What is a digital identity? A plain-language guide

A digital identity is the collection of information that represents you online, together with a method to prove that the information is really yours. It can be as simple as an email address and a password, or as formal as a government-issued eID that a bank accepts for opening an account. What matters is not the technology but the question it answers: who is on the other end, and how sure can the service be?

The three parts of a digital identity

Most digital identities, whatever their form, combine three things.

• Attributes. Facts about you: name, date of birth, address, nationality, a customer number, a professional title, or simply an email address.
• Credentials. The means of showing those attributes: a password, a passkey, a smart card, a mobile app, a signed certificate or a document stored on your phone.
• Verification. The process by which someone checks that the credential is genuine and that you are the person it belongs to. Often this involves a trusted issuer, such as a government or a bank, that vouched for the attributes in the first place.

The difference between a throwaway forum account and a state eID is mostly in the third part. A forum accepts whatever you type in. A bank wants an issuer it can trust to have checked your passport.

Types of digital identity you meet in Europe

Type	Who issues it	Typical use	Strength of proof
Self-asserted account	You (email, username)	Forums, newsletters, shops	Low
Platform or social login	Google, Apple, Microsoft and others	‘Sign in with…’ on third-party sites	Low to medium
Bank or telecom identity	Banks, mobile operators	Online banking, contracts, some e-government	Medium to high
National eID	The state (ID card, residence permit, app)	Tax, health, official services, remote signing	High
EU Digital Identity Wallet	Member states, under EU law	Cross-border identification and credentials	High (required by law)

Many countries combine several of these. Estonia and Belgium have issued national eIDs for many years, while several other countries, including Sweden and Norway, rely largely on bank-based schemes. Our country guides show what exists where.

Three ways of organising identity

1. Siloed accounts. Every service keeps its own copy of your data and its own password. This is simple for the service and tiring for you.
2. Federated login. One provider vouches for you to many services, as with ‘Sign in with…’ buttons or a company single sign-on. You get fewer passwords, but the provider can see where you log in.
3. Wallet-based identity. You hold credentials issued by trusted authorities and present them directly. The services check the signatures and no central login provider has to be involved in every transaction. This is the model behind the EU wallet.

None of these is perfect. Federation concentrates data, while wallet-based models move responsibility for the device and its backup to you.

Identity and data protection

Name, date of birth, national identification numbers and similar attributes are personal data under the GDPR. A service should ask only for what it needs for a stated purpose, and it should not keep identity data longer than necessary. As a user, that is a good test: if a website asks for a copy of your ID card to let you read an article, something is wrong.

How identity differs from authentication

People often mix up two ideas. Identification establishes who you are, usually once and with some effort, for example when you enrol for an eID. Authentication confirms later that the same person is returning, for example when you unlock the app with a fingerprint. A passkey is excellent at authentication but does not prove your legal name. We explain the distinction in more detail in identity versus authentication.

Why the way identity works is changing

Historically, each website ran its own identity silo. You created yet another account and handed over a copy of the same data again. Federation (single sign-on) reduced the number of passwords but concentrated power in a few large identity providers. States then added eIDs, but these were mostly national and rarely worked across borders.

The European Union is now setting a common frame. Regulation (EU) 2024/1183, often called eIDAS 2.0, obliges every member state to offer at least one EU Digital Identity Wallet by the end of 2026. The idea is that you hold your identity data and credentials yourself on your phone and decide case by case what to show. A shop that only needs to know you are over 18 should not learn your birthday.

Levels of confidence

Not every service needs the same certainty. European law distinguishes three assurance levels, low, substantial and high, depending on how strictly your identity was checked and how strongly your login is protected. Details are on our page about levels of assurance.

What you can do now

1. Know what you have. List the accounts that matter most: email, bank, tax or health portal, cloud storage. These form the core of your identity.
2. Protect the foundation. Your main email account can reset almost everything else. Use a passkey or app-based second factor there first. See passkeys explained.
3. Check your national eID. If your country issues a smart-card ID or an app, activate it and test it once while you do not urgently need it.
4. Plan for the wallet. You do not have to do anything yet. When your country launches its wallet, installation will be voluntary and free of charge.
5. Keep recovery options current. A lost phone should be an inconvenience, not a lockout.

For the official picture of the EU programme, the European Commission maintains a portal on the EU Digital Identity Wallet.

Common misunderstandings

A digital identity is not a single database entry. There is no central EU file on every citizen. The wallet approach is built around data kept on your own device, issued by authorities that already hold it.

A digital identity is not necessarily a government product. Banks, telecom operators and platforms all provide identity services, with different legal weight.

Having one does not mean sharing everything. Good design lets you reveal single attributes. Whether a given service actually asks for less is partly up to regulation and partly up to the service, which is why the registration of relying parties matters. More on that in our guide to selective disclosure and unlinkability.