EU age verification app
Age verification app in Privacy & security
Praised for open specs, open-source code and proving age without sharing personal data. Main caveat: it requires attested Android or iOS, which excludes de-Googled phones.
Praised for open specs, open-source code and proving age without sharing personal data. Main caveat: it requires attested Android or iOS, which excludes de-Googled phones.
44 people gave an opinion
- recommend it
- 10
- criticize it
- 34
- approval share
- 23%
Recommended in 7 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 10 people recommend itNeeds 10 or more, met.
- 0.2 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 7 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Open specs and open-source code
“All the specs are open and the reference implementations are also open source, so other jurisdictions could adopt this.”
Comment from 23 Jan 2026 in “Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops” “"open source": this is the only reassuring part.”
Comment from 13 Jul 2026 in “EU will seek to limit children's access to social media” Proves age without sharing personal data
“allows owners of ID wallets to verify their age, without their actual age or personal data being transmitted”
Comment from 10 Feb 2026 in “Discord will require a face scan or ID for full access next month” “a much more secure and privacy preserving system than what they would get otherwise”
Comment from 15 Jan 2026 in “Why Every Country Should Set 16 as the Minimum Age for Social Media Accounts” Design praised as strong overall
“the EU Age Verification app looks fine, especially now what the easy bugs are fixed”
Comment from 20 Apr 2026 in “EU Age Verification Hacked in 2 Minutes: What Happened” “this EU initiative is about the best design one can have”
Comment from 25 Mar 2026 in “Apple Just Lost Me”
What people warn about
Each mark is one comment
Locked to Google or Apple devices
“The "app" could be a good solution, if it didn't require attested Android or iOS.”
Comment from 14 Jul 2026 in “European "age verification" "app" forcing everyone to use Android or iOS” “it requires attestation: even if you install Google Play on some Android in an emulator/container/VM, on an alternative Android distro or in a rooted device, the app will not accept it.”
Comment from 14 Jul 2026 in “European "age verification" "app" forcing everