Many companies treat identity verification as an obligation to collect everything: a copy of the ID card, the address, the date of birth, a photograph of the face, sometimes a bank statement. The result is a database that is hard to justify under the data minimisation principle and easy to compromise.
The reflex already has a price. In April 2026 ANSPDCP sanctioned an online gambling operator, among other things because, when a person asked where their phone number had been obtained from, the operator asked for a copy of their ID card and a selfie. The authority found that the documents had been collected and stored unlawfully and excessively.
Zero-knowledge proofs (ZKP) offer a different model: prove that a statement is true without passing on the data behind it.
What a zero-knowledge proof is, in brief
A zero-knowledge proof lets a person show that they meet a condition — over 18, resident in a Member State, holding a valid driving licence — without revealing their name, address, personal numeric code or the document the condition comes from.
The verifier receives a cryptographic result it can check on its own: the condition is met or it is not. It does not receive the file.
The mechanism, described in the literature since 1985, has three properties. A true statement always passes verification. A false statement can pass only with negligible probability. And the verifier learns nothing beyond the statement verified.
Selective disclosure is not the same thing. Current digital credential formats already allow a single attribute to be sent — for example, being over 18 — but accompanied by unique technical elements, such as the issuer’s signature, that can be recognised from one check to the next. A zero-knowledge proof removes those as well: two checks of the same person, at different providers, can no longer be linked through the proof.
And the term “zero-knowledge” used by some storage or password management providers means something else: that they do not hold the decryption keys.
Where the technology stands
This is not a laboratory idea.
The revised eIDAS Regulation names it expressly
Recital 14 of Regulation (EU) 2024/1183 states that Member States should integrate into the European Digital Identity Wallet technologies such as zero-knowledge proofs, by which a relying party verifies a statement without learning the data it rests on. Article 5a(16)(b) turns the intention into a requirement: the wallet’s technical framework must enable techniques that ensure unlinkability where the attestation of attributes does not require identification of the user.
The wallet has a deadline
Each Member State must provide at least one wallet by the end of 2026. In Romania, the Ministry of Internal Affairs has announced that enrolment and authentication will use the electronic identity card.
Age verification is the first field of application
The Commission’s guidelines on the protection of minors, adopted in July 2025 under the Digital Services Act, list zero-knowledge proofs among the cryptographic protocols suitable for verifying age without transmitting personal data. Recommendation (EU) 2026/1035, adopted by the Commission in April 2026, recommends that Member States make available, by 31 December 2026, at least one age verification solution built on the European blueprint. Being a recommendation, the date is not binding. The solution confirms only that the user has reached the age threshold, without the exact age or any other data.
The tools exist
The European technical blueprint optionally uses a zero-knowledge proof built on top of existing signed credentials, with a library released as open source by Google in July 2025. And ISO/IEC 27565, an international guideline dedicated to these proofs, was published at the beginning of 2026.
One nuance: in the reference architecture of the European wallet, support for zero-knowledge proofs is planned after launch, and standardisation is ongoing. The first wallets will rely mainly on selective disclosure.
Why the GDPR is interested
Article 5(1)(c) GDPR requires data to be adequate, relevant and limited to what is necessary. Article 25 requires data protection by design and by default: only the data necessary for each purpose is processed, and the rule applies to the amount of data, the extent of processing, the storage period and accessibility.
The same Article requires the controller to take account of the state of the art. The EDPB made clear in Guidelines 4/2019 that the notion is dynamic and is assessed continuously. As wallets become available, keeping a full copy of an ID card to learn a single fact will be ever harder to justify.
The discussion is not theoretical for the Romanian market. The first fine imposed in Romania under the GDPR, in June 2019, concerned Article 25: 130,000 euros for a bank whose online transactions revealed payers’ personal numeric codes and addresses to the payees.
Three reference points complete the picture.
A copy of the ID card is not an ordinary means of authentication
In Guidelines 01/2022 on the right of access, the EDPB states that using it to authenticate the person making a request creates a risk for data security and is, in principle, inappropriate. If a copy has nonetheless been made, the controller should consider deleting it immediately after authentication.
