On 15 October 2026 the Bundestag passed the Digitale Identitätengesetz (DIdG, Drucksache 21/7408) with the votes of the CDU/CSU and SPD. The AfD, the Greens and Die Linke voted against, according to the Bundestag's own record. The law gives Germany's EUDI wallet, called d-you, its legal basis. The planned launch date is 2 January 2027. The wallet is a real piece of infrastructure, and the law is a reasonable first step. Its weak point is the order of delivery: identification comes first and the privacy tools come later, with no date attached.
The case for shipping now
The strongest argument for the government's approach is timing. The European Commission says the revised eIDAS framework, Regulation (EU) 2024/1183, obliges Member States to provide wallets to citizens by the end of 2026. A country that misses that deadline leaves its residents without a credential that service providers will increasingly have to accept. Germany has a long record of digital-ID schemes that arrived late or went unused, so a working launch has value. The government also says the wallet should remain voluntary and should not replace existing identification methods. The Bundestag's summary quotes the bill: "Die Nutzung soll freiwillig sein." The coalition did make concessions in committee: the deadline for federal attribute certificates was cut from 24 to 12 months, and users can refuse the transfer of their biometric passport photo.
What launches, and what does not
At launch d-you will offer only the ID function. Netzpolitik reports that a driver's licence and the biometric photo are meant to follow. Pseudonymous logins, zero-knowledge proofs and selective disclosure come after that. These are the features that let a person prove they are over 18, or a resident of a city, without handing over a full identity record.
A non-binding resolution asks the government to provide pseudonyms "as soon as possible". It sets no date. The government says it is waiting for EU Commission specifications. Markus Reichel, the CDU's wallet rapporteur, acknowledged a gap. At the committee hearing, Andreas Hartl of the Federal Data Protection Commissioner's office called the lack of pseudonyms "unfortunate" ("misslich"). Bianca Kastl argued for delaying the launch until the privacy-friendly core functions exist.
The sequencing matters because of how identity systems behave in practice. When the only thing a wallet can do is present a full identity, every relying party has an incentive to ask for the full identity. Once a service has built its login flow around full disclosure, adding minimal-disclosure options later does little unless the service is made to use them. Die Linke's Sonja Lemke warned of a "Cookie-Banner 2.0": users clicking through requests for state-certified data without thinking.
Safeguards that rely on goodwill
Three gaps stand out in the criticism recorded by Netzpolitik.
- No protection for people who opt out. Users can decline the passport-photo transfer, but the law has no guarantee against disadvantage for those who do. Thomas Lohninger of epicenter.works made this criticism. A right that carries a penalty is a weak right.
- Light oversight of relying parties. Lina Ehrig of the vzbv wanted a supervisory authority to check data requests in advance. The law instead points to GDPR data minimisation and asks services to apply it when registering. Critics note there is no risk-based registration, no public directory of permitted data requests, and unclear sanctions, such as exclusion from the wallet ecosystem.
- An experimentation clause. The Federal Digital Ministry may trial new verification methods and let children aged 12 and over use the wallet. To deviate from statutory requirements it only has to inform the Digital Committee and allow at least two session weeks for a response. A trial can be extended once. The Federal Data Protection Commissioner asked for its own expertise or the BSI's to be included, and that was not adopted. Experimentation clauses can be legitimate in fast-moving technology. Here the ministry, not parliament, has the last word on changes to a state identity system.
A proportionate fix
This publication favours proportionate, evidence-based regulation, and none of these problems calls for blocking the wallet. They call for cheap, targeted corrections that keep the launch date.
- Put a date on pseudonyms and selective disclosure. A statutory review point, or a ministerial duty to report to the Digital Committee on progress, would turn a hope into a commitment. The 12-month shortening for federal certificates shows the coalition can set deadlines when it chooses.
- Add a plain non-discrimination clause for opt-outs. It costs the state nothing and makes the opt-out meaningful.
- Let a data-protection authority see relying-party requests. A public register of what each service may ask for would be enough. Light-touch transparency is more proportionate than prior approval of every request, and it would still give regulators something to enforce.
- Bring the data protection and cyber-security regulators into any experimentation-clause trial. That would address the objection without removing the flexibility.
The wider point is one that EFF's Jillian York and Eva Galperin make about digital sovereignty: control should rest with users rather than simply move from one dominant institution to another. A wallet that makes identity checks easy for the state and for services, but gives the user few tools to limit what is shared, does not meet that test. SPD member Parsa Marvi called the coming period the "real test" for the wallet. The evidence of the first year, including how many services ask for full identity when less would do, should decide whether the privacy features stay a promise or become part of the product.