Concerns over dependence on Google and Apple in EU digital identity wallet infrastructure

The article examines concerns surrounding the European Union’s rollout of digital identity (ID) wallets, which are intended to provide citizens with secure access to government services and enable online age verification. It argues that, despite their public infrastructure role, many implementations of these wallets rely on proprietary security mechanisms developed by Google and Apple, specifically Google’s Play Integrity API and Apple’s Managed Device Attestation. These systems, known as remote attestation services, are designed to verify that devices and apps have not been tampered with and are running on certified hardware.

The author warns that integrating these proprietary services into EU digital infrastructure may increase dependence on major US technology companies and strengthen their control over mobile ecosystems. In particular, Google’s Play Integrity API is criticized for reinforcing Google’s dominance by privileging devices certified by Google and discouraging alternative Android distributions that do not include Google services. This can effectively exclude users of de-Googled operating systems such as GrapheneOS or e/OS from accessing essential public services.

The article also highlights a tension between this practice and the EU’s Digital Markets Act (DMA), which aims to limit anti-competitive behavior by large platforms. It argues that alternative, more open solutions exist, such as Android’s Hardware Attestation API, which could provide similar security guarantees without reinforcing platform lock-in.

Additionally, the article discusses inconsistent approaches across EU member states. Some countries, like the Netherlands and Italy, have adopted Google’s attestation system, while others, such as Switzerland, have opted for more open alternatives due to concerns about sovereignty and interoperability. This lack of coordination, the article suggests, undermines the EU’s broader goals of digital sovereignty and interoperability in public digital infrastructure.

The piece concludes that digital identity wallets should remain open, interoperable, and independent from private platform policies, emphasizing that access to government services should not depend on corporate ecosystems controlled by Google and Apple.