Early access. Product screens use synthetic demo data; accounts and bank imports are not open yet. What is live today

Research

Digital euro privacy: proposals, safeguards and open questions

The proposed digital euro would not be anonymous. Offline payments would stay between payer and payee; online, your provider would know you while the Eurosystem saw only pseudonymised data. These are draft rules, and the EDPB and EDPS have asked for stronger safeguards.

By Daniel Malbašić · Last reviewed

Short answer

Under the published design, the digital euro would not be anonymous but would limit who sees what. Offline payments would be known only to payer and payee. Online, your bank or provider would know your identity for anti-money-laundering checks, while the Eurosystem would see only pseudonymised data. None of this is law yet, and data protection authorities want stronger safeguards.

Why privacy is the central question

Privacy is the issue that decides whether people would trust a digital euro at all. The French data protection authority, the CNIL, notes that in the ECB's 2021 public consultation privacy was ranked the most important feature by 43% of respondents, ahead of security at 18% (CNIL, 14 February 2022). The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) go further: they write that the added value of a digital euro "would reside mainly in its confidentiality" (EDPB-EDPS Joint Opinion 02/2023).

Two opposite misreadings circulate. One says the digital euro would be "anonymous like cash". The other says it is a tool for the central bank to watch every purchase. Both contradict the published documents. This page sets out, actor by actor, what the proposals say each party would see, what regulators have asked to change, and what remains undecided. For the basics of what the digital euro is, see our overview; for the legislative process as a whole, our legislation page.

DIGITAL EUR is independent of the ECB and the EU institutions. This page is not legal advice.

Who would see what? The data map

This is our consolidated reading of ECB, Bundesbank and EDPB-EDPS material. It describes the proposed design, not a system in operation.

Actor Online digital euro payment Offline digital euro payment Main source
You and the other party Each other's details as needed to pay Each other's details; the record stays on the two devices ECB FAQ; ECB privacy page
Your PSP (bank or payment provider) Your identity, the payments on your account, data needed for anti-money-laundering, fraud prevention and settlement Only funding and defunding of your offline balance, not the payments themselves ECB FAQ; Bundesbank FAQ
The payee's PSP Its own customer's side of the payment Nothing about the payment Bundesbank FAQ
Eurosystem (ECB and national central banks) Pseudonymised balances and changes in balances; cannot identify users Minimum data at defunding to detect forgery and double spending, not identifying individuals Bundesbank FAQ; ECB ERPB slides, April 2024
Public authorities Through PSPs, on a legal basis (for example anti-money-laundering) Funding and defunding data held by PSPs Bundesbank FAQ
Merchants and advertisers What the merchant needs to complete the sale; PSPs need explicit consent for commercial use of your data Nothing beyond the sale ECB privacy page

Sources: ECB FAQ; ECB, Digital euro and privacy; Deutsche Bundesbank FAQ; ECB, State of play on offline digital euro, 11 April 2024.

The table shows where the real privacy line falls. The digital euro does not remove intermediaries from your online payments; it changes what the issuer sees and adds an offline mode in which intermediaries do not see payments at all.

Online payments: what pseudonymisation means

For online payments, the ECB says the Eurosystem "would not be able to identify users" making or receiving payments, while PSPs could identify them for anti-money-laundering compliance (ECB FAQ). The mechanism is pseudonymisation: the ECB's data protection officer explained in 2024 that your bank pseudonymises the data, so your name is "replaced by a random identification number" before the Eurosystem processes it, and that digital euro identity is kept separate from payment data (ECB Blog, "Making the digital euro truly private", 13 June 2024).

Several supporting details are worth knowing:

  • The DEAN carries no personal data. The Bundesbank says the digital euro account number does not contain personal data and, unlike an IBAN, does not reveal the country or the bank (Bundesbank FAQ).
  • No commercial use by the Eurosystem. The ECB says it would never use the data for commercial purposes; PSPs would need your explicit consent to do so (ECB privacy page).
  • Independent oversight. The ECB says it would be supervised by independent data protection authorities, and its blog describes a planned compliance and audit framework with an independent group of data protection officers. The blog uses the word "plan"; this framework does not exist yet.

What pseudonymisation is not. A pseudonym is not anonymity. Whoever holds the key (your PSP) can link the pseudonym to you, and data protection authorities warn that static pseudonyms can sometimes be re-identified by matching with other data. The CNIL has suggested dynamic identifiers for that reason (CNIL, "Confidentiality in the Digital Euro: Where are we?", 26 May 2026). The EDPB and EDPS asked for a binding legal obligation to pseudonymise all transaction data towards the ECB and national central banks, rather than leaving it to design choices (Joint Opinion 02/2023).

