QWACs Explained Simply: What Are the Facts Regarding the Statement About Spying on EU Citizens?

Position Papers · November 23, 2023

The debate around Article 45 eIDAS and Qualified Website Authentication Certificates (QWACs) is accompanied by unsubstantiated claims that the new framework could facilitate surveillance of EU citizens and undermine internet security. ESD publishes this fact-based explainer to put these claims into perspective and clarify how QWACs and the proposed governance framework actually work. At its core, the controversy is about governance: should QWACs that comply with EU law and are issued by supervised and audited Qualified Trust Service Providers be subject to an additional layer of proprietary browser requirements? ESD argues that compliance with the European regulatory framework should provide the basis for recognition of QWACs, while browsers remain free to perform operational security checks and act on genuine security concerns.