On 23 June 2026, the European Parliament's economic affairs committee approved the digital euro framework by 43 votes to 14. The timeline is firming up: legislation expected to be adopted during 2026, pilot transactions in mid-2027, a possible first issuance in 2029. And as the project moves forward, one question is settling at the centre of the debate: what happens to privacy when money goes digital?
The ECB's answer is a strong formula: privacy "comparable to cash". A serious commitment or a reassuring slogan? Here is what the project actually provides, what data protection authorities say about it, and the deeper question this debate raises for all your financial data.
Two payment modes, two levels of privacy
The digital euro will not be a single system but two payment modes with very different logics. The whole privacy analysis hinges on this distinction.
Online mode: pseudonymisation as the safeguard
For everyday payments, the digital euro will run on accounts managed by intermediaries: banks and payment service providers. Your bank will see your transactions, as it does today, with the same anti-money-laundering obligations.
The novelty lies at the central bank level. Before forwarding a payment order to the ECB's infrastructure, the intermediary will replace your identity with a technical identifier. The ECB will see flows, not names. It states that it does not want access to personal identification data.
Offline mode: the only true "comparable to cash"
For small amounts, an offline mode is planned: digital euros stored locally on your device (phone or card), settlement happening directly between payer and payee, and transaction details known to them alone. No central ledger, no server to query.
This is the mode, and this mode only, that the ECB compares to cash. The nuance matters: "cash-like" privacy does not describe the digital euro in general, but its offline variant.
The guarantees written into the project
The text under discussion sets several explicit safeguards. First, the refusal of any programmability: the digital euro will be money, not a conditional voucher whose use could be restricted in time or by spending category.
Second, coexistence with cash: the legislative package includes a text guaranteeing access to banknotes, positioning the digital euro as a complement, not a replacement.
Third, a holding limit, under study between 500 and 3,000 euros, designed to protect bank deposits. The direct consequence: the digital euro is designed as a payment instrument, not a store of value.
What data protection authorities say
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) welcome the project's general direction in a joint opinion, and national regulators such as Germany's BfDI have set their own conditions. Their analyses point to three precise limits.
One, pseudonymisation should become a legal obligation. Today it is an architectural choice, and therefore a revocable one. What one internal policy decides, another can undo.
Two, retroactive de-pseudonymisation remains theoretically possible. By cross-referencing flow data with other sources, a technical identifier can be linked back to a person. The authorities call for dynamic identifiers, renewed at regular intervals, to close that door. They also note that a central access point concentrating the payment flows of the entire euro area would be a prime target for cyberattacks.
Three, even the offline mode has its limits. The EDPB has shown that physical proximity between two devices cannot be absolutely guaranteed in a digital system, as relay attacks can carry an NFC signal over the internet.
The overall verdict from Europe's privacy regulators is unambiguous: without solid privacy, the digital euro is doomed to fail, for lack of adoption by citizens.
Guarantee by promise, guarantee by architecture
This technical debate reveals a distinction that goes far beyond the digital euro. There are two families of privacy guarantees.
Guarantees by promise: a legal text, an institutional commitment, an internal policy. The online mode's pseudonymisation belongs to this family. These guarantees are real, but they live in the legal world: they can be amended, often quietly, sometimes with effect on data already collected.
Guarantees by architecture: the offline mode is the example. When no central ledger exists, there is nothing to promise, nothing to audit, nothing to shield from view. Weakening this guarantee would require changing the system itself: a visible change, and one that cannot apply retroactively to data that never left your device.
And here lies the project's most instructive paradox: when the ECB went looking for privacy truly comparable to cash, it ended up with local storage. The best-protected data is the data that goes nowhere.
The same question applies to your wealth
This reasoning applies word for word to your portfolio data. Most wealth tracking tools work in "online" mode: your positions, allocation and history live on a provider's servers, protected by guarantees by promise, a privacy policy and terms of use that can change.
Tukhe chooses architecture. The app is local-first by design: your portfolio data stays on your machine, with no third-party server to protect and no policy to amend. This is not a stance born of the digital euro debate; it is the same conclusion, drawn for another type of financial data.
What to take away
The digital euro is neither the surveillance tool its critics describe, nor a perfect digital equivalent of cash. The project contains serious guarantees, grey areas documented by the regulators themselves, and a text still under negotiation whose final balance is not set.
In the meantime, this debate offers a valuable reading grid, applicable to any tool that touches your money: does this privacy rest on a promise or on an architecture? The answer does not tell you who is honest. It tells you who does not even need to be trusted.
Tukhe is a local-first portfolio tracking application, designed for European investors who want to keep control of their data. This article is educational and does not constitute investment advice.
