On 15 October 2026 the Bundestag passed the Digitale Identitätengesetz with the votes of the CDU/CSU and SPD. The AfD, Greens and Left voted against, according to the Bundestag's account of the vote. The law is the legal basis for "d-you", Germany's EU Digital Identity wallet, which is scheduled to launch on 2 January 2027. Use is voluntary and existing identification methods stay in place.
That voluntariness is the strongest part of the law. The weakest part is what the wallet does at launch, and what the law leaves unchecked.
The case for shipping fast
The argument for speed is serious. The EU's European Digital Identity Framework obliges Member States to offer citizens a wallet by the end of 2026. A wallet that exists, even in reduced form, gives Germany a way to move away from the patchwork of card readers and app-specific logins that has held back digital public services. A late launch also means delay for companies and agencies that want to build services on a trusted identity layer. Regulators who ship a minimal product and add features later are applying the iterative approach that technologists usually praise. The Digital Ministry says it is waiting on EU Commission specifications for some of the missing functions.
What the launch leaves out
The trouble is that the deferred items are the ones that make a digital identity system safe to use at scale. Netzpolitik reports that d-you starts with the ID function only. A driving licence and a biometric passport photo are meant to follow. Pseudonymous logins, zero-knowledge proofs and selective data disclosure come later still.
The law does require a pseudonym function. But the Bundestag notes that it is not expected at launch. A coalition resolution asks the government to deliver it "as soon as possible", and that resolution is non-binding and has no start date. Greens and Left resolutions demanding it were rejected. The Federal Data Protection Commissioner's office flagged the absence, and its representative called it unfortunate.
This matters because a wallet without pseudonyms turns every login into an identity disclosure. Many online interactions need no real name. Commenting on a news site, reading age-gated but non-sensitive content and joining a forum are examples. If the only available credential is the ID function, the likely outcome is more identification than the activity needs. For a publication that defends online speech, that is the central risk: anonymity and pseudonymity are what let people with unpopular opinions take part in public debate.
Oversight that depends on providers behaving
The second gap is the relationship between the wallet and the businesses and agencies that ask it for data. According to Netzpolitik, the law contains no risk-based registration or prior vetting of service providers and no public registry of providers or their data requests. It relies on GDPR data minimisation, which providers are expected to apply themselves when they register. The consumer federation vzbv had demanded prior review by a supervisory authority, and that was not adopted. In the Bundestag hearing, expert Bianca Kastl warned of a "cookie banner 2.0" if oversight of provider registration is weak, according to the Bundestag's hearing summary.
The comparison is apt. Cookie consent is the standard example of a privacy safeguard that exists on paper, is clicked through in practice and is rarely checked. Proportionate regulation does not require heavy licensing. It does require that a user can see who is asking for what, and that someone can find out when a provider asks for too much. A public registry of data requests is cheap to run and puts the checking on the public, journalists and researchers rather than on an overloaded regulator. Its absence is a design choice, and it undercuts the trust the wallet needs to win voluntary adoption.
An experimentation clause with limited checks
The law also gives the Digital Ministry a clause allowing time-limited trials that deviate from statutory requirements. The Bundestag says trials will be more tightly controlled after amendment, with the Digital Committee involved earlier, and experts at the hearing had praised the clause. Netzpolitik reports that the ministry must inform the committee and allow at least two session weeks for comment, and that trials can be extended once. It also reports that the Data Protection Commissioner asked to be involved, along with the BSI, and the law does not require it.
Sandboxes are a good tool, and a pro-innovation reader should defend them. But a sandbox that can waive statutory protections is only as good as the independent bodies that review it. A deviation from privacy rules should need the data protection authority's input, not just a notice period.
What worked, and what to fix
Two changes deserve credit. Users may decline to have their biometric passport photo loaded into the wallet, a point the government had originally wanted to require. And the deadline for attribute certificates was shortened from 24 to 12 months. epicenter.works notes, however, that the law still lacks protection against discrimination for people who opt out. A right to refuse is of little value if a landlord or employer can effectively demand compliance.
The same concern appears in the wider debate over age verification. The EFF argues that the Commission's proposed EU Kids Act would expand intrusive age checks across the internet. If identity wallets become the default tool for those checks, the lack of pseudonyms and provider oversight in d-you becomes more costly.
The practical fixes are modest. Set a statutory date for pseudonymous logins. Publish a registry of providers and their declared data requests. Require the Data Protection Commissioner's sign-off on any experimental deviation. Add a non-discrimination rule for users who decline optional features. None of these would delay the January launch, and each would make a voluntary wallet something people can reasonably choose to use.