Designed to Forget You

Two documents, two years apart, are worth reading side by side.

The earlier one is dated June 2024. Sixteen cryptographers — Camenisch, Lysyanskaya, Preneel, Troncoso, Hoepman among them — wrote to the European Commission after being shown the design of the European digital identity wallet. Their recommendation was the BBS family of anonymous credentials: a scheme the academic community has been analysing for more than twenty years, which lets one credential be presented many times without those presentations being linkable to each other.

The later one is dated 2026. It is Annex B of the Commission’s age verification specification, and it contains a table comparing five schemes against four requirements.

The table shows why BBS was not chosen. It is printed there, in the Commission’s own document, and it requires no speculation to read.

What the table says

Two of the four requirements carry the decision.

Req02 — “A ZKP scheme SHALL be peer-reviewed by the relevant scientific community.”

Req03 — “A ZKP scheme SHALL introduce as minimum disruptions to existing infrastructure as possible.” The rationale column explains why: the solution “prioritizes a rapid time-to-market strategy by leveraging existing infrastructure wherever feasible.”

Here is how the candidates scored on those two.

Scheme	Req02 peer review	Req03 infrastructure friction
BBS+	pass	fail
BBS+ with ECDSA proof of possession	pass	fail
Pairing-free BBS+	pass	fail
ECDSA Anonymous Credentials ← selected	partial	pass
Crescent	partial	pass

Three BBS variants pass on peer review and fail on infrastructure friction. The selected scheme does the reverse.

The annex concludes that ECDSA Anonymous Credentials “appears the most promising due to its compatibility with existing credential formats and issuance flows.”

And a few lines earlier, about that same scheme, the annex states:

“The solution has not been peer-reviewed.”

Req02 marked peer review as SHALL. Section 7 of the specification is titled “Experimental features,” and its opening sentence says a next version will include the zero-knowledge solution as an experimental feature. For apps and relying parties the requirement level is SHOULD, not SHALL.

What is SHALL is the mechanism that shipped instead.

Thirty cards

On 15 April 2026 the Commission released a white-label age verification app for member states to adapt — translatable into national languages, with its privacy features locked against modification.

Unlinkability in that app is achieved without zero-knowledge proofs. The specification is direct about it: “Initially, the solution will rely on batch issuance to protect users from colluding RPs. Zero-Knowledge Proof (ZKP) mechanisms will be considered.”

Batch issuance works like this:

“Since Proof of Age Attestations are designed for single use, the system must support the issuance of attestations in batches. It is recommended that each batch consist of thirty (30) attestations.”

The app receives thirty proofs and stores them. Entering a site spends one, and that one is discarded — an app “SHALL use a Proof of Age attestation only once and then remove it from the batch.” Reusing a card would let two sites compare notes and recognise the same person.

When the thirty run out, the passport comes back out of the drawer. The specification requires re-identification “at least every 3 months,” and a proof stays valid for three months at most. Spending them slowly does not help; the clock runs anyway.

Denmark, France, Greece, Italy and Spain are building national apps on this. The technical portal counts seven states integrating it into national wallets, adding Cyprus and Ireland — a different thing being counted. As of April 2026 the Commission described the app as technically ready and coming to citizens soon. It is not yet a thing in general public hands.

Blurring the clock

One clause in the same section shows what kind of engineering this is.

Each proof carries validity timestamps. The issuer is instructed to set them imprecisely — the same hour, minute and second across every proof in the batch — because those timestamps “can provide linkability clues.”

A precise issuance time is a fingerprint. Two sites comparing millisecond-accurate timestamps would discover that thirty cards belong to one person. So the clock is deliberately smudged.

That clause is the tell. Forgetting does not happen by default. It is not achieved by deciding not to keep records. Every trace that could link two moments has to be found and erased on purpose.

Manufactured forgetting has a price, and the price shows up somewhere.

A system that does not remember cannot renew you

The premise this piece works from:

What if it were already the default that institutions are designed not to remember you?

There is no need to imagine it. Five countries are building the app.

What breaks earliest in that world is not privacy. It is renewal.

The specification explains why the passport has to come back out, and the explanation is mechanical:

“Automatic attestation re-issuing is not in scope for the white label app deployment. A refresh token could theoretically be used to re-issue the Proof of Age attestation. However, since the claims do not contain the date of birth, the user would need to repeat the enrolment process to recalculate the claims.”

Three steps.

1. The credential does not carry the date of birth. That is the point of the design — the fact of being over eighteen travels, the birthday stays home
2. So there is nothing left to compute a renewal from. The server does not know who you were, and is not supposed to
3. So you start over

Erasing the context is what makes renewal impossible. That is not an interpretation laid over the document. It is the document’s own causal chain.

Who pays

Memory is another word for convenience.

A bank that remembers you does not ask for identity papers on every visit. A clinic that remembers you does not repeat last month’s test. Institutional memory is a privacy hazard and an exemption from repetition, at the same time and for the same reason.

Removing the memory removes the exemption. An exemption that disappears does not vanish — it transfers.

In the age verification app the transfer looks like this: find the passport, open the app, hold the machine-readable zone to the camera, match a face. Once every thirty visits, or once a quarter, whichever comes first.

That cost does not appear on an institution’s infrastructure bill. It is charged in the user’s hands and minutes.

It also does not arrive evenly. Someone whose passport is in a desk drawer and someone whose passport expired eighteen months ago receive very different versions of the same invoice. So does someone whose old ID card scans badly. The structural pattern is familiar: the people with slack pay less.

Paid differently, and not yet paid

Two other places have taken this question somewhere else.

The Netherlands has been running the alternative for years. Yivi, built on the Idemix scheme and maintained by the Privacy by Design Foundation out of Radboud University, provides multi-show unlinkability: a verifier seeing the same attributes twice cannot tell whether that was one person or two. The city of Nijmegen offers it alongside the national DigiD login. But it was not free either. Yivi’s own documentation lists what Idemix lacks — it is not elliptic-curve based, and it has no hardware binding, the feature that ties a credential to a phone’s secure chip. And on 22 June 2026, Yivi 8.0 described itself as “the structural moment Yivi stops being an IRMA wallet that speaks OpenID and becomes a credential-format-agnostic wallet that happens to also speak IRMA.” Becoming a European wallet means other formats move to the front. Its scale, as of November 2023, was in the low hundreds of thousands. Evidence that the thing runs; not evidence that it spread.

Switzerland has not settled the price yet. On 6 December 2024 the federal e-ID office published a definition of unlinkability and, in the same post, its limit: “unlinkability cannot be guaranteed in cases where personal data is disclosed in plain text.” Official documents that print the promise and the caveat together are rare. Open the actual technology stack, though, and it is SD-JWT VC with ECDSA P-256; BBS does not appear. Then, on 30 June 2026, the launch slipped. The federal wording: “To ensure that user data protection and security are maintained, further work is needed, which will delay the introduction of the e-ID… the trust infrastructure is expected to become operational in the first half of 2027.” The statement does not name unlinkability as the reason.

One paid in capability and stayed small. One could not settle on a price and paid in time.

Objections

“Thirty is a starting parameter. Raise it.” Fair, and it will probably rise. But raising it stretches the interval rather than removing the conflict, and the three-month ceiling is bolted on separately. Three hundred cards still end at a passport scan in ninety days.

“Zero-knowledge proofs are landing. This solves itself.” It is landing. The Android app shipped “EUDI Wallet Core 23.0-SNAPSHOT with Zero-Knowledge Proof (ZKP) configuration” in its January 2026 release and still loads Longfellow circuits today; iOS added the same library on 10 July 2026. This is not a story about a promise that went unbuilt. But the specification still files that work under experimental features, and the annex still records that the chosen scheme has not been peer-reviewed. Implementation is running ahead of the normative document. What the document requires is batch issuance — and the thirty cards and the three months come from that requirement. What is striking is that the Commission has already named the trap. The same §6.2 continues: “For this reason, refresh tokens are only practical when used in combination with zero-knowledge proofs.” The conflict is understood and the direction of the fix is understood. The timing is what the document does not say.

“Yivi proves it can be done.” Half true. Idemix buys unlinkability by giving up hardware binding. Put one requirement down and another stands up. Which requirement gets put down is the choice this piece is watching.

“Age verification is a minor case. Generalising to identity is a stretch.” It is not being generalised — the argument runs the other way. Age verification is the lightest possible claim: one bit, over eighteen or not. If the lightest claim costs thirty cards and a quarterly passport scan, the question is what the heavier ones cost. Qualifications. Income. Medical history.

It already runs, every day

Unlinkability is not a pending future. It is operating at internet scale right now.

Anyone who has loaded a website on a recent iPhone without being asked to prove they are human has been through it. Apple’s Private Access Tokens, built on Privacy Pass: Apple attests the device, Cloudflare or Fastly issues the token, the roles are split so neither side holds the whole picture, and blind signatures make the moment a token was issued unlinkable to the moment it was spent.

It runs smoothly for one reason.

That token proves “a human” and nothing else. There is no accumulated context to lose by forgetting, and nothing to renew. Run out of tokens and more arrive quietly. No drawer, no passport.

The age verification proof carries “over eighteen” and nothing else. Nearly the same weight. Yet running out means finding the passport.

One difference separates them. A humanity token does not have to look at a real identity document. The age proof has to look at one, once. And once you decide not to remember that single look, the single look repeats.

So the question is not whether unlinkability is worth having. It is. The question is what comes after.

The party that decides to forget and the party that pays for the forgetting are not the same party.

In Europe right now that payment is being charged to a passport in a drawer. In the Netherlands it was charged to hardware binding. In Switzerland it has not been fixed, so it is being charged to the calendar.

Three places, three currencies, one purchase. The price is being set this year, and the people who receive the invoice are mostly not in the room.

The judgement is left to the reader.