EU eIDAS wallets embed Google Play Integrity and Apple attestation in NL and IT pilots

Member states are deploying eIDAS digital identity wallets under Regulation 2024/1183 to enable age verification and government service access. Pilot code in the Netherlands and Italy routes attestation requests through Google Play Integrity API and Apple DeviceCheck, treating non-certified Android builds as integrity failures. Hardware Attestation API remains unused despite providing equivalent key attestation without Google account or Play Store requirements.

Play Integrity API documentation states it verifies device certification, app signature, and installation source against Google servers. This produces a binary verdict that de-Googled distributions fail by design. DMA Article 5(3) prohibits gatekeepers from conditioning core platform access on use of their proprietary services, yet public procurement now enforces exactly that condition for identity infrastructure.

Operational effect is immediate exclusion: GrapheneOS users cannot complete wallet onboarding or access linked services without sideloading Google Mobile Services. Public infrastructure thereby inherits private platform policy enforcement, contradicting stated goals of technological sovereignty and interoperability in the eIDAS implementing acts.

Next regulatory checkpoint is the 2026 conformity assessment cycle. Member states must either switch to open attestation paths or document DMA derogations; failure triggers infringement proceedings under Article 114 TFEU.