NEW YORK — What happened
European data protection authorities issued combined fines of €140 million against three identity technology providers building software for the EU Digital Identity Framework. Audits conducted throughout summer 2026 revealed that background telemetry services were capturing and storing unencrypted user metadata during identity validation flows.
Why it matters
The EU eIDAS 2.0 framework was designed with strict zero-knowledge architecture principles to ensure that verifying a user's age or credential does not track where or when that user interacted with a service. This regulatory action sends a message that background analytics and diagnostic routines are subject to the same strict privacy rules as core authentication workflows.
Deep dive
When citizens present a digital credential (such as a mobile driver's license), cryptographic proofs should allow verification without the issuer learning the transaction details. However, inspectors discovered that the providers' crash-reporting and performance monitoring SDKs were transmitting hashed device identifiers, timestamps, and rough IP-based location data back to central telemetry servers. While the identity payloads themselves remained encrypted, the metadata allowed cross-site user profiling.
Report check
Claims: Regulators claimed biometric facial scan data was transmitted to third-party ad networks. Verified: Telemetry logs contained IP addresses, device models, and timestamps. Disproven: Independent audits confirmed biometric vector data never left local secure enclaves, contradicting initial online reports.
Open questions
Can developer teams build reliable application monitoring tools that comply with absolute zero-knowledge metadata restrictions? How will this ruling affect third-party SDK vendors whose software is bundled into regulated digital wallets?