Identity only where identity is needed: the onboarding regulation completes an identity-centred web

The implementing regulation on the remote onboarding of users to the European Digital Identity Wallets was presented as a draft on 2 December 2025 (feedback until 30 December 2025) and adopted as Implementing Regulation (EU) 2026/798 of 7 April 2026. It permits onboarding via electronic identification means at assurance level „substantial“, reinforced by additional remote procedures so that the combination meets assurance level „high“; identity proofing already performed at level „high“ does not have to be repeated. The context: Member States must make at least one EUDI Wallet available by 24 December 2026; banks, regulated sectors and large platforms must accept it from 24 December 2027; and from 10 July 2027 the Anti-Money-Laundering Regulation recognises it for customer identification.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation, the standards institute of the Trusted WEB 4.0 concept – acknowledges the regulation and the underlying wallet architecture: decentralised storage on the user’s own device, selective disclosure instead of all-round data surrender, a dashboard of one’s own transactions, free e-signatures for non-professional use. These are genuine advances over central account databases and identity platforms. Yet the regulation also completes a misguided development: it makes identity the currency of everyday digital life.

1. Selective disclosure is half freedom

The wallet decides how much identity a service receives – but the decisive question is whether a service needs identity at all. Buying an e-book, reading a news item, searching for information: none of this requires a personal identity. The personality protection concept of Trusted WEB 4.0 shows the alternative: WAN anonymity, no cookies, no privacy settings – assignment only via trust station key sets where it is genuinely needed. GISAD recommends placing an equivalent anonymous path alongside the wallet. The border rule of the European Digital System (EU-D-S) shows how anonymous entry into digital spaces works: through generic user names and transaction numbers that can only be assigned within the system.

2. The Article 5f acceptance obligation must not become compulsory identification at gatekeepers

From the end of 2027, banks and large platforms must accept the wallet – including those US corporations whose business model rests on the exploitation of personal data. A European identity instrument that normatively channels identifiable registration to non-European platforms delivers precisely what the wallet is meant to prevent: personal data flows to gatekeepers. The regulation should make clear that anonymous use remains equally permissible wherever no legal identification requirement exists.

3. Simplicity decides success – and simplicity means participation

The adoption gap is official: only 5 % of Germans can explain what the wallet is; national predecessors remained below 5 % usage. An identity infrastructure that requires explanation fails its own aspiration. getmySense with 2,500 written languages shows the principle: participation instead of barriers – also for older people, for whom every identity procedure is a risk of exclusion. Onboarding procedures should therefore work without prior digital experience; multilingual design is not a courtesy but a prerequisite for access.

4. The wallet is a honeypot – the onboarding regulation must not enlarge it

A device bundling all personal data, the driving licence, certificates and means of payment is the most attractive target in the digital space; its loss is total identity compromise. The regulation is on the right path where it makes repeated identity proofing superfluous through the leverage of existing „high“ eID means. It should additionally minimise the data trail of onboarding itself: no central storage of identity verification records, WAN-anonymous storage of metadata, and biometrics only as a voluntary option – never as the standard.