European Digital ID Wallets: A Windfall for Google and Apple

European governments are currently deploying digital identity wallets designed to allow citizens to verify their age online and access essential services. However, as highlighted by Android Authority and Follow the Money, a critical flaw exists: these wallets are built upon the proprietary safety frameworks of two tech giants: Google and Apple.

Specifically, these systems utilize Google Play Integrity API and Apple’s Managed Device Attestation.

Understanding "Remote Attestation"

At its core, these services provide remote attestation. This is a security process used to confirm that a specific application is running on hardware that has not been compromised or tampered with.

While this sounds like a standard security measure, the EU-wallet implementation is symptomatic of a broader crisis: by integrating private safety services into public infrastructure, Europe is risking systemic dependency on corporate entities, effectively serving their business interests.

---

The Mechanism of Control: Google Play Integrity API

The Google Play Integrity API is more than a security tool; it is a mechanism for maintaining dominance over the Android ecosystem. Google provides this software to developers for free, allowing them to verify if an app is running on a "genuine certified Android device."

While this helps prevent:

• Bot abuse
• Banking fraud
• Cheating in mobile games

It simultaneously functions as a gatekeeper. The API checks if the device is running a Google-licensed version of Android. Any unlicensed alternative is flagged as a security risk. Because Google uses the Play Store as the "source of truth," it verifies both the app's integrity and its installation source.

The result? The service is engineered to:

1. Exclude non-licensed operating systems.
2. Force installations via the Google Play Store.
3. Mandate the use of a Google account.

Comparing Attestation Methods

---

The Paradox of European Sovereignty

The European Union frequently claims it wants to break big tech monopolies $\rightarrow$ reinforce big tech monopolies by embedding these APIs into public architecture.

When nations like Italy and the Netherlands implement Play Integrity, they effectively alienate users of "de-Googled" operating systems (such as GrapheneOS or e/OS). In this scenario, governments stop being neutral service providers and start acting as enforcers for a private company's platform policies.

"ID wallets are not just any kind of software—they are key means to access government documents and manage logins to public services."

This creates a fundamental tension with the EU's stated goals of technological sovereignty, inclusiveness, and the interoperability mandates underpinning the identity wallet regulations.

The Logic of Access

If we define access to public services as a function of hardware and ecosystem compliance, the formula looks like this: $\text{Access} = \text{Hardware Integrity} \cap \text{Corporate Ecosystem License}$ For a sovereign citizen, the equation should simply be: $\text{Access} = \text{Hardware Integrity}$

---

The "Mobifree" Findings and Public Infrastructure

The EU-funded Mobifree project spent two years researching why users switch to de-Googled software. Out of 120 testers, a primary barrier to adoption was the lack of compatibility with critical apps, specifically:

• Payment systems
• Government identification apps

If a citizen cannot use their government ID wallet because they chose a privacy-focused OS, the incentive to leave the Google/Apple ecosystem vanishes. This creates a "lock-in" effect that stifles digital autonomy.

A Fragmented Governance Approach

The current chaos stems from the Architecture Reference Framework (ARF) provided by the EU. While the ARF doesn't force the use of Google/Apple attestation, it recommends it. This has led to an inconsistent rollout across member states:

• Italy & The Netherlands: Have adopted Play Integrity unconditionally, treating the recommendation as a mandate.
• Switzerland: Has rejected Play Integrity due to concerns over data sovereignty and freedom of choice, opting instead for Android’s standard attestation mechanism.

The Path Forward

To truly achieve digital autonomy, the EU must pivot its strategy.

Required Actions for the EU:

• Remove Google and Apple attestation from the Architecture Reference Framework.
• Mandate the use of open, hardware-based attestation mechanisms.
• Ensure interoperability across all OS versions, regardless of licensing.

By following the example of Switzerland, Europe can ensure that public infrastructure remains public, rather than becoming a "gift" to the world's largest tech platforms.