SOURCE: Ken Macon via Reclaim The Net
Brussels wants every member state shipping its age verification app by year’s end, three months after a security researcher cracked it in under two minutes.
The European Commission wants every member state running age verification by the end of 2026, and it wants them running its own app to do it. A recommendation adopted Wednesday tells the bloc’s twenty-seven governments to accelerate deployment of the EU Age Verification App and have it available to citizens before the year is out, regardless of the unease some capitals have expressed about adopting Brussels’ code over their own.
The push lands months after security researchers tore through the same app the Commission is now urging governments to ship. In April, consultant Paul Moore bypassed the app’s protections in under two minutes, demonstrating that the rate-limiting controls were stored in an editable file, biometric authentication could be turned off with a simple configuration change, and sensitive credentials were accessible without secure hardware protection.
The Commission patched the headline issues. It is now telling governments the app is ready for production.
Henna Virkkunen, the Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy, framed the recommendation as the next step toward shielding minors online. “Effective and privacy-preserving age verification is the next piece of the puzzle that we are getting closer to completing, as we work towards an online space where our children are safe and empowered to use positively and responsibly without restricting the rights of adults,” she said.
What the Commission is actually building is identity infrastructure. Member states have the option of producing the app as a standalone product or folding it into the European Digital Identity Wallet, the bloc’s wider plan to put government-issued credentials on every citizen’s phone. Either path requires linking your real-world identity to a phone you carry everywhere, and either path puts the Commission at the center of how Europeans prove who they are online.
The verification flow asks for a passport or national ID card. The app then tells platforms whether you clear an age threshold but the credential it uses to make that judgment is your government identity.
Alongside the recommendation, the Commission plans to set up an EU Age Verification Scheme with formal requirements for anyone offering proof-of-age attestations or verification solutions, and it will publish lists of approved providers and approved products. Vendors will need certification. National implementations will need accreditation.
Virkkunen has been explicit that the goal is consolidation rather than competition between national approaches. “I will set up an EU-wide coordination mechanism,” she said earlier this month. “We need a structured approach for EU accreditation of national solutions. And for Member States to ensure that age credentials can be issued easily and across the whole EU. And above all to ensure that we continue to build one solution for the EU, not 27 different ones.”