The CNP has a national regime
Article 4 of Law no. 190/2018 allows the personal numeric code to be processed on legitimate interest, including by collecting documents that contain it, only with safeguards: data minimisation, retention and erasure periods, periodic staff training and the appointment of a data protection officer. A company that copies identity cards on that basis without a DPO already has a problem, whatever the technology.
A photograph of the face is biometric data
The EDPB considers that both biometric identification and biometric verification involve processing special categories of data under Article 9 GDPR (Opinion 11/2024). The AI Act excludes biometric verification from the high-risk category of remote biometric identification systems (Annex III), but that exclusion changes nothing under the GDPR.
Against this framework, a zero-knowledge proof helps in four ways:
- you collect less: a fact, not a document;
- you store less: the archive of ID copies and photographs disappears;
- you reduce the severity of an incident: an identity cannot be stolen from a record of pass or fail results, and the risk assessment after a personal data breach starts from a different level;
- you can argue more easily, in a data protection impact assessment, that you chose the least intrusive option.
Who remains responsible
The technology does not take the processing out of the GDPR. It only moves its centre of gravity.
The issuer of the credential — the authority or provider that checks the documents — processes full data and remains the controller for that processing. The wallet provider may not collect information about use that is not needed for the service. The company that requests the proof is the controller for the result it receives and for what it does with it. A verification service provider working for it will usually be its processor. Roles follow how the flow is built, however, not the label in the contract.
A company that accepts the European wallet also becomes a relying party under the eIDAS Regulation. It registers in the Member State where it is established and declares the data it will request. It may not ask users for data other than what it declared. Data minimisation thus becomes a technical condition of access, not merely a principle.
Two further points matter:
- use of the wallet is voluntary for users, and those who do not use it may not be restricted in their access to services. You will also need an alternative route, built with the same care;
- for some companies, accepting the wallet will not be optional. Private relying parties required to identify their users online with authentication of at least two factors — including in banking and financial services, transport, energy, health and telecommunications — must accept it at the user’s request within 36 months of the entry into force of the implementing acts, that is, towards the end of 2027. So must very large online platforms that require user authentication, for the minimum data the service needs.
Two concrete examples
Age verification
An online shop selling products prohibited to minors, or a platform with adult content, needs a single fact: the user is at least 18.
In the classic model, the customer uploads a photograph of their ID card and sometimes a photograph of their face. The company learns the customer’s name, personal numeric code, address, exact date of birth and face, and keeps them for months or years for a yes-or-no answer.
The zero-knowledge model works differently:
- 1
an authority or identity provider checks the documents once and issues an electronic credential to the wallet on the user’s phone;
- 2
the shop asks only for the proof it needs: over 18;
- 3
the user’s app generates the proof;
- 4
the shop verifies the proof mathematically and keeps only a minimal record of the check — no document copy, no date of birth, no photograph.
| Classic model | Zero-knowledge proof | |
|---|---|---|
| What the company receives | a copy of the ID, sometimes a photograph of the face | confirmation that the age threshold is met |
| What it keeps | documents, for months or years | a minimal record of the check |
| Biometric data | often | no |
| What an incident exposes | customers’ full identity | the fact that an account passed a check |
The Digital Services Act points the same way. Article 28(3) does not require online platforms to process additional data in order to assess whether a user is a minor, and the Commission’s guidelines recommend “double-blind” methods: the platform receives no additional means of identifying the user, and the verification provider does not learn which services the proof is used for.
A crypto-asset exchange
Here the example needs care, because anti-money laundering law comes in.
A crypto-asset exchange is an obliged entity. Romanian Law no. 129/2019 requires it to identify the customer and verify their identity on the basis of reliable and independent sources, including the electronic identification means provided for by the eIDAS Regulation. It also requires it to keep copies of identification documents and information obtained through electronic identification means for 5 years after the end of the business relationship. Regulation (EU) 2024/1624, applicable from 10 July 2027, keeps the same logic.
A zero-knowledge proof cannot, therefore, replace customer identification. Nor can sanctions screening be shifted onto the customer: it remains the exchange’s obligation.
