What is in a data request, and what do you decide?
Your wallet does not send data on its own. A service, called a relying party in the law, makes a request, and you approve it or not. Under the eIDAS Regulation, as amended by Regulation (EU) 2024/1183, relying parties must identify themselves to you. The wallet must also allow selective disclosure, so you share single items rather than a whole ID document.
The European Commission sums it up: users share only what is necessary. Germany's state wallet, planned for early 2027, shows how this works in practice. Its project site says data is only transferred when you actively release it, only what a specific purpose requires is sent, and only state-registered organisations may ask, with the wallet checking their certificate automatically. For the bigger picture, see EU Digital Identity Wallet: what it does and when it arrives.
Tip: A valid certificate tells you that a registered service is asking. Whether the amount of data fits your situation is still your call.
What may a service ask for?
A relying party registers in its EU country and states which data it will request for which intended use. It may not ask for any other data. Member States publish this information online.
Implementing Regulation (EU) 2025/848 fills in the details and applies from 24 December 2026. Where a country uses registration certificates, wallet providers must inform you when a relying party requests data not listed in its certificate. A relying party that requests more attributes than it registered risks having its registration suspended or cancelled.
- Pseudonyms: where no law requires you to be identified, a relying party may not refuse a pseudonym.
- Very large online platforms: where they require you to log in, they must also accept the wallet if you choose it, and only for the minimum data the service needs.
- Voluntary use: people who do not use a wallet must not be disadvantaged, and other ways of identifying yourself must remain available.
Over-identification: does the request fit the purpose?
Over-identification means a service wants to know more about you than its purpose requires. Registration does not always prevent it, because a relying party can register several intended uses with different data. So compare each request with what you are actually doing.
| Situation | What is usually enough | Reason to pause |
|---|---|---|
| Age check for an 18+ purchase online | Confirmation that you are an adult; Germany's wallet plans an age proof without your exact date of birth or address | Address, document number or full date of birth |
| Platform where no law requires identification | A pseudonym or a few details | Your full identity with no clear reason |
| Bank account, contract with an identity check, application to a public authority | The identity data the procedure requires | Data unrelated to the contract, or a service name that does not match |
The same question helps with app permissions: Does this app need your contacts? Review permissions by purpose.
What should you do if a request does not fit?
- Cancel. Nothing is shared without your approval.
- Compare the service name with the service you opened yourself. If the request came from a link in an unexpected message, open the service yourself through a route you already know.
- Ask the service why it needs the extra data. Where registration certificates are used, it must link to its privacy policy for the registered use.
- If the wallet shows a warning, do not approve anyway.
- Use another route if there is one, such as an in-person check.
Read first, then confirm, just as with a banking app approval request.
Already shared? Overview, erasure and complaints
Every EU Digital Identity Wallet must offer a common dashboard listing the relying parties you have connected with and a log of your transactions. From there you can easily ask a relying party to erase your data under Article 17 GDPR, or report it to your national data protection authority after an allegedly unlawful or suspicious request. Note the date, service name and data requested. Authorities such as France's CNIL ask you to contact the organisation first.
| Country | Rules | Where to complain | Good to know |
|---|---|---|---|
| Germany | EU law; state wallet planned for early 2027 | Companies: usually your federal state's authority; federal bodies, telecoms and postal firms: the BfDI | Progress update within three months at the latest |
| Austria | EU law | Datenschutzbehörde: online form, email or post, in German | Free in principle; within one year of finding out |
| France | EU law | CNIL: contact the organisation or its DPO first, then complain online | Reply to a rights request due within one month, extendable by two |
| Italy | EU law | Garante: signed complaint by certified email (PEC), registered letter or in person | A complaint template is available |
| Spain | EU law | AEPD: complaint via its electronic office | Keep evidence of the request |
| Switzerland | No EU law; own e-ID with the swiyu wallet | Planned: report misuse to the Federal Office of Justice | Planned: public register of data requests and their purpose |
An example: Aoife checks an age request
Fictional example: Aoife from Galway joins an online wine club in spring 2027. The club checks her age through her wallet and requests her first name, surname, date of birth, home address and document number.
The club's name matches; the amount of data does not. Aoife cancels and asks through the contact form why the address and document number are needed. The club admits a set-up error, and on her second try only her adult status is requested. Afterwards the dashboard shows that only this one item was shared.
Common mistakes
- Approving because the service name sounds familiar, without comparing it with the service you opened.
- Sharing date of birth, address and document number for a simple age check.
- Dismissing a wallet warning to finish faster.
- Starting a data request from a link in an unexpected message.
- Never checking the log or asking for erasure after a questionable approval.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Do I have to approve every request in my wallet?
No. Using an EU Digital Identity Wallet is voluntary, and you decide on each request. Germany's state wallet project says data is only transferred when you actively release it. If you refuse, you may not get the service this way. Other ways of identifying yourself must remain available, though, and people who do not use a wallet must not be disadvantaged.
Can a shop ask for my date of birth to check my age?
Under EU law it may only request data it declared when registering, and from 24 December 2026 that registration information must be published online. For a pure age check, Germany's wallet plans a proof that reveals neither your exact date of birth nor your address. If a shop asks for more, cancel and ask why. Whether a request is lawful in your case is for the data protection authority or an advice service to assess.
Does this apply in Switzerland?
No. The EU regulation does not apply in Switzerland. The Confederation is introducing its own e-ID with the swiyu wallet under Swiss law. Measures announced in February 2026 say services will have to record their data requests and purpose in a public register. If a service asks for too much, the wallet is to warn you, and you will be able to report misuse to the Federal Office of Justice.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- EUR-Lex: eIDAS Regulation (EU) No 910/2014, consolidated text with Articles 5a, 5b and 5fSource review date:
- EUR-Lex: Implementing Regulation (EU) 2025/848 on the registration of wallet-relying partiesSource review date:
- European Commission: European Digital IdentitySource review date:
- German government EUDI Wallet project: the state wallet app (in German)Source review date:
- Swiss Federal Department of Justice and Police: measures to strengthen acceptance of the e-ID (in German)Source review date:
- BfDI: complaints to data protection authorities in Germany (in German)Source review date:
- Austrian Data Protection Authority: complaints (in German)Source review date:
- CNIL: lodging a complaint (in French)Source review date:
- Garante per la protezione dei dati personali: complaints (in Italian)Source review date:
- AEPD: how to lodge a complaint (in Spanish)Source review date:
