EU digital identity, in plain language

Compliance

Age assurance

Age assurance is the umbrella term for any method of establishing that someone is old enough to do something. It splits into age verification, which proves age from an authoritative source, and age estimation, which infers it from a face, a voice or behaviour. The difference matters legally, because a regulator asks not just whether you checked but how well.

Compliance

Highly effective age assurance (HEAA)

Highly effective age assurance is the standard the UK Online Safety Act sets for services that must keep children away from adult content. Ofcom judges it against four criteria: technically accurate, robust, reliable and fair. It is a higher bar than "we asked", and Ofcom has named methods that do not clear it.

Compliance

Relying party

A relying party is whoever asks an EU Digital Identity Wallet for data and relies on the answer, which in practice means your service. The EU framework makes it a registered role, not an informal one: you register with a national authority, and that registration is what eventually gets you the access certificate a wallet checks before releasing anything.

Credentials

Selective disclosure

Selective disclosure is the ability to reveal some claims from a signed credential while keeping the rest hidden, without breaking the issuer's signature. It works by signing digests of salted values rather than the values themselves, so the holder can hand over only the values they choose and the verifier can still check every one against what was signed.

Credentials

SD-JWT VC

SD-JWT VC is a verifiable credential format built on JSON Web Tokens with selective disclosure added, so a holder can reveal individual claims from an issuer signed credential. It is one of the two formats the EU Digital Identity Wallet uses, the other being ISO mdoc.

Credentials

mdoc and mDL (ISO/IEC 18013-5)

An mdoc is a mobile document in the ISO/IEC 18013-5 format, a CBOR-based credential best known as the mDL, the mobile driving licence. It is one of the two formats the EU Digital Identity Wallet uses, and the EU age verification attestation is an mdoc.

Credentials

Person Identification Data (PID)

Person Identification Data, or PID, is the core identity credential in the EU Digital Identity Wallet: the attested set of attributes that establish who someone is, issued by a member state designated PID provider. It is the wallet's identity document, and it carries a name and a date of birth.

Credentials

EU age verification attestation (eu.europa.ec.av.1)

The EU age verification attestation is a credential, doctype eu.europa.ec.av.1, that carries nothing but a set of age_over_N booleans. No name, no date of birth, no document number, no portrait. It exists so a service can check someone is old enough without learning anything else about them.

EUDI infrastructure

Wallet-relying party access certificate (WRPAC)

A wallet relying party access certificate, or WRPAC, is the certificate that proves to an EU Digital Identity Wallet that you are a registered relying party. Without one the wallet refuses your request outright, before any data is shared and before the user is even asked.

eIDAS trust infrastructure

EU trusted list and the LOTL

An EU trusted list is a signed, machine readable list that a member state publishes of the trust service providers it has qualified under eIDAS. The LOTL, or List of Trusted Lists, is the European Commission's list pointing at all of them, and it is the root you start from when you want to know whether a certificate is genuinely qualified.

EUDI infrastructure

IACA (Issuing Authority Certificate Authority)

An IACA, or Issuing Authority Certificate Authority, is the root certificate authority an mdoc issuing authority operates. Trust in an mdoc is decided by whether its Document Signer certificate chains to an IACA root the verifier already holds, so the IACA list is the mdoc equivalent of a trusted list.

Protocols

OpenID for Verifiable Presentations (OpenID4VP)

OpenID for Verifiable Presentations, or OpenID4VP, is the protocol a verifier uses to ask a wallet for credentials and receive the presentation back. It is format neutral: the same exchange carries SD-JWT VC and ISO mdoc, and it is what the EU Digital Identity Wallet uses.

Protocols

DCQL (Digital Credentials Query Language)

DCQL, the Digital Credentials Query Language, is how an OpenID4VP request states which credentials it wants and which claims from them. It replaced the earlier Presentation Exchange syntax in OpenID4VP 1.0, and it asks for a claim by name; it does not constrain what that claim's value may be.