Most data below is LLM research and likely contains mistakes. Seeking Human Maintainer!

EU Digital Identity Wallets - Source and Privacy

A country-by-country index of wallet source releases, plus an overview of known privacy issues.

The open-source requirement. Article 5a(3) of the consolidated eIDAS Regulation

The source code of the application software components of European Digital Identity Wallets shall be open-source licensed. Member States may provide that, for duly justified reasons, the source code of specific components other than those installed on user devices shall not be disclosed.

The privacy requirement. Article 5a(16) of the consolidated eIDAS Regulation

The technical framework of the European Digital Identity Wallet shall:

(a) not allow providers of electronic attestations of attributes or any other party, after the issuance of the attestation of attributes, to obtain data that allows transactions or user behaviour to be tracked, linked or correlated, or knowledge of transactions or user behaviour to be otherwise obtained, unless explicitly authorised by the user;

(b) enable privacy preserving techniques which ensure unlinkability, where the attestation of attributes does not require the identification of the user.

Last updated: 14 July 2026

Tag key

not foundNo official national-wallet source located DemoPrototype, pilot, mock, or demonstrator only LimitedIncomplete or access-restricted publication ReleasedOfficially designated national wallet app publicly available CertifiedCertified as an EUDI Wallet FaceFacial recognition, not for device unlocks EEANon-EU pilot participant; EEA incorporation is pending, so not currently required to participate. EU candidateUkraine is an EU candidate and pilot participant; not currently required to participate.

27 EU member states + 3 pilot countries

Source availability

Prototype, pilot, and non-EU entries are labelled as such.

Publicly located European Digital Identity Wallet source code by EU member state and non-EU pilot participant
Country	Source code	Privacy issues
AustriaeAusweiseReleased	not found DEMO Valera is an Austrian technology demonstrator; no official national-wallet status found
BelgiumMyGov.beReleased	not found
Bulgaria	not found
Croatia	not found
Cyprus	not found
Czechia	not found
DenmarkAltIDReleased	Source release Most app and backend code; some components excluded
Estonia	not found DEMO EUDI wallet proof of concept
Finland	not found
FranceFrance IdentitéReleased	not found
Germany	not found DEMO Google FUNKE prototype; archived challenge entry, not the official national wallet
GreeceGov.gr WalletReleased	not found DEMO GRNET web wallet mock; not the Gov.gr Wallet app
HungaryDÁPReleased	not found	Remote onboarding matches a selfie against the ID document photo Face
IcelandEEA	not found
Ireland	not found
ItalyIT-WalletReleased	App source wallet provider Wallet application and provider components
Latvia	not found DEMO NOBID pilot repositories; not the production national wallet
Lithuania	not found
Luxembourg	not found
Malta	not found
NetherlandsNL Wallet	Source repository App and wallet-provider backend	#38: BSN based recovery mechanism weakens privacy
NorwayEEA	not found
PolandmObywatelReleased	Source publication Limited Frontend-only release; access is account-gated
Portugalgov.ptReleased	not found	Chave Móvel Digital activation matches a selfie against card and register photos Face
Romania	not found
SlovakiaeDokladyReleased	not found
Slovenia	not found
Spain	not found
Sweden	DIGG wallet repositories Apps, provider, gateway, and backend components
UkraineDiiaReleasedEU candidate	not found	PhotoID matches a live capture against the state register photo Face

Notes on scope

Licensing. This tracker records whether source is publicly available; it does not assess license terms. Source-available code counts here even though Article 5a(3) says the wallet’s application software components shall be “open-source licensed.”

Server code. Missing server source does not count against a release in this tracker. Users cannot verify that a deployed server is running the published code, so publishing it would not by itself make the live service verifiable.

Privacy analysis. We assume servers are malicious, i.e. that they retain and correlate all information they receive, regardless of what the Regulation permits. Privacy must therefore follow from what the protocol withholds, not from promises about server behaviour.

Face recognition. The tag marks wallets whose own onboarding includes biometric face verification. Some untagged wallets do no face capture themselves, but onboarding depends on another app — typically a national or private eID — that does. The tag reflects only the wallet app itself.

These are inclusion rules for this tracker, not conclusions about legal compliance.

Help improve the index

Human maintainer wanted!

This research was done with great LLM help. But with a project like this, all information should be checked by a human. However, I don't have time for that. Let me know if you want to take over and maintain this. Also, feel free to open an issue if you spot an hallucination.

Volunteer as maintainer