Your identity in your phone, 6/8: your identity is free, the proof may be billed

The citizen clicks a free button. The online service receives an identity at substantial or high assurance level. Nothing appears on the user’s bank statement. Yet the official FranceConnect+ documentation already describes a possible commercial relationship: a private service contracts with private identity providers, usage may be billed according to consumption, and DINUM supplies the relevant volumes.

This mechanism proves neither abuse nor a hidden unit fee applied to every login. It shows that an identity provided free to its holder can become a paid service for the organisation that verifies it. When billing occurs, the cost shifts to another party.

The future European wallet extends that logic. The Union makes issuance, use and revocation of the wallet free for natural persons. In the same regulation, it defines trust services as electronic services normally provided for remuneration. Between those two rules, a market is taking shape around certificates, attestations, signatures, validation, integration and incident handling.

This is part six of the Your identity in your phone investigation. Part one followed France Identité’s data and traces. Part two measured the practical price of opting out. Part three examined sovereignty under contract. Part four followed age as an access credential. Part five tested what happens when digital identity stops responding.

Version française : Votre identité est gratuite. La preuve peut être facturée.

Key points

• The EUDI regulation requires wallet issuance, use and revocation to be free of charge for natural persons.
• Member States must also provide free mechanisms to verify the authenticity and validity of wallets and registered relying parties.
• Qualified electronic signatures must be available by default and free of charge to natural persons, although Member States may limit free use to non-professional purposes.
• The same regulation defines a trust service as an electronic service normally provided for remuneration. Issuing and validating certificates, signatures, seals, timestamps and attribute attestations can therefore support commercial models.
• FranceConnect+ documentation states that a private service must contract with all available private identity providers. Their use may be billed according to consumption, with DINUM providing the relevant usage volumes.
• Public identity providers are currently free for services. The documentation warns that the model is evolving and that charges may arise in some cases.
• No official page reviewed publishes unit prices, subscription fees, discounts, minimum commitments or the total amount billed.
• FranceConnect+ reports 2.7 million users and 800,000 monthly connections. Another page stated that more than seven million identities were usable in early 2025. These indicators measure different things.
• Two identity providers are available on FranceConnect+: La Poste Digital Identity at substantial assurance level and France Identité at high assurance level.
• The final service should not know which identity provider was used for a specific login. The identity provider should not know which service was visited. Aggregated distributions may still be supplied.
• In sectors already subject to strong authentication, certain private services will have to accept the European wallet at the user’s voluntary request. Microenterprises and small enterprises are exempt.
• The first large-scale EU pilots represented more than €90 million of investment, half co-financed by the Commission. The French Senate estimates the updated total cost of the France Identité programme at €107.4 million.
• Those public investments do not prove the existence of private rents. They make it necessary to separate the collectively funded common layer from services that will later be charged for.

The free button can already generate an invoice

The FranceConnect+ partner documentation describes an explicit economic mechanism.

A private relying service wishing to use FranceConnect+ must enter into contracts with all available private identity providers. Use of those identities may be billed according to consumption. When this model applies, DINUM supplies the usage volumes of identity providers for the service concerned.

Public identities are currently free for relying services and do not require a direct contract with their issuer. The same page warns that the model is evolving and that use of public identity providers may carry a cost in some cases.

The general presentation states that FranceConnect+ itself creates no financial compensation between DINUM and the relying service. Any commercial relationship therefore sits elsewhere: between the service seeking to authenticate a user and the private provider guaranteeing that identity.

None of the documents reviewed supports the claim that every FranceConnect+ login generates an invoice. We do not know:

The price per authentication
Whether annual subscriptions exist
Volume discounts
Minimum commitments
Free allowances
Whether failed attempts are billed
What the State may subsidise
The total amount already paid

The established fact is narrower but decisive: the infrastructure can attribute aggregate consumption to a commercial relationship.

The limits of the European free-of-charge guarantee

Regulation (EU) 2024/1183 establishes several precise free-of-charge guarantees.

For natural persons, Member States must provide free of charge:

• wallet issuance;
• wallet use;
• wallet revocation;
• mechanisms to verify the authenticity and validity of wallets;
• mechanisms allowing users to verify the identity of a registered relying party;
• the ability to sign by default with a qualified electronic signature.

The final guarantee has an important qualification. Member States may limit free qualified signatures to non-professional use by natural persons.

