CBDC Privacy Debate: Who Sees Your Digital Euro, e-Rupee or e-CNY?

A pharmacist in Leipzig who still keeps a cash drawer will tell you why: some customers buy things they would rather nobody recorded. That instinct, more than any economics paper, is what CBDC designers are up against. Every central bank planning a digital currency for the public now spends as much time explaining what it will not see as what it will do.

What people are actually afraid of

The fear is not abstract. When the ECB ran its public consultation on a digital euro in 2021, more than a third of respondents ranked payment privacy as the most important feature, ahead of everything else, a result summarised in a 2026 critical review of the digital euro by Cannataci and co-authors. The same paper cites the ECB's 2024 SPACE study, in which 42% of respondents named privacy as a top advantage of cash.

The worries come in three layers. The first is surveillance: a state that can see every payment can profile political donations, medical purchases or religious giving. The second is control: money that can be blocked, capped or made to expire, the subject of our piece on programmable e-rupee. The third is plain data security: a central database of balances is a target. A design can answer one layer well and fail another.

The tiered privacy model, explained

Most central banks have converged on some version of tiered privacy. The logic mirrors anti-money-laundering rules for cash: small and local can be private, large and remote must be traceable.

• Tier 1, offline and small. Device-to-device payments with low limits, where the record stays on the two devices. The closest thing to cash.
• Tier 2, online and everyday. Payments pass through a bank or payment service provider that knows the customer, while the central bank sees only pseudonymised data, if anything.
• Tier 3, large or flagged. Fully identified and traceable, with access for law enforcement under existing legal procedures.

India's version is called managed anonymity. The RBI's 2022 concept note summarised the principle as anonymity for small values and traceability for high values. China's e-CNY has used a similar idea; a 2021 China Daily report noted that e-CNY wallets could be opened without a linked bank account for a limited number of transactions. And the BIS Project Polaris research found 44% of central banks believe offline CBDC should offer more privacy than online, according to Ledger Insights.

The model sounds tidy. The arguments are about the boundaries: how small is small, who decides, and how easily those thresholds can be moved later.

The ECB's commitments, and the critics' reply

Europe has made the most explicit promises. For offline payments, the ECB's first progress report on the digital euro says only the two parties would know personal transaction details, with nothing shared with payment providers or the Eurosystem. For online payments, the ECB says the Eurosystem would not be able to directly identify users, with data pseudonymised and encrypted, while supervised intermediaries carry out the same anti-money-laundering checks they do today. In September 2025, executive board member Piero Cipollone went as far as saying the central bank would know nothing about the two sides of a payment, as Reclaim The Net reported.

Critics are not convinced. The Cannataci paper argues that every online payment would be visible to the payment service provider, that the ECB would keep a central record of account balances, and that settlement data would be "at best pseudonymized". Pseudonymous data, in their view, is a short step from identified data once it is combined with other records. Civil society groups, including the German Informatics Society, see the decline of cash and the arrival of a digital euro as a threat to informational self-determination, and a group of 70 economists and academics wrote to the European Parliament asking for a privacy-preserving, offline-capable design.

Both sides have a point. The ECB's technical commitments are real and go beyond what card networks offer today. But commitments in a design document are weaker than limits in law, and online privacy depends on banks and regulators as much as on the ECB. More on the project itself in the digital euro explained.

Where the law stands in July 2026

The legislative fight has moved privacy from an engineering topic to a political one. The Council of the EU agreed its negotiating position in December 2025, backing online and offline use with a high degree of privacy offline, according to a Lewis Silkin note. On 23 June 2026, the European Parliament's economic and monetary affairs committee approved its position by 43 votes to 14 with one abstention, as Crowdfund Insider reported. The committee text writes in privacy by design and by default, verification methods that do not reveal unnecessary personal details, and no ECB access to identifying information. Offline payments use secure local storage and carry no fees. A plenary vote is due in July, after which negotiations with the Council can begin.

Holding limits are part of the privacy story too, though they are usually discussed as a stability tool. A per-person cap limits how much of a household's financial life can sit in the instrument at all. EU finance ministers agreed a process for setting the cap in September 2025 without agreeing the amount, and ECB staff analysis has used an illustrative ceiling of €3,000.

Worked example: one month, three payments

Consider a payroll administrator in Porto, after a hypothetical launch, holding a digital euro wallet under an assumed €3,000 cap. Over one month she makes three payments. The table shows who would see what under the ECB's described design.

Two things stand out. The €25 cafe payment is genuinely more private than a card payment is today. The €140 online purchase is about as private as a card payment, no worse and no better. So the honest summary is that a digital euro would add a cash-like option for small in-person payments while leaving online privacy roughly where it is. Whether that is enough depends on how much of daily life is offline and small, which is shrinking.

This is an illustration of a design that has not been finalised; the cap, the offline limits and the data rules will be fixed in legislation and ECB rules.

The American "no" and the Chinese "yes"

At the two extremes sit the United States and China. Washington has turned against a retail CBDC on privacy grounds: in January 2025 a White House executive order barred federal agencies from working to establish a CBDC, and Congress has since debated legislation to prohibit one. US policy has instead backed privately issued, regulated stablecoins, which brings its own privacy questions since issuers and exchanges hold customer data. We cover that framework in stablecoin rules under the GENIUS Act and MiCA.

China went the other way. The e-CNY has been in testing since 2019 and, from 1 January 2026, was reclassified as interest-bearing "digital deposit money" held as a liability of commercial banks, according to a China Daily report republished by Capital FM. That moves e-CNY balances closer to ordinary bank deposits, with the same customer identification and reporting that implies. See our e-CNY explainer.

India sits in between. Its pilot follows managed anonymity, and the e-rupee is token-based and does not pay interest, but the RBI has not yet published detailed rules on what data each party sees. The Finshots analysis of programmability also points out that the Bank of England has said it will not pursue government or central bank-initiated programmable functions, a line India has not drawn.

A privacy promise in a design document is a starting position. A privacy limit in statute is a guarantee.

What good privacy design would look like

From the designs on the table, a credible privacy package for any retail CBDC would include five things.

1. Limits in law, not policy. Data access, retention periods and the conditions for law-enforcement access should sit in legislation, so that a later government cannot quietly widen them.
2. A real offline tier. Device-to-device payments with no central record, capped at levels that keep fraud manageable. See how offline CBDC works.
3. Separation of duties. The central bank settles but does not hold identity; intermediaries hold identity but not the full settlement picture.
4. No programmability by default. Money a person buys with their own deposit should carry no rules.
5. Independent audit. Regular public audits by data protection authorities, with published results.

The ECB's design meets most of these on paper. India and China would need more published detail to be assessed on the same terms.

What to watch next

• July 2026: the European Parliament plenary vote on its digital euro position, which opens trilogue negotiations with the Council.
• End of 2026: the target for final EU agreement on the digital euro regulation, including the privacy articles and the process for holding limits.
• Second half of 2027: the planned 12-month pilot, the first chance to see whether the offline privacy promise holds up with real users.
• May 2027: the RBI's next annual report, which could say more about data handling in the e-rupee pilot as it expands into government schemes.

For a side-by-side of design choices, read e-rupee vs digital euro vs e-CNY.

About this researchMuffinPay InsightsIndependent analysis of stablecoins, CBDCs, cross-border payments and digital public infrastructure. Every figure is linked to its source. Read our editorial standards →