What does change:
- identification can be done with verified data presented from the European wallet, instead of photographs of documents and of the face. Biometric processing and the image archive can disappear;
- eligibility before account opening — residence, for example — can be checked with a proof, without collecting data from people who will not become customers anyway;
- anything collected beyond the legal requirement and the exchange’s own risk assessment becomes hard to defend.
For an obliged entity, the gain lies in the verification method and in collection discipline, not in giving up verification.
What a zero-knowledge proof does not solve
It does not remove the initial check
Someone has to have seen the documents once: the issuer of the credential, at enrolment. The full data still exists, with the issuer.
It does not take the company out of the GDPR
The verification result, tied to an account, a session or an IP address, usually remains personal data. Information to data subjects, the record of processing activities and, if the risk remains high, a DPIA all still apply.
It does not guarantee a correct implementation
In April 2026, a few days after the Commission announced that the European age verification app was ready, security researchers showed that its PIN and biometric protection could be bypassed on the device. The Commission replied that it was a demonstration version. The problem lay in the application, not the cryptography: the mathematics can be sound and the product vulnerable.
It is not a standard imposed in Romania
ANSPDCP does not require zero-knowledge proofs. It does, however, already sanction the excessive collection of ID copies. The principle applies now; the technology only makes it easier to respect.
The data minimisation principle already applies, whether or not you use a new technology. A copy of an ID card kept to learn a single fact is hard to justify today, with today’s tools.
What a company should do now
- 1An inventory of the points where you ask for identity documents
account opening, delivery, data subject requests, recruitment, access to premises. For each: which fact you need, and on which basis.
- 2Separate the fact from the document
Where you need a fact (age, being the account holder, residence), do not keep the document. If you see the ID, record the check; do not copy it.
- 3The safeguards for the CNP
If you process it on legitimate interest, check the conditions in Article 4 of Law no. 190/2018.
- 4Real retention periods
Copies the law does not require are deleted after the check. Those the law requires are kept exactly as long as the law says.
- 5The minimisation alternative in the impact assessment
If you are assessing a new identity verification system, document the option based on electronic attestations and the reasons for choosing it or not.
- 6Clauses with verification providers
what data they receive, how long they keep it, where they process it, and whether they also use it for their own purposes.
- 7Preparing for the European wallet
If you operate in a sector required to accept it, plan the registration as a relying party and the list of data you will request. The list has to be minimal from day one: you will not be able to ask for more than you declared.
Where we can help
The technical part stays with your provider. We help you establish what data you are entitled to request and how long you may keep it: the inventory of points where you collect identity documents, the basis and safeguards for the CNP, retention periods, the data protection impact assessment for a new verification system, the clauses with providers and the information to data subjects.
To discuss your flows, write to office@dataconsulting.ro.
The analysis reflects the legal framework as at 29 September 2026: Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018; Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183; Regulation (EU) 2022/2065 on digital services, the Commission guidelines adopted under Article 28(4) and Commission Recommendation (EU) 2026/1035; Law no. 129/2019 and Regulation (EU) 2024/1624.
Frequently asked questions
Do zero-knowledge proofs mean we no longer apply customer due diligence (KYC)?
No. They mean you can verify a requirement without copying the whole file at every intermediary. Where the law requires identification, identification remains.
If we only receive a proof, are we still processing personal data?
It depends on what the proof contains and whether it can be linked to a person. In case C-413/23 P, judgment of 4 September 2025, the Court of Justice held that the same data can be personal data for the party that transmits it and not for a recipient that has no reasonable means of identifying the person. In practice the verification result is tied to an account or a session, so it usually remains personal data, but the processing is much narrower than in a classic check.
Can we implement this tomorrow in an online shop or a fintech company?
Rarely as a complete solution. National wallets are only now being launched, and support for zero-knowledge proofs will come in stages. It is worth adopting as an architectural direction and as a data minimisation argument, not as an immediate legal exemption.
Will the European wallet be mandatory?
Not for users. For companies in regulated sectors that authenticate users online with at least two factors, and for very large online platforms that require authentication, accepting it at the user’s request will be mandatory.
Is a zero-knowledge proof anonymisation?
No. The issuer still holds the full data, and the verifier usually receives information tied to an account. It is a data minimisation technique, not a way out of the scope of the GDPR.