The same regulation defines a trust service much more broadly as an electronic service normally provided for remuneration. It includes issuing and validating certificates, creating and validating signatures or seals, preserving them, electronic timestamps and electronic attestations of attributes.

The boundary can be summarised as follows:

One operation can therefore combine a free function with several commercial services.

A user may present a diploma attestation stored in the wallet without paying. The university, the provider qualifying the attestation, the employer integrating the protocol and the operator handling an appeal may still each bear costs.

FranceConnect+ produces aggregate volumes

Billing does not necessarily require a named history of individual uses.

The identity-provider documentation sets out two isolation principles:

• the online service should not be able to identify the identity provider used by a person for a particular login;
• the identity provider should not know which services that person accesses.

The relying service may nevertheless obtain an aggregated distribution of its connections among identity providers, provided that no specific user access can be identified.

On paper, this allows four properties to coexist:

Individual provider choice
Separation of usage data
Aggregate metering
Contractual billing

Billing can therefore be based on volumes without La Poste knowing that a named person opened a specific file, or the bank knowing which identity that person selected for the login.

This separation still depends on real implementation, logs, contracts and the data available to each actor. The article does not infer absolute unlinkability from the documentary principle alone.

Two providers, two assurance levels

The current concentration is easy to describe.

According to the FranceConnect documentation, FranceConnect+ has two identity providers:

• La Poste Digital Identity, qualified at substantial assurance level;
• France Identité, qualified at high assurance level.

The relying service may request a specific level. If it requests substantial assurance, identities meeting that level or a higher level may be offered. If it requires high assurance, only providers capable of delivering it appear. In the current offering, that requirement may therefore leave France Identité as the only available provider. (eIDAS assurance parameter)

It would be excessive to infer a general monopoly. La Poste and France Identité do not deliver the same level, and other means are discussed for the future. The documentation mentions TrustMe as a candidate in discussion and the digital health card as a possible later provider. (Identity providers)

The current setup nevertheless creates functional concentration: a process requiring high assurance currently depends on one provider available through FranceConnect+.

That concentration affects bargaining power. A private service must preserve user choice and contract with available private providers. It cannot simply hide the more expensive identity. At the same time, requesting high assurance can technically reduce the available choices.

Three indicators with different scopes

The DINUM service page reports:

2.7 million FranceConnect+ users
800,000 connections per month

Another documentation page stated that in early 2025, more than seven million digital identities were usable through FranceConnect+, with over 100,000 new identities created each month. (Identity providers)

These numbers are not necessarily inconsistent. They probably describe:

• a stock of eligible identities;
• people who have already used FranceConnect+;
• a monthly flow of connections.

They should not be added together or treated as identical metrics.

To understand the market, at least the following are missing:

Monthly active users
Successful authentications
Attempts and failures
Public and private share
Substantial and high assurance share
Aggregate split between providers
Connections giving rise to billing
Average price actually paid

The contrast with standard FranceConnect merely shows potential scale. DINUM announced 500 million connections in 2025 and 45 million users for that service. FranceConnect remains free for relying services. (Ten years of FranceConnect)

Europe is creating regulatory demand

The European wallet will not depend only on companies choosing to adopt it.

Article 5f of the consolidated eIDAS Regulation provides that:

• public services requiring electronic identification must accept European wallets;
• certain private services required by law or contract to use strong authentication must also accept them at the user’s voluntary request;
• the listed areas include transport, energy, banking, financial services, health, social security, telecommunications and education;
• microenterprises and small enterprises are exempt;
• the deadline runs for 36 months after the relevant implementing acts enter into force.

The statement that every company must accept the wallet in 2027 is therefore too broad. The obligation depends on sector, strong-authentication requirements, company size and the legal timetable of the implementing acts.

A service relying on the wallet must also be registered and authenticated. Implementing Regulation (EU) 2025/848 provides for access certificates, suspension or cancellation of registration and ten-year retention of information submitted to the registrar. It applies from 24 December 2026.

Those controls are essential to prevent a fake website from requesting attributes while impersonating a bank or public authority. They also create costs:

Registration
Organisation verification
Certificate issuance and renewal
Register operation
Supervision
Ten-year retention
Appeal after suspension

The European texts reviewed do not specify which French actor will operate every function or what, if any, fee will apply.

The value chain may have nine layers

The word “wallet” hides a much larger ecosystem.

This table does not claim that nine separate bills will be issued for every transaction. It identifies nine cost centres and nine places where an intermediary may earn a margin.

