CBDC privacy concerns are structural, not incidental. A central-bank digital currency is a liability of the central bank held in accounts or wallets the issuer (or its intermediaries) can see and, in most designs, restrict. That is the opposite of physical cash. Core issues that show up across proposals, including the digital euro: Full transaction visibility. Unlike banknotes, every payment can be logged with payer, payee, amount, time, and location metadata. Even “anonymity vouchers” or tiered privacy (small offline payments less visible, larger ones fully identified) still leave the bulk of economic activity observable by the central bank or the supervised intermediaries it designates. The Eurosystem diagram you shared routes settlement through T2, ESMIG, and an Extended Interoperability Interface; those are controlled chokepoints, not private channels. Identity binding. Most retail CBDC models require strong customer identification to open a wallet, precisely to satisfy AML/CFT rules. Once the wallet is linked to a legal identity, the transaction graph is no longer pseudonymous. Selective disclosure or zero-knowledge features can hide details from merchants, but they do not hide them from the issuer that must still enforce limits and sanctions. Programmability and conditional access. Because the ledger is permissioned and the tokens are central-bank liabilities, rules can be attached at the protocol or policy layer: spending caps, merchant-category blocks, geographic limits, expiry dates, or negative interest that cannot be escaped by withdrawing cash. The technical ability exists even if current policy documents say it will not be used; future legislation or emergency powers can activate it without changing the underlying system. No true bearer option at scale. Offline or “cash-like” modes are usually capped, device-bound, and eventually reconciled to the online ledger. Large or repeated offline balances defeat the privacy claim and reintroduce traceability. Physical cash remains the only widely used instrument that settles without a third party recording the exchange. Intermediary and data-sharing risk. Even if the central bank itself claims not to store personal transaction data, commercial banks, payment providers, or “market DLT operators” in the interoperability layer still process it. Data-retention rules, court orders, and cross-border information-sharing agreements then apply. Concentration of that data creates a single high-value target for both state access and breaches. Political and mission creep. Systems built for payments can later support fiscal policy (stimulus that expires, sector-specific subsidies, carbon-linked spending limits). Once the infrastructure exists, the marginal cost of adding conditions is low. Historical precedent with bank accounts, payment networks, and frozen assets shows that legal powers expand under crisis or policy pressure. The digital-euro design under discussion tries to mitigate some of this with holding limits, privacy thresholds, and pseudonymization for low-value payments. Those are policy choices layered on top of a system the Eurosystem ultimately operates. They can be tightened; they are not enforced by independent users running open-source nodes. Bitcoin’s base layer does not offer perfect privacy either (addresses are pseudonymous and chain analysis exists), but it has no central issuer that can unilaterally alter balances, freeze specific coins by policy, or require identity to participate in settlement. That difference in control, not marketing language about “privacy by design,” is the practical distinction. Opt out with Bitcoin.