the German implementation stands under criticism. Experts have warned in hearings against a rushed rollout and raised doubts about data protection and transparency. The gist of the objection is that central security questions are still open while the timetable is already pressing.

Three points come up again and again. First, the bundling: if ID, driving licence and health records sit in one app, that app becomes a rewarding target. Second, the architecture, whose security level differs between member states, because each country sets parts of it itself. Third, the linkability, the worry that many individual wallet transactions could still be assembled into a movement profile, even though selective disclosure is meant to prevent exactly that. Consumer advocates also point out that users themselves become a weak spot when they release data carelessly.

These objections are no reason to panic, but a reason to stay watchful. A technology that replaces the ID card has to be measured against a higher standard than an ordinary app.

Protecting your digital identity, in practice

Whether or not you use the wallet, you have a digital identity, and it deserves care. The overview below sorts the main fronts and what helps on each.

The most effective lever is unspectacular: data thrift. Every detail you do not hand over cannot be used against you later. Before you release an attribute anywhere, it is worth the brief question of whether the other side actually needs it or merely asks out of convenience. An online shop rarely needs your age, and a newsletter does fine without your date of birth.

The second lever is oversight. Most people no longer know how many services they hold an account with. A password manager brings order here, because it makes all your sign-ins visible, and along the way lays the ground for unique passwords. Going through once a year and clearing out shrinks your attack surface noticeably, without having to study any technology. When you delete those old accounts and devices, our piece on why deleted rarely means deleted is worth a look, because a device you pass on often gives away more than its former owner assumes. And anyone who thinks a VPN takes this work off their hands should first read what a VPN really does and does not.

A third point often gets overlooked: recovery. A digital identity is only as strong as its weakest fallback. What good is the best two-factor login if the account can be reset through a poorly secured backup email? That chain deserves a scrutinising look, because attackers rarely seek the front door, the forgotten window usually does. Tidying your recovery paths, removing old phone numbers and storing backup codes somewhere safe closes the gap that hardly anyone thinks of.

For all the technology, the human stays the deciding factor. The most refined wallet does not protect against someone falling for a well-made scam email and handing over their credentials themselves. Scepticism towards unexpected demands, a second look at the address bar, and the calm to enter nothing when in doubt belong to the most effective protection there is. Tools help, but they do not replace your own judgement.

What remains

Digital identity is long since part of your life, whether you want it or not. The question is not whether you have one, but how much control you keep over it. The EUDI wallet can strengthen that control if selective disclosure and transparency hold their promise, and it can weaken it if convenience lands everything in one place and nobody can tell any more who sees what.

The good news is that the decision rests with you for now. Voluntary means voluntary, and it is decided better when informed than under pressure. Whoever understands what digital identity covers can use the new tools without handing themselves over to them.

Frequently asked questions

What is a digital identity in simple terms?

Your digital identity is the sum of all the data that lets a computer, a company, or a government recognise you as you. That includes the obvious things like your email address, username and password, but also your ID card with an online function or a state wallet app. In a broader sense even your traces count, meaning everything a service uses to recognise you without you giving your name.

Is the EUDI wallet mandatory?

Not for citizens. The eIDAS 2.0 regulation obliges EU states to provide a free wallet by the end of 2026, but nobody has to install or use it. The obligation sits on the other side: certain providers such as banks or large online platforms will have to accept the wallet as a means of identification when you choose to present it.

How can I protect my digital identity?

Separate your accounts cleanly with a password manager and unique passwords, turn on two-factor authentication everywhere, and reveal only the attributes actually being asked for. Review regularly which services can reach your data, and clear out old accounts. For the state eID, keep the PIN secret and secure the card physically.

What is the difference between eID and the EUDI wallet?

The eID is the online identification function that has been built into the German ID card since 2010, letting you prove who you are to public authorities. The EUDI wallet is an app that bundles and extends this function: alongside the ID it is meant to hold your driving licence, diplomas or insurance records, and to work across Europe.

What are the dangers of a digital identity?

The biggest danger is identity theft, where someone takes over your data and acts in your name. On top of that come the bundling of many credentials in one place, possible security flaws in the software, and the linking of data traces into a profile. Experts criticise the German wallet above all for a lack of transparency and open questions around data protection.

Can I refuse a digital identity?

Yes. As long as use stays voluntary, you can ignore the wallet and handle your official business the analogue way or through the existing eID. What matters is keeping an eye on the trend, because the more services expect or favour the wallet, the more the pressure to use it will grow.