Offline payments: the closest thing to cash privacy

Offline digital euro privacy is where the design comes nearest to cash. The ECB describes "cash-like privacy" for offline payments: personal transaction details known only to payer and payee (ECB FAQ). Its 2024 blog puts it plainly: payment data stays between the two phones, and neither banks nor the Eurosystem can see it.

The checks move to the edges, just as with cash withdrawals and deposits. According to the ECB's April 2024 presentation to the Euro Retail Payments Board, at funding and defunding the PSP's anti-money-laundering check sees the amount, the identifier of the local storage device, the date and time, and the number of the online account used. Separately, the Eurosystem receives the minimum data needed to detect forgery and double spending, which "would not enable Eurosystem to identify individuals" (ECB, 11 April 2024).

This privacy has a price in limits and risk. Offline payments are expected to carry transaction and holding caps to contain money-laundering risk, and a lost device means lost money. How offline payments work, and what is still undecided, is covered on our offline digital euro page.

Is the digital euro anonymous?

No, and the ECB does not claim it is. Asked whether the digital euro would be as private as cash, the ECB's data protection officer answered "Not quite, but close" (ECB Blog, 13 June 2024). The distinction matters:

Term Meaning Applies to
Anonymity Nobody, including intermediaries, can link a payment to you Cash only
Cash-like privacy Only payer and payee know the details; checks happen when money enters or leaves Proposed offline digital euro
Pseudonymity The central bank sees a random identifier, your provider knows who you are Proposed online digital euro, towards the Eurosystem
Ordinary account privacy Your bank and the payment chain see the payment; data protection law limits use Cards and transfers today

So the honest answer to "digital euro anonymous payments" is: offline payments would be private between the two parties but tied to an identified account at funding and defunding; online payments would be identified at your provider.

Can the digital euro be used to track or control what I buy?

This is the core of most digital euro surveillance claims and of worries about digital euro transaction tracking. Taking tracking and control separately:

Tracking. Your PSP would see your online digital euro payments, as your bank sees card and transfer payments today. The Eurosystem would see pseudonymised balances and changes, not names. The Bundesbank adds that the draft regulation bars the Eurosystem from reversing the segregation or pseudonymisation, and that government access would run through PSPs "only on a sound legal basis" (Bundesbank FAQ). Payment data covers amounts and parties, not the goods bought.

Control. The proposal states that the digital euro would not be programmable money, meaning units could not carry built-in rules limiting what they may be spent on, and the EDPB and EDPS explicitly welcomed this (Joint Opinion 02/2023). That is different from conditional payments, which a user agrees to set up, such as an instalment paid automatically. The ECB's experiments with those are covered on our innovation page.

What remains a legitimate concern is not a secret switch to block purchases, but the ordinary questions of any payment system: how much data your provider keeps, how fraud monitoring works, and who may request data. Those are exactly the points regulators have raised.

What do the data protection authorities say?

On digital euro data protection, the EDPB and EDPS have commented since 2021. Their main text is Joint Opinion 02/2023 of 17 October 2023 on the Commission's proposal (EDPB-EDPS, PDF). In summary:

  1. Welcomed: the choice to pay in digital euros or cash, the digital euro not being programmable money, the offline modality ("strongly support"), decentralised distribution through intermediaries, and data protection by design and by default.
  2. Privacy threshold online: they "regret" that the proposal discarded a selective privacy approach and "strongly recommend" extending the offline regime to low-value online payments, with a threshold below which transactions are not traced for anti-money-laundering purposes.
  3. Binding pseudonymisation of all transaction data towards the ECB and national central banks.
  4. Single access point: more justification for the central register of user identifiers and holding limits, and clarity on how PSPs would process personal data to enforce holding limits.
  5. Fraud detection mechanism: the provisions on a general fraud detection and prevention mechanism "lack foreseeability"; if necessity is not shown, they recommend less intrusive measures.
  6. Roles and legal bases: clearer allocation of responsibilities and legal bases among PSPs, the ECB and national central banks.

In 2025 the EDPB also commissioned an expert study, The Digital Euro and its token-based offline modality (Prof. Tibor Jager, completed September 2025), on whether a cash-like, anonymous offline mode resistant to double spending is technically feasible (EDPB Support Pool of Experts). The CNIL, writing with Germany's federal data protection commissioner in May 2026, called a high level of privacy a key condition for the digital euro's success and noted that the proposal would involve the EDPB in setting the offline cap (CNIL, 26 May 2026).

Where the Commission, Council and Parliament stand on privacy

Text What it says on privacy (as summarised by the institution)
Commission proposal, June 2023 High level of privacy; offline privacy closer to cash; data categories per actor in Chapter VIII and annexes
Council position, 19 December 2025 Payments and transfers "with a high degree of privacy"; online and offline versions (Council)
Parliament mandate, June/July 2026 Privacy by design and by default; zero-knowledge proofs to verify transactions "without exposing personal data"; ECB without access to personal identification data; data processed only as strictly necessary (EP, 23 June 2026)

The precise list of data each actor may process is one of the points still open in the trilogues, which our legislation page follows. Press reporting on the trilogue of 20 October 2026 says negotiators discussed anti-money-laundering rules for small transactions and limits on offline payments; no agreed text has been published.