The most important issue concerns attribute attestations. A wallet can hold information produced by a public source, converted into an attestation by a qualified provider and checked by a private company.

The financial question becomes:

Who captures value when authentic information maintained with public money is turned into a commercial proof used by a bank, employer or platform?

Payment may be legitimate. The provider bears security, availability and liability costs. Transparency still requires visibility over the source-data cost, attestation price, margin and the client’s ability to switch provider.

Payments change the scale

The first major pilot coordinated by France Titres, POTENTIAL, tested bank-account opening and qualified electronic signatures. Its successor, APTITUDE, is experimenting with strong customer authentication and payment initiation. (POTENTIAL and APTITUDE)

The wallet is neither a bank account nor, by itself, a payment method. It may nevertheless intervene at several stages:

Initial KYC
Account login
Sensitive account change
Strong customer authentication
Consent
Payment initiation
Contract signature

These uses have very different frequency and economic value.

A bank may accept a relatively high cost to avoid manual account opening, reduce fraud or obtain a qualified signature. The same per-act price becomes much more significant when applied to every login or every payment.

The future model must therefore distinguish rare identity checks from repeated authorisations. A tariff suitable for KYC may be unsuitable for hundreds of millions of recurring transactions.

One cent multiplied by millions

FranceConnect+ reports 800,000 monthly connections. If that pace remained constant for 12 months, it would represent 9.6 million connections.

Apply three strictly hypothetical prices:

At €0.01 per connection, the theoretical annual cost is €96,000. At €0.10, it approaches €1 million.

These calculations are not an estimate of the current market. The share of connections using a private provider, the applicable contracts and the real price are unknown. They show why a micro-toll should be documented before volumes scale up.

As a reference point, one cent applied to the 500 million connections recorded by standard FranceConnect in 2025 would theoretically represent €5 million. FranceConnect is, however, described as free for relying services. That multiplication must not be presented as real FranceConnect revenue.

The price of qualification both protects and concentrates

A qualified provider obtains more than a logo.

The consolidated eIDAS Regulation requires qualified trust service providers to undergo an audit at their own expense at least every 24 months. The supervisory authority may order additional assessments at any time, also at the provider’s expense. The recent European framework also requires an annual surveillance conformity assessment for each evaluated qualified trust service. (Implementing Regulation 2025/2162)

Qualified status also strengthens the victim’s position. When a qualified provider causes damage through non-compliance, its intention or negligence is presumed unless it proves otherwise. With a non-qualified provider, more of the burden lies on the claimant. (Article 13 eIDAS)

Those requirements justify part of the price:

Audit
Cybersecurity
Continuity
Evidence retention
Legal work
Insurance
Support
Liability

They also create fixed costs that may favour operators already serving banking, public-sector or industrial clients.

ANSSI lists several providers commercialising qualified signature certificates, including CertEurope, Certigna, Certinomis, ChamberSign France, Datasure, DocuSign France, Universign, Vialink, Goodflag and Cegedim. That list illustrates an existing digital-trust market. It does not predict which companies will issue wallet attestations in the future.

Competition will therefore not be measured only by the number of companies on a list. Relevant questions include:

• how many hold the exact required qualification;
• how many can handle national-scale volumes;
• how many rely on the same assessors or subcontractors;
• how many can withstand falling unit prices;
• how many offer genuine reversibility to clients.

Public money is already funding the common layer

Building digital identity already requires substantial public budgets.

The French Senate’s 2026 budget report estimates the updated total cost of the France Identité programme at €107.4 million, mainly excluding staff expenditure, with €16.22 million in payment appropriations planned for 2026.

That figure covers the overall programme. It is neither the cost of the mobile app alone, nor a payment to one contractor, nor revenue already produced by authentications.

At EU level, the first four large-scale pilots involved more than 250 public and private organisations and represented more than €90 million of investment, with 50% co-financing from the Commission. (European Commission)

In France, France Titres announced in May 2026 that more than 80 organisations had signed a memorandum of understanding to accelerate wallet adoption. The agency committed to informing businesses about standards and incorporating their feedback on market needs. (France Identité memorandum)

Public-private cooperation can accelerate interoperability and prevent the construction of unusable systems. It also makes the allocation of value worth documenting.

For each component, the investigation must ask:

Who funded initial development?
Who owns the code and rights?
Who pays recurring operations?
Who bills usage?
Who keeps the margin?
Who bears the cost of errors?
Can the client switch provider?

