The Italian digital identity wallet only supports Google-certified Android devices

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

Overview of IT-Wallet and its technical requirements

"IO, l'app dei servizi pubblici" (IO hereinafter) is an app developed by PagoPA S.p.A., a State-owned enterprise which develops tools to make digital public services available in Italy. The app can be downloaded on Android and iOS.

One of the services offered by IO is *Documenti su IO* (IT-Wallet hereinafter), a wallet containing digital identification documents, as defined by the eIDAS regulation.

To be able to access the IT-Wallet, the user needs to satisfy certain device integrity requirements, which the app's F.A.Q.s define as (translated from Italian):

The device should not be compromised, that is, it should not be modified in such a way as to remove the security restrictions imposed by the operating system (for instance, jailbreak on iOS or rooting on Android). Furthermore, it is necessary that the app being executed is the official one, downloaded and signed from the Android and Apple stores (respectively, Play Store and App Store).

On Android, these integrity requirements are checked with the Play Integrity API.

The distribution policy and the implementation of the integrity checks highlighted above pose two issues discussed in the next sections.

Exclusive distribution on Google Play Store

IO is distributed on Android exclusively via the Google Play Store, which may not be available on all devices or the user may be running a non-Google licensed or non-Google compatible version of Android, which could not include the Play Store or may not even be eligible to include it. Moreover, users may wish not to install Google services on the device themselves in favor of alternatives.

Android devices are not only those running a version of the OS commercially licensed by Google to include the proprietary Google Mobile Services (GMS), a collection of proprietary applications and APIs from Google, containing Google Play and Google Play services. Devices running Android versions based on or stemming from the Android Open Source Project or devices produced by an OEM with an agreement with Google that does not include GMS should also be taken into consideration.

Manufacturers wishing to ship devices with GMS and the Play Store pre-installed are required to enter into an agreement with Google. Google's position in the app distribution market can be seen as concerning for market competition, as it could represent a barrier to emerging distribution channels and app stores.  The European Union itself designated Alphabet (the parent holding company of Google) as a gatekeeper — a large digital platform providing core platform services, that needs to comply with specific regulations set forth in the Digital Markets Act — with respect to its Google Play platform. One of the purposes of the DMA is to enforce the right of European citizens to have the choice to install preferred apps directly from the web or alternative app stores.

Note that the European Digital Identity Wallet Architecture and Framework Reference explicitly states that wallets can be made available "on other means than the official OS app store".

Use of Play Integrity API

The Google Play Integrity API is part of Google Play and its strong integrity check is not compatible with devices running on alternative operating systems. This issue has been reported by the GrapheneOS developers and by IO users.

A more universally compatible solution to check the integrity of the device would be the standard Android hardware attestation API, which would support non-Google alternative operating systems via the whitelisting of their keys.

Impact

The design choices of the IT-Wallet make it so that the service is only accessible to Italian citizens using one of two core services from Apple and Google, two foreign companies designated as gatekeepers by the EU Digital Markets Act. Furthermore, Android users can only use the IT-Wallet if they have a Google-certified device and OS.

Distributing the app on Android via channels other than Google Play and performing integrity checks via the hardware attestation API instead of the Google Play Integrity API would enable users to access the service on alternative devices and operating systems, not restricting it to services with a dominant position in the market.