Privacy vs. Surveillance: The Central Design Battle in CBDC Policy

Every monetary system embeds assumptions about state power. Cash is anonymous — governments cannot track what you buy with banknotes. Bank accounts are monitored — financial institutions report suspicious transactions, governments can subpoena records. A central bank digital currency sits somewhere on this spectrum, and precisely where it sits is a political choice dressed as a technical one.

The privacy versus surveillance debate in CBDC policy is not peripheral. It is the debate. Technical questions — DLT architecture, interoperability standards, wallet design — are subordinate to the foundational question: should a government-issued digital currency give the state real-time visibility into every transaction its citizens make?

What Programmable Money Actually Enables

The technical capabilities of a CBDC extend far beyond what physical cash or traditional bank accounts allow. Programmability — the ability to embed rules directly into the currency itself — enables features that no previous monetary instrument has possessed.

Expiry dates are the most striking example. A government could issue stimulus payments in digital currency that must be spent within ninety days, preventing hoarding and ensuring economic velocity. China’s e-CNY pilots have tested precisely this feature — digital money with built-in expiration, behaving more like a time-limited voucher than a store of value.

Restricted use is equally significant. A welfare payment in programmable CBDC could be restricted to food purchases, preventing its use on alcohol or gambling. A subsidy could be programmable to specific vendors or geographic areas. These capabilities address genuine policy problems — ensuring welfare funds reach their intended purpose — but they also represent an unprecedented degree of state control over individual spending decisions.

Real-time surveillance is the most politically charged capability. A CBDC that records every transaction in a government-accessible ledger would give authorities a complete, timestamped record of citizens’ financial lives. Combine this with AI analysis and the result is a financial surveillance apparatus of a qualitatively different kind than anything that exists today.

China’s e-CNY: What Has Actually Been Used

China’s digital yuan, the e-CNY, is the world’s most advanced CBDC deployment and the reference point around which all privacy debates orbit. It is important to distinguish between what the e-CNY technically enables and what has actually been deployed.

The e-CNY has been piloted across dozens of Chinese cities, used for retail payments, and distributed as consumer subsidies. Expiry-date features have been tested in at least one pilot. The architecture gives the People’s Bank of China a two-tiered system: commercial banks handle distribution and customer relationships, while the central bank maintains a master ledger.

What critics point to is not primarily what the PBoC has done with the data, but what it structurally can do. The e-CNY is not anonymous in the way cash is. Transactions are traceable to the central bank. The PBoC has used language like “controllable anonymity” — meaning small transactions may have limited traceability, but large transactions are fully visible. In a country where financial surveillance already extends to social credit systems, the e-CNY creates infrastructure for comprehensive economic monitoring of citizens.

The e-CNY precedent matters globally not because other countries will replicate its approach, but because it has demonstrated that CBDC surveillance capabilities are not theoretical. They are buildable, deployable, and functional.

The ECB’s Privacy Commitments: Legal vs. Technical

The European Central Bank has been explicit that the digital euro will be designed with “privacy by design” as a core principle. Christine Lagarde and ECB communications have repeatedly committed to ensuring that the digital euro does not create a surveillance instrument. The ECB has proposed that offline transactions be fully anonymous — equivalent to cash — while online transactions would have conditional privacy, more private than commercial bank accounts but with law enforcement access under legal process.

These commitments face a distinction that has received insufficient attention: the difference between legal privacy guarantees and technical privacy guarantees.

A legal privacy commitment means the ECB promises not to use data it collects for surveillance purposes, and European law restricts government access to transaction records. A technical privacy guarantee means the architecture makes surveillance impossible — there is no central ledger to subpoena, or transactions are encrypted in ways even the issuer cannot read.

The digital euro’s current design leans toward legal rather than technical privacy. The ECB will have access to transaction data; it commits not to use it inappropriately. For European citizens in functioning democracies with robust rule of law, this legal commitment may be adequate. But it represents a fundamentally different privacy guarantee than cash, and the infrastructure created is one that future governments — governments that may be less committed to civil liberties — will inherit.

US Congressional Opposition: A Bipartisan Privacy Coalition

In January 2025, the United States took the most dramatic CBDC policy position of any major economy: a ban on its development. The executive order prohibiting a Federal Reserve digital currency united libertarian Republicans and civil liberties-focused Democrats around a shared concern — government surveillance of financial transactions.

The American anti-CBDC coalition has been unusually bipartisan. Libertarian Republicans see a retail CBDC as an instrument of financial control, enabling authorities to freeze accounts, restrict purchases, or monitor political dissidents. Some progressive Democrats share the surveillance concern from a different angle — worried about law enforcement overreach and disproportionate monitoring of minority communities.

Both coalitions point to the same capability: a CBDC gives the state a real-time financial monitoring system that no legal framework can fully constrain once the infrastructure exists. The argument is not that today’s government would misuse it, but that the infrastructure’s existence creates risks across future political configurations.

The US ban reflects a genuine political philosophy: that financial privacy is a component of individual liberty, and that government-issued digital money is incompatible with that privacy.

The UK’s Careful Language and the Stablecoin Alternative

The Bank of England and His Majesty’s Treasury have been notably careful in their language about the “digital pound.” They have explicitly described the project as a “research and development” phase with no commitment to issuance. Consultation documents have extensively addressed privacy concerns, proposing that the Bank of England would not see individual transaction data — a stronger privacy commitment than the ECB’s current design.

The deliberate tentativeness of UK language reflects political sensitivity. British politicians are aware that the surveillance critique resonates with voters, and the Treasury has chosen not to force a political confrontation over CBDC before the design questions are resolved.

Meanwhile, the stablecoin market has grown to over $200 billion without any of these surveillance debates. Dollar-backed stablecoins like USDT and USDC operate on public blockchains where transactions are pseudonymous — visible on chain but not linked by default to real-world identities. For users who want digital dollars without government surveillance architecture, stablecoins already provide the answer.

This dynamic — private stablecoins as the de facto privacy-preserving digital dollar — creates a political economy problem for CBDC advocates. If governments offer surveillance-capable CBDCs while private alternatives offer greater privacy, users will choose private alternatives. Governments then face the choice of restricting private stablecoins to make CBDCs competitive, or accepting that their CBDC will serve a limited population that has no alternative.

The Foundational Political Question

The privacy versus surveillance debate ultimately rests on a foundational political philosophy question that technology cannot resolve: should governments have real-time visibility into every financial transaction their citizens make?

Those who answer yes tend to emphasise tax evasion, money laundering, terrorism financing, and welfare fraud — genuine harms that financial opacity enables. If governments had perfect financial visibility, they argue, these harms could be prevented more effectively.

Those who answer no tend to emphasise the conditions under which financial surveillance is tolerable. Democratic governments with strong rule of law and independent judiciaries might be trusted with extensive financial data. Authoritarian governments will weaponise it. And even in democracies, the infrastructure created under benign conditions will be available to future governments whose intentions may differ.

CBDC design choices — offline anonymity, data retention periods, law enforcement access standards — are not technical parameters. They are encoded answers to this political philosophy question. And unlike software that can be patched, the political norms established by early CBDC designs tend to persist.

The most honest framing of the CBDC privacy debate is this: every CBDC represents a political bargain between monetary modernisation and surveillance risk. The terms of that bargain are being negotiated now, in design documents and legislative frameworks, by policymakers who will not live with its consequences for as long as the citizens who will.