What the bill does, and what we could not confirm
On 30 September 2026 the federal government's TKG-Änderungsgesetz 2026 was published as Bundestag Drucksache 21/8277. It carries the Bundesrat's opinion of 25 September and the government's counter-statement. Reported excerpts, and IDnow's March 2026 consultation submission on the draft, say the bill rewrites the prepaid SIM identity rule in § 172 TKG. Instead of leaving the choice of methods largely to the regulator, it would set a closed list of permitted verification routes. That list reportedly includes reading data from the EU Digital Identity Wallet.
A caveat applies to this analysis. We could not machine-read the Drucksache or the consultation PDF. We therefore could not confirm the exact wording of the new § 172 or the Bundesrat's position on it. What follows rests on the confirmed current legal framework and on the reported shape of the draft. Where the draft text matters, that is flagged.
The current regime: regulator-defined, certificate-gated
Today § 172 Abs. 2 TKG works in layers. Under Satz 1 (Nr. 1–7), a provider may verify a buyer by checking listed identity documents. Under Satz 3, the Bundesnetzagentur determines which other procedures are suitable, which in practice means video and app-based identification. Under Satz 4, providers must present a conformity assessment certificate before using such a procedure. The Bundesnetzagentur's Verfügung Nr. 94/2021 is the operative determination.
The system has a visible weak point. The original 12-month transition for certificates ended on 1 December 2022, and § 230 Abs. 9 TKG rules out extending it. Yet the Bundesnetzagentur says no certification bodies have been accredited, so certificates cannot currently be obtained. In Mitteilung Nr. 86/2026 it announced that it will open no supervisory proceedings solely for a missing certificate until 1 May 2027. That is an enforcement forbearance, not a legal fix. A statutory regime in which the compliance step cannot be performed for years is poor regulation, and a clearer rule is a fair response to it.
The strongest case for the rewrite
The best argument for a closed statutory list is legal certainty. Providers, identification vendors and law enforcement would all know which methods count. Parliament, not an agency determination, would own a rule that touches every prepaid buyer's identity. A fixed list also helps when the certification route is stalled: methods named in statute do not wait on accreditation bodies that do not exist.
On the wallet, the logic is also sound. Under the EU Digital Identity Wallet framework, each Member State must provide at least one wallet to its citizens, businesses and residents, with rollout due around the end of 2026. A wallet lets a buyer prove who they are cryptographically, with user-controlled disclosure. For SIM activation that could be more secure than a photographed ID and a selfie video, which are the weakest links against fraud and deepfakes.
Where the proportionality risks sit
A closed list helps legal certainty, but it can also freeze innovation. Our concerns are specific.
- A list that cannot change quickly. Verification fraud evolves faster than the legislative cycle. If a new method is not on the list, it needs an amendment to the Act. The current regulator-led design, however flawed in execution, can adapt. The bill should keep a narrow, fast route to add methods that meet an objective assurance standard.
- The wallet must stay one option. Wallet uptake will be gradual. A rule that in practice steers buyers toward it would turn a convenience into a gate on basic connectivity, and would hit visitors, migrants and people without compatible phones hardest. Alternatives such as document checks, eID and regulated remote methods should stay genuinely available.
- Data minimisation. The wallet's strength is selective disclosure. A SIM rule that requires providers to read more attributes than they need would waste it. The statute should state what may be collected and retained.
- Certification must work. Moving methods onto a list does nothing if the § 172 Abs. 2 Satz 4 conformity requirement remains unworkable. Whichever route Parliament picks, accreditation has to exist before the forbearance ends on 1 May 2027.
The constitutional backdrop
Prepaid registration in Germany has already been tested. In Breyer v. Germany (application no. 50001/12) the European Court of Human Rights ruled six to one that collecting prepaid users' names and addresses did not violate Article 8. It called the interference limited, pointed to the law's safeguards and independent supervisory review, and found Germany within its margin of appreciation.
That ruling supports the existence of a registration duty. It does not bless every later expansion. The Court's reasoning rested on the limited nature of the data (names and addresses) and on the safeguards around it. A reform that widened the data collected, or made one digital credential the practical price of a SIM, would be judged on its own merits, not on Breyer.
What lawmakers should do
The direction of travel is defensible: put the rule in statute, name the methods, and let the EU wallet in. Four amendments would make it good policy:
- Keep the wallet strictly optional, with at least one non-digital-credential route guaranteed in the text.
- Add a fast, criteria-based procedure for admitting new methods without a full amendment.
- Limit collection and retention to the data the existing registration duty needs.
- Tie the new list to a working assurance scheme, so that 1 May 2027 does not simply roll into another forbearance notice.
Once the Drucksache text and the Bundesrat's opinion can be read in full, the test is simple. The rule should lower fraud and friction for prepaid buyers without making a state-linked credential the price of a phone number.