security analysis<\/a> of the app\u2019s open-source code found a fundamental architectural flaw: the system\u2019s issuer component has no way to verify that passport verification actually happened on the user\u2019s device.<\/p>\n\n\n\nThe researchers who found the vulnerability noted an uncomfortable tradeoff at the heart of the design. Fixing the security gap would likely require sending full passport cryptographic data to the server, including the user\u2019s name and document number, which would amount to a significant reduction in the privacy the system currently promises.<\/p>\n\n\n\n
The Commission calls this a \u201cmini wallet.\u201d That nickname reveals more than the branding intends. The app is built on the same technical specifications as the European Digital Identity Wallets, ensuring compatibility and future integration.<\/p>\n\n\n\n
Today, it verifies your age. Tomorrow, it can verify your nationality, your qualifications, your right to access a government service. The solution can also be easily adapted to prove other age ranges, for example 13+. The age check is the entry point, not the destination.<\/p>\n\n\n\n
Seven EU member states are already preparing to integrate the app into national digital wallets. Von der Leyen named France, Denmark, Greece, Italy, Spain, Cyprus, and Ireland as \u201cfront runners,\u201d with each country building the age verification function into its national identity systems.<\/p>\n\n\n\n
Ireland, rather than banning social media for under-16s, is developing a digital wallet that verifies age using citizens\u2019 PPS numbers. That\u2019s a national tax identification number tethered to an online access credential.<\/p>\n\n\n\n
Virkkunen used her portion of the press conference to announce enforcement actions alongside the app launch. The Commission has taken action against TikTok, Facebook, Instagram, Snapchat, Shein, and several pornographic platforms over failures to protect minors. The dual announcement is strategic. By pairing the age verification tool with punitive enforcement, the Commission is telling platforms that the app is no longer optional and neither is the identity verification regime it carries.<\/p>\n\n\n\n
Virkkunen said she will establish an EU-wide coordination mechanism by the end of April \u201cto ensure that we continue to build one solution for the EU, not 27 different ones.\u201d One standardized identity verification system, deployed across 27 countries, with a single set of technical requirements that all private companies must follow. The centralization is the point.<\/p>\n\n\n\n
European Digital Rights (EDRi) has warned that the app\u2019s plans show a clear intention to control access to a much wider range of platforms and services beyond pornography.<\/p>\n\n\n\n
The Commission touts the app\u2019s open-source code as proof of transparency. The code is available on GitHub, and private companies can build on the blueprint provided they meet technical requirements and, as Virkkunen put it, \u201crespect the privacy standard.\u201d<\/p>\n\n\n\n
The part they\u2019re less eager to highlight is what happens next. The app you actually download won\u2019t come from the EU; it comes from your national government or its contracted service providers, bundled into each country\u2019s digital wallet. And those national versions aren\u2019t guaranteed to be fully open source, even when they\u2019re built on the EU\u2019s open components.<\/p>\n\n\n\n
The app has already drawn criticism for requiring Google\u2019s Play Integrity API on Android, creating a mandatory dependency on Google\u2019s infrastructure that effectively locks out alternative Android distributions and sideloaded applications. An open-source app that requires Google\u2019s permission to function is a strange definition of digital sovereignty.<\/p>\n\n\n\n
Von der Leyen closed her remarks with a line that captures the Commission\u2019s approach perfectly. \u201cChildren\u2019s rights in the European Union come before commercial interest,\u201d she said. \u201cAnd we will make sure they do.\u201d Nobody is arguing against protecting children. The question is whether protecting children requires every adult in Europe to register their government identity documents with a centralized digital system before accessing the internet. The Commission has decided the answer is yes. It built the app before anyone had a chance to disagree.<\/p>\n","protected":false},"excerpt":{"rendered":"
This pretty much unveils the whole sneaky plan. If I was in the EU, I’d be setting up an exit nation and documents now. https:\/\/reclaimthenet.org\/eu-launches-age-verification-app The Commission built the app on the same architecture as its planned continental digital identity wallet. That’s not a coincidence. By Ken Macon The European Commission announced today that its […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,7],"tags":[],"class_list":["post-16833","post","type-post","status-publish","format-standard","hentry","category-tech","category-world"],"blocksy_meta":[],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/16833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=16833"}],"version-history":[{"count":1,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/16833\/revisions"}],"predecessor-version":[{"id":16834,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/16833\/revisions\/16834"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=16833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=16833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=16833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Ursula](\"https:\/\/reclaimthenet.org\/wp-content\/uploads\/2026\/04\/jxGfA5t3b9hg-scaled.jpg\")
<\/figure>\n\n\n\n![\"Three](\"https:\/\/reclaimthenet.org\/wp-content\/uploads\/2026\/04\/FVJATmHCI77B-scaled.jpg\")
<\/figure>\n\n\n\n