Public funding of a common layer does not prevent commercial services from being built around it. It makes transparency over access and reuse conditions more important.

The hidden cost of false refusals

The cost of an identity system does not end with successful authentication.

A complete model must include:

Failed attempts
Poor data matching
Manual review
Support contacts
Proof re-issuance
Appeals
Undetected fraud
Legitimate transactions refused
Possible compensation

A five-cent login can become expensive if 2% of users require several minutes of human processing. Conversely, a more expensive proof can be profitable if it replaces manual KYC and reduces fraud.

Liability is also fragmented. A refusal may originate from:

• the authentic source;
• the identity provider;
• FranceConnect+;
• the final service;
• an anti-fraud rule;
• defective integration.

The citizen should not have to reconstruct that chain to obtain correction. The organisation purchasing the proof should know from its contract the resolution time, incident evidence, liability cap and appeal procedure.

Public documents do not state whether failures are billed, who pays for manual review or whether contractual penalties can fund compensation for an affected user.

l0g tool: the price of proof

The model below uses no value presented as a real tariff. It identifies the information a public body, bank or SME should demand before signing a contract.

Annual cost = integration
              + operations
              + billable volume × unit price
              + failures × review cost
              + incidents and support

Initial KYC
Account login
Bank-detail change
Strong authentication
Payment initiation
Contract signature

Setup fee
Minimum subscription
Overage price
Billing of failures
Support cost
Commitment period
Exit deadline
Portability of logs and evidence

Public-source cost
Issuer cost
Validation cost
Relying-party certificate cost
Archiving cost
Correction cost

Three market models remain possible

A low-marginal-cost public common layer

France Identité and public authentic sources provide essential proofs without usage charges. Companies mainly pay for integration and additional features. Competition focuses on value-added services.

A paid and competitive trust market

The citizen pays nothing directly. Companies pay providers for attestations, signatures and guarantees. Prices are transparent, several operators are available, portability works and liability is insurable.

A chain of micro-tolls

Every layer charges for its own act: identity, attribute, certificate, signature, validation, archiving, support and appeal. Large companies negotiate discounts, smaller ones use integrators, and a handful of operators concentrate qualifications.

The public record available on 28 August 2026 does not establish which scenario will prevail. It does show that the second layer, B2B billing linked to consumption of private identities in FranceConnect+, already exists in the official model.

The numbers that should be published

Minimum transparency should cover:

Number of connected private services
Number of public bodies concerned
Connections by assurance level
Share of private providers
Acts giving rise to billing
Aggregate amounts billed
Average price after discounts
Minimum commitments
Failure rate
Appeal cost
Provider-switching time
Incidents and compensation

These data can be published in aggregate without exposing individual use.

DINUM could also publish a redacted standard contract, pricing principles, the definition of a billable act and the rules expected to apply to public providers. France Titres could clarify the business model planned for attestations in the French wallet and access to authentic sources.

Method and limitations

This article relies on public documents available on 28 August 2026: the revised eIDAS Regulation, EU implementing acts, FranceConnect+ partner documentation, DINUM publications, France Titres pages, the French Senate budget report and ANSSI documentation.

The l0g method separates five evidence levels:

ESTABLISHED
Official text, contract or statistic

DECLARED
Statement by an authority or provider

INFERRED
Reasonable conclusion from several documents

UNKNOWN
Information not published

TO BE TESTED
Operation requiring production evidence

The €0.01, €0.05 and €0.10 models are sensitivity calculations. They are not observed tariffs or estimates of revenue for La Poste, France Identité or DINUM.

At this stage, l0g has not obtained commercial contracts between relying services and identity providers, invoices, price schedules, discounts, billable volumes or internal operating costs. Any conclusion about margins would be premature.

The price of trust must become visible

High-assurance identity is expensive. Providers must verify people, secure keys, audit systems, monitor incidents, maintain interfaces, preserve evidence and bear liability. Treating every payment as a rent would be as weak as treating every free service as costless.

The democratic issue begins when the price remains invisible while use becomes structural.

The European wallet must be free for its holder. Companies in certain sectors will progressively have to accept it. Trust services are, by definition, normally remunerated. FranceConnect+ already has a mechanism of contracts, consumption and aggregate volumes.

The question is no longer whether a market will exist.

It is whether that market will operate as an open, competitive and reversible infrastructure, or as a chain of tiny tolls that nobody sees separately but everyone eventually pays.

For every euro spent to prove an identity, who bills, who pays, who bears the error and who keeps the margin?