European UnionEuropean Digital Identity Regulation (eIDAS2)
Regulation (EU) 2024/1183, amending Regulation (EU) No 910/2014 (eIDAS)
An app store age verification (AV) rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Audit expectation
- periodic
- Who audits it
- Registered or designated auditor
- Where the report goes
- Filed with regulator
What it requires
- This Regulation binds member states first, from : under Article 5a(1) each member state must provide at least one European Digital Identity Wallet to its citizens, residents and businesses within 24 months of the entry into force of the implementing acts under Article 5a(23) and Article 5c(6), and those acts entered into force on ; the wallet-acceptance duties below rest on wallets provided under this Regulation.
- If you provide a very large online platform and require users to authenticate to access your service, also accept and facilitate the use of European Digital Identity Wallets for that authentication, only at the user's voluntary request and for the minimum data the service needs.NIST Privacy FrameworkPR.AC-P6NIST Privacy FrameworkCT.DP-P4
- If you are a private service, other than a microenterprise or small enterprise, that law or contract requires to use strong user authentication for online identification, also accept European Digital Identity Wallets, only at the user's voluntary request, no later than 36 months after the Commission's implementing acts entered into force, which is by .NIST Privacy FrameworkPR.AC-P6
- If you need proof of age, you may accept a wallet attestation of attributes that includes age, qualified or non qualified; wallets must allow selective disclosure of data, so a user need not share more than the attribute you ask for.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DP-P4System or device configurations permit selective collection or disclosure of data elements.
- PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
National supervisory bodies designated under the regulation, coordinated with the European Commission
Settledness
The Commission's overview page for the Regulation states the acceptance duty in general terms and gives no reading of the terms of Article 5f.
- As of
- Open questions
- Does 'required by contractual obligation' in Article 5f(2) reach a requirement a relying party sets for itself in its own terms of service, or only strong user authentication that a contract with a third party, such as a bank or a payment network, requires of it?
- Does a provider of a very large online platform 'require user authentication for access to online services' under Article 5f(3) when it asks a user only for proof of age, without a login to an account?
What it reaches
Covered services
European Digital Identity Wallets issued by or on behalf of member states, and relying parties, public and private, that accept wallet based attribute attestations including age.
How the hook was established
express
What makes it apply
Operator establishment
Obligation class
Security
Verification methods
Digital ID
What it makes you log
Who may demand the log
Data subject
What the log must hold
Actor identity, Output reference
Log retention
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Information about the use of the wallet that is not necessary for the provision of wallet services, which the wallet provider may not collect
Logging duty
The wallet must keep a log of its transactions that the user can open in a common dashboard. Article 5a(14) bars the wallet provider from collecting information about wallet use that the wallet services do not need.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) No 910/2014 Article 5a(4) point (d), as inserted by Regulation (EU) 2024/1183
- Trigger
- personal_data_processing
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1183
What this law does
Establishes the legal framework for European Digital Identity Wallets, requiring each member state to provide at least one wallet to its citizens, residents, and businesses, and creating qualified and non qualified electronic attestations of attributes that can include a person's age, and requiring wallets to allow selective disclosure of data, so a user need not share more than the attribute a relying party asks for.
Adopted , published in the Official Journal , and entered into force ; each member state must provide a wallet within 24 months of the entry into force of the Commission's implementing acts under Articles 5a(23) and 5c(6), which were published on and entered into force on the twentieth day after publication, so by .
The Commission's age verification blueprint consists of technical specifications aligned with those of the wallets, and a member state may offer an EU age verification solution integrated into its wallet or as a standalone application.
When LexLint raises it
When your app profile says your app operates an app store.
Back to the example · Lint your app
Page updated .