Self-Sovereign Identity and eIDAS 2.0: An Analysis of Control, Privacy, and Legal Implications

Abstract

European digital identity initiatives are grounded in regulatory frameworks designed to ensure interoperability and robust, harmonized security standards. The evolution of these frameworks culminates in eIDAS 2.0, whose origins trace back to the Electronic Signatures Directive 1999/93/EC, the first EU-wide legal foundation for the use of electronic signatures in cross-border electronic transactions. As technological capabilities advanced, the initial eIDAS 1.0 framework was increasingly criticized for its limitations and lack of comprehensiveness. Emerging decentralized approaches further exposed these shortcomings and introduced the possibility of integrating innovative identity paradigms, such as Self-Sovereign Identity (SSI) models. In this article, we contribute to the ongoing legal and policy debate on the European Digital Identity Framework by analyzing key provisions of eIDAS 2.0 and its accompanying recitals, drawing on a systematic literature review guided by defined Research Questions (RQ). This work employs a structured methodological approach that combines descriptive and comparative analysis, systematic gap analysis supported by a defined scoring matrix, and normative analysis to evaluate the compatibility of SSI properties with eIDAS 2.0 regulation, as operationalized via its Architecture and Reference Framework (ARF). Furthermore, we assess the ARF's guidelines and examine the extent to which it aligns with SSI. The analysis adopts a complementary perspective demonstrating how the regulation can be further developed to better support SSI in the future by identifying existing limitations and potential adoption opportunities within the current legal foundations of the framework.