Open questions and criticism

A fair assessment of digital euro privacy concerns has to include what is unresolved:

  • No online privacy threshold. The EDPB-EDPS request for untraced low-value online payments is not in the Commission's proposal. Whether co-legislators add it is unknown.
  • Holding-limit enforcement needs data. To stop one person exceeding the limit across providers, some central check of identifiers is needed. That is the "single access point" regulators questioned.
  • Fraud scoring. The ECB has selected Feedzai as first-ranked provider for a risk and fraud management component (ECB, 2 October 2025), and the draft rulebook refers to real-time fraud scores available to participants (rulebook v0.91). How this squares with the regulators' call for a foreseeable, minimal mechanism depends on the final law and specifications.
  • Academic criticism. A January 2026 paper by researchers including Bernd Lucke argues that the online version leaves all transactions visible to PSPs with mainly legal rather than cryptographic protection, and that pseudonymous data can still reveal "patterns of life" (Cannataci et al., "Digital Euro: Frequently Asked Questions Revisited", arXiv). That is a critique, not an official finding, but it identifies the right questions.
  • Retention. How long PSPs keep digital euro data is not set out in the material we reviewed. In the pilot, PSPs apply their existing retention obligations (ECB pilot FAQ).

Worked example: one €4.80 coffee, three ways

An illustration of who learns about the same purchase. It describes the proposed design for the digital euro and the general structure of card payments, not any specific provider.

Who learns of the purchase Contactless debit card today Proposed online digital euro Proposed offline digital euro
Café Amount, time, masked card number Amount, time, payment confirmation Amount, time
Your bank or PSP You, the café, amount, time You, the café, amount, time Nothing (only your earlier offline top-up)
The café's acquirer Payment details Payment details Nothing at the time of payment
Card scheme Payment details in its network Not involved Not involved
Eurosystem Not involved A pseudonymised balance change Nothing until coins are defunded, and then no identity

The pattern matches the Bank of Estonia's argument that the digital euro would restrict visibility compared with card payments, where scheme operators can see payment details (Eesti Pank). It also shows the limit of that argument: online, your own PSP still sees what it sees today.

What is confirmed, proposed and unknown

Status Privacy item
Confirmed fact The digital euro is not issued, and the pilot has not started, so no real digital euro payment data exists yet. EU data protection law (GDPR and the EU institutions' data protection regulation) would apply. The EDPB and EDPS have issued a joint opinion.
Proposed design Offline payments private between payer and payee; online pseudonymisation towards the Eurosystem; AML checks by PSPs; no commercial use without consent; not programmable.
Unknown Online privacy threshold; exact data lists per actor; retention periods; offline caps; how holding limits are enforced; the final fraud-monitoring model.

A checklist for when wallets exist

If the digital euro is issued (there is no date; see our timeline), these are the questions to put to any provider. How providers and apps would be set up is explained on our digital euro wallet page.

  1. Is offline payment available on my device, and what is the offline limit?
  2. What digital euro data do you keep, for how long, and on what legal basis?
  3. Do you use my digital euro transaction data for anything other than executing payments and legal obligations? Where did I consent?
  4. What happens to my data when I switch provider?
  5. How do I file a data access request?

Frequently asked questions

Can the ECB see my digital euro transactions?

Under the published design, no: the Eurosystem would see pseudonymised data and could not identify users. Your bank or PSP would see your online payments, as it does today. The final rules depend on the regulation.

Are digital euro payments anonymous?

No. Offline payments would be private between payer and payee, with checks at funding and defunding. Online payments would be identified at your provider for anti-money-laundering purposes.

Is offline digital euro privacy the same as cash?

Close but not identical. The payment itself would leave no record with banks or the ECB, but loading and unloading the offline balance would go through an identified account, and offline amounts are expected to be capped.

Could the government block what I buy with digital euros?

The proposal says the digital euro would not be programmable money, and the Bundesbank says it would be technically impossible to steer consumption. Data access by authorities would run through PSPs under legal rules.

Who protects my data if the digital euro launches?

Your PSP under the GDPR and national supervisors; the ECB and national central banks under EU data protection law, with the EDPS and national authorities as supervisors. The ECB also plans an independent data protection audit framework.

What do privacy regulators want changed?

Mainly an untraced threshold for low-value online payments, binding pseudonymisation, a justified and minimal central identifier register and fraud mechanism, and clearer roles. See the list above.

Sources