The Fed recently put out a white paper, Data Privacy for Digital Asset Systems, which contends that the expectation of privacy in digital currencies (read: CBDCs) stems from misunderstanding how digital systems work.

"Concepts such as the desire for 'cash-like anonymity' are based on false underlying assumptions.", is the crux of it (quick, somebody tell the Monero team, and everybody else already deploying anonymizing protocols and applications for digital assets).

The subtext is that there can be some privacy and confidentiality safeguards built into CBDCs, but at the end of the day those would still be subject to being overridden or dispensed with. The paper doesn't come out and say that, but it does make oblique references:

"confidentiality implies that collected and stored data is protected from view in some manner, such as obfuscation or access restriction, and available only to authorized actors."

Which of course makes you wonder who exactly will be authorized and what will their capabilities be? It truly is the trillion dollar question.