Designed to Forget You

Two documents, written two years apart, are worth reading side by side.

The earlier one dates from June 2024. The European Commission had shown sixteen cryptographers the design of its planned digital identity wallet, and they wrote back. Among them were Camenisch, Lysyanskaya, Preneel, Troncoso and Hoepman. They recommended the BBS family of anonymous credentials — digital proofs that can show something about you without revealing who you are. Academic cryptographers have been studying BBS for more than twenty years. Its selling point is that you can show the same credential many times without those showings being linked to one another.

The later document dates from 2026. It is Annex B of the Commission’s technical specification for age verification, and it contains a table that scores five schemes against four requirements.

That table shows why BBS was not chosen. It is printed in the Commission’s own document, and reading it requires no guesswork about anyone’s reasons.

What the table says

Two of the four requirements decide the outcome.

Req02 — “A ZKP scheme SHALL be peer-reviewed by the relevant scientific community.” In standards documents, SHALL marks a requirement as mandatory.

Req03 — “A ZKP scheme SHALL introduce as minimum disruptions to existing infrastructure as possible.” The column that gives the reasoning explains why: the solution “prioritizes a rapid time-to-market strategy by leveraging existing infrastructure wherever feasible.” In plain terms, get it out quickly by building on what already exists.

Here is how the five candidates scored on those two.

Scheme	Req02 peer review	Req03 infrastructure friction
BBS+	pass	fail
BBS+ with ECDSA proof of possession	pass	fail
Pairing-free BBS+	pass	fail
ECDSA Anonymous Credentials ← selected	partial	pass
Crescent	partial	pass

All three BBS variants pass on peer review and fail on infrastructure friction. The scheme that was selected does exactly the opposite.

The annex concludes that ECDSA Anonymous Credentials “appears the most promising due to its compatibility with existing credential formats and issuance flows.”

A few lines earlier, discussing that same scheme, the annex says:

“The solution has not been peer-reviewed.”

Yet Req02 made peer review a SHALL. Section 7 of the specification is titled “Experimental features,” and it opens by saying that the next version will add the zero-knowledge solution as an experimental feature. (A zero-knowledge proof lets you prove a fact — that you are over 18, say — without revealing anything else.) For apps, and for the websites that check the proofs, known in the jargon as relying parties, this is a SHOULD: recommended, not required.

What the specification does make a SHALL is the mechanism that shipped instead.

Thirty proofs, each used once

On 15 April 2026 the Commission released a white-label age-verification app: a ready-made app that member states can adapt and translate into their own languages, but whose privacy features they are not allowed to change.

That app keeps your visits unlinkable without using zero-knowledge proofs. The specification says so plainly: “Initially, the solution will rely on batch issuance to protect users from colluding RPs. Zero-Knowledge Proof (ZKP) mechanisms will be considered.” Colluding RPs are websites that might pool what they know about you.

Batch issuance means the app is handed a supply of proofs in advance:

“Since Proof of Age Attestations are designed for single use, the system must support the issuance of attestations in batches. It is recommended that each batch consist of thirty (30) attestations.”

So the app receives thirty proofs and stores them. Each time you visit a site that checks your age, the app uses one and then deletes it — an app “SHALL use a Proof of Age attestation only once and then remove it from the batch.” If the same proof were shown twice, the two sites could compare notes and work out that the same person had visited both. That is what unlinkability means in practice: a site can check your age, but sites cannot join up your visits.

When the thirty are used up, the passport has to come out of the drawer again. The specification also requires users to identify themselves again “at least every 3 months,” and a proof stays valid for three months at most. Using the proofs sparingly doesn’t help, because the clock keeps running.

Denmark, France, Greece, Italy and Spain are building national apps on this model. The technical portal lists seven countries integrating it into their national wallets — adding Cyprus and Ireland — but that figure counts something different. As of April 2026, the Commission described the app as technically ready and coming to citizens soon. It is not yet in general public use.

Blurring the timestamps

One clause in the same section shows what kind of engineering this involves.

Each proof carries timestamps that mark when it is valid. The issuer is told to make them imprecise, using the same hour, minute and second on every proof in the batch, because those timestamps “can provide linkability clues.”

A precise time of issue works like a fingerprint. If two sites compared timestamps accurate to the millisecond, they could work out that thirty different proofs all belonged to one person. So the clock is blurred on purpose.

That clause is revealing. Forgetting doesn’t happen by default, and simply deciding not to keep records is not enough. Every trace that could connect one moment to another has to be tracked down and deliberately erased.

Forgetting by design has a cost, and someone ends up paying it.

Why the app can’t just renew itself

This piece starts from a premise:

What if it were already the default for institutions to be designed not to remember you?

There is no need to imagine it. Five countries are building the app.

In that world, the thing that breaks down soonest is not privacy. It is renewal — being able to refresh your proof without starting over.

The specification explains why the passport has to come out again, and the explanation is purely mechanical:

“Automatic attestation re-issuing is not in scope for the white label app deployment. A refresh token could theoretically be used to re-issue the Proof of Age attestation. However, since the claims do not contain the date of birth, the user would need to repeat the enrolment process to recalculate the claims.”

A refresh token is a kind of digital key that lets an app get new credentials without the user going through the whole process again. Here is why it doesn’t help, in three steps.

1. The proof does not contain your date of birth. That is the whole point of the design: it tells a site you are over eighteen and keeps your birthday to itself
2. So the server has nothing to calculate a renewal from. It doesn’t know who you were, and it isn’t supposed to
3. So you have to enrol again from scratch

Erasing the context is exactly what makes renewal impossible. This is not an interpretation laid over the document. The document sets out that chain of cause and effect itself.

Who pays

Being remembered is what makes things convenient.

A bank that knows you doesn’t ask for your identity papers every time you walk in. A clinic that knows you doesn’t repeat last month’s test. An institution’s memory of you is a risk to your privacy, and it is also what spares you from repeating yourself. Both follow from the same fact.

Take away the memory and you take away that exemption. But the effort it used to save doesn’t simply disappear. It is shifted onto you.

In the age-verification app, this is what it looks like: find your passport, open the app, hold the machine-readable zone — the lines of code at the bottom of the photo page — up to the camera, and have your face matched. Once every thirty visits, or once every three months, whichever comes first.

None of that appears in any institution’s infrastructure budget. It is paid in the user’s own time and effort.

Nor is the cost spread evenly. Someone whose passport is sitting in a desk drawer and someone whose passport ran out eighteen months ago get very different versions of the same bill. So does someone whose old ID card doesn’t scan well. It is a familiar pattern: those who have more to spare pay less.

The Netherlands and Switzerland

Two other countries have taken this question in different directions.

The Netherlands has been running the alternative for years. Yivi, built on the Idemix scheme and maintained by the Privacy by Design Foundation, which came out of Radboud University, offers what is called multi-show unlinkability: a verifier that sees the same attributes twice cannot tell whether it is dealing with one person or two. The city of Nijmegen offers it as a way to log in alongside DigiD, the national login. But this came at a price too. Yivi’s own documentation lists what Idemix lacks: it is not based on elliptic-curve cryptography, and it has no hardware binding, the feature that ties a credential to the secure chip in a phone. And on 22 June 2026, Yivi described its version 8.0 as “the structural moment Yivi stops being an IRMA wallet that speaks OpenID and becomes a credential-format-agnostic wallet that happens to also speak IRMA.” Becoming a European wallet means putting other formats first. As of November 2023, Yivi had more than 100,000 users. That shows the system works; it does not show that it has caught on.

Switzerland has not yet settled on a price. On 6 December 2024 the federal e-ID office published a definition of unlinkability and, in the same post, its limits: “unlinkability cannot be guaranteed in cases where personal data is disclosed in plain text.” It is rare for an official document to print the promise and the caveat side by side. Look at the technology Switzerland is actually using, though, and you find SD-JWT VC with ECDSA P-256; BBS is not part of it. Then, on 30 June 2026, the launch was pushed back. In the government’s words: “To ensure that user data protection and security are maintained, further work is needed, which will delay the introduction of the e-ID”. The same statement says the trust infrastructure is now expected to become operational between January and June 2027. It does not name unlinkability as the reason.

In the Netherlands, the price was a missing feature, and the system stayed small. In Switzerland, no price has been settled yet, and the cost so far is time.

Objections

“Thirty is just a starting figure. Raise it.” Fair enough, and it will probably go up. But a bigger batch only stretches the time between passport scans; it doesn’t remove the conflict. And the three-month limit applies separately, whatever the batch size. Even a batch of three hundred ends with a passport scan after ninety days.

“Zero-knowledge proofs are on their way. This will sort itself out.” They are on their way. The Android app shipped “EUDI Wallet Core 23.0-SNAPSHOT with Zero-Knowledge Proof (ZKP) configuration” in its January 2026 release, and it still loads Longfellow circuits today; the iOS app added the same library on 10 July 2026. So this is not a story about a promise that went unbuilt. But the specification still lists that work under experimental features, and the annex still records that the chosen scheme has not been peer-reviewed. The software is running ahead of the rulebook. What the rulebook actually requires is batch issuance — and that requirement is where the thirty proofs and the three-month limit come from. Strikingly, the Commission has already identified the trap. The same section, §6.2, goes on: “For this reason, refresh tokens are only practical when used in combination with zero-knowledge proofs.” The conflict is understood, and so is the direction of the fix. What the document does not say is when.

“Yivi proves it can be done.” That is half true. Idemix gets unlinkability by giving up hardware binding. Meeting one requirement means dropping another. Which requirement gets dropped is the choice this piece is watching.

“Age verification is a minor case. Stretching it to identity in general is a leap.” The argument doesn’t stretch it; it runs the other way. Age is the lightest claim there is: a single bit of information, over eighteen or not. If even that costs thirty proofs and a passport scan every three months, what will heavier claims cost? Think of qualifications, income or medical history.

Where it already works, every day

Unlinkability isn’t something waiting in the future. It is already working, at internet scale.

If you have opened a website on a recent iPhone and weren’t asked to prove you are human, you have been through it. Apple’s Private Access Tokens are built on Privacy Pass. Apple vouches for the device, Cloudflare or Fastly issues a token, and the roles are split so that neither side sees the whole picture. Blind signatures, in which the issuer signs a token without seeing it, mean that the moment a token was issued can’t be linked to the moment it was used.

It runs smoothly for one reason.

That token proves you are a human, and nothing else. There is no built-up history for forgetting to lose, and nothing to renew. When you run out of tokens, new ones arrive without you noticing. No drawer, no passport.

The age proof says you are over eighteen, and nothing else — almost as little. Yet when it runs out, you have to find your passport.

One difference separates them. A token that shows you are human doesn’t need anyone to look at a real identity document. The age proof does need one looked at, once. And as soon as a system decides not to remember that single look, the look has to be repeated.

So the question is not whether unlinkability is worth having. It is. The question is what comes after it.

The side that decides to forget is not the side that pays for the forgetting.

In Europe right now, the bill goes to a passport sitting in a drawer. In the Netherlands, it was paid by giving up hardware binding. In Switzerland the price hasn’t been fixed, so for now it is being paid in time.

Three places are buying the same thing, and each is paying in a different currency. The price is being set this year, and most of the people who will receive the bill are not in the room.

The judgement is left to the reader.