A new digital wallet is scheduled to launch in Germany on January 2, 2027. The Federal Ministry for Digital and State Modernisation has given the state-run EUDI wallet the name d-you. More than 40 partners from business, academia and public administration are expected to offer their own applications when it launches.
Planned uses include digital proof of age, legally valid contract conclusions and opening bank accounts. A digital driving licence, electronic signatures, pseudonymous logins and payment functions are expected to follow later. The practical benefits are easy to see, but the political significance goes much further: d-you is intended to become the centre of a digital identity ecosystem.
According to the German government, use will initially remain voluntary. This promise will determine whether d-you is a useful tool or one day becomes the digital ticket to access public authorities, banks and platforms.
d-you is launching as an ecosystem, not an ID app
The Federal Ministry for Digital and State Modernisation (BMDS) unveiled d-you in early September, along with its name and logo. The actual launch is planned for January 2, 2027. The more than 40 partners include public bodies, companies, universities and providers in sectors such as banking, transport, insurance and public administration. Proof of age is expected to be one of the main uses at launch, but contracts should also be able to be concluded digitally and new bank accounts opened. Further credentials and applications are to follow gradually. The wallet is still in a development and testing phase.
The project follows the European EUDI framework. EUDI stands for European Digital Identity. The EU requires its member states to provide at least one compatible digital wallet. Germany is implementing this requirement with a state-backed solution. Under current plans, private providers will later also be allowed to offer their own certified wallets.
For now, d-you has nothing to do with the digital euro. The wallet is intended to manage identities and credentials. Payment functions are merely planned as a later extension. The digital euro is a separate project of the European Central Bank and the EU.
Digital credentials are intended to replace copies of identity documents
d-you is not simply intended to store a photo of an identity card. Its technical approach is based on digital credentials issued by public authorities or other authorised bodies and cryptographically signed. A company then checks not just an image, but the authenticity and validity of a credential.
For example, a person must be of legal age to buy an alcoholic drink. A wallet could confirm this without disclosing their name, address or exact date of birth. Instead of the complete identity document, only the necessary information would be transmitted. This is a genuine improvement over uploading a complete copy of an ID document, because many processes today require more personal data than is actually necessary for the purpose in question.
Opening a bank account, however, is subject to different requirements: statutory rules on identification and the prevention of money laundering may require additional information. Data minimisation does not mean that personal data will never be transmitted; rather, only the information required for the specific transaction should be requested.
The BMDS plans to store data in encrypted form on the device. The wallet is intended to show which information was shared with which provider. Under the European rules, providers may not collect unnecessary usage data or link identity data with other datasets without explicit consent.
The EU only mandates acceptance
Citizens and companies do not have to use the wallet, but service providers do. EU Regulation 2024/1183 stipulates that use must remain voluntary. Anyone who does not use an EUDI wallet may not be disadvantaged when accessing public or private services, the labour market or exercising their freedom to conduct a business. Other identification and authentication options must remain available.
| Area | EU legal requirement |
|---|---|
| Citizens and companies | Use of the wallet remains voluntary. |
| Public online services | If electronic identification is required, the EUDI wallet must be accepted. |
| Certain private services | Providers other than micro and small enterprises must accept the wallet for strong online authentication. This applies, among others, to banking, financial services, healthcare, telecommunications, education and transport. |
| Very large online platforms | If they require authentication, they must accept the wallet when voluntarily requested and facilitate its use. |
For certain private providers, the acceptance requirement applies no later than 36 months after the relevant implementing acts enter into force. This does not mean that every private service must support d-you immediately from January 2027. The regulation also requires the wallet’s application software components to be released under an open-source licence. Issuance, use and revocation are to be free of charge for natural persons. Users are to be able to store, select, delete and share credentials, and track their transactions.
Legal voluntariness can shrink in practice
More than 40 providers are expected to be available at launch. Each additional provider increases the wallet’s usefulness. This is where a network effect emerges. If a digital process can be completed in a few seconds with d-you, while the analogue alternative requires a form, an appointment or a letter, both options may remain legally available but differ in convenience in everyday life. That may encourage people to use it later on.
The EU prohibits directly or indirectly disadvantaging people who do not use a wallet. The practical test will therefore not simply be whether a paper form still exists somewhere. It will also concern processing times, costs, accessibility and whether banks, public authorities and companies offer the analogue option with the same degree of normality.
Data protection limits the amount of data—not every form of power
The EUDI wallet’s safeguards make sense: encrypted storage, selective disclosure, open-source code and a ban on unnecessary data linking reduce the risk of disclosing a person’s entire digital life with every transaction. According to the published concept, d-you is also not a central database in which every use is automatically consolidated. The wallet provider is not supposed to collect excessive usage information.
This makes total surveillance more difficult, but it does not make the question of power disappear. The state provides the legal identity, public authorities and other bodies issue credentials, providers register their intended uses, and companies decide which information is required for a transaction. The wallet therefore controls the technical disclosure. It does not itself decide whether a bank, platform or public authority is allowed to require a particular form of identification.
Open source is not a complete security guarantee either. Under the EU regulation, the application software components must be released under an open licence. Reasoned exceptions may apply to certain components that are not installed on the user’s device. Moreover, access to the source code says little about the security of the operating system, app store, updates, identity registers or the databases of the companies receiving the data.
Independent audits, clear liability rules and transparency about what happens to data after it is transmitted are therefore necessary. The wallet can enable data-minimising disclosure. It does not automatically prevent a company from storing the data later.
The smartphone becomes a risk
A physical wallet still works when a smartphone battery is empty. A digital wallet, by contrast, depends on the operating system, updates, app stores, device security and a functioning recovery process. What happens if the smartphone is lost? How quickly can the wallet be activated on a replacement device? What options remain if a device is compromised or a user account is locked? The German government points to technical support and analogue alternatives.
In fact, the EU regulation provides that a wallet may be suspended and, where necessary, revoked if its security is compromised. This protects the overall system. At the same time, it may mean that digital credentials temporarily stop working for the person affected. That is inconvenient for proof of age. For a bank account, an employment contract or an appointment with a public authority, it can quickly become a genuine access problem. State identity infrastructure must therefore be not only secure, but also resilient and revocable. The analogue option must not become an emergency fallback that works only with considerable additional effort.
The state may set the standard, but not provide the only way in
Digital identity itself is not the issue. A wallet that replaces unnecessary copies of identity documents, shares data selectively and makes different providers interoperable can make everyday life easier. It may also reduce dependence on individual large platforms. The criticism is directed at a different development: identity is the basis for contracts, property, bank accounts, work and public benefits. Whoever controls the infrastructure for that identity also influences the conditions for participating in society.
A state may set common standards and provide a secure service. But it should not become the sole operator and sole access point. The planned alternative wallet providers are therefore more than an additional technical option. They will constitute genuine competition only if data remains transferable between solutions and no provider receives lasting special status because of its proximity to the state.
Four clear requirements follow: analog access must remain permanently available without a penalty fee or artificial delay. Every use needs a narrowly defined purpose. Security audits and liability rules must be publicly transparent. New areas of application must not be added gradually merely because the infrastructure is already in place.
For retail investors, d-you will primarily become relevant when opening accounts and using financial services, and possibly later in connection with payment functions. The wallet may simplify such processes. But it must not become a prerequisite for opening an account or concluding a contract at all.
A voluntary wallet must also work without it
d-you could genuinely make digital identity more practical in Germany. But trust will arise only if there is a credible alternative. People without a wallet must continue to be able to access public and private services on comparable terms. Multiple providers must be technically on an equal footing. Security vulnerabilities require rapid assistance and clearly accountable parties. Use of the wallet must not lead to complete monitoring of everyday life.
If these limits remain in place, d-you is a useful tool. If they disappear, voluntary digital identity will gradually become an access code for economic and social life. That would be unacceptable—as could also happen with the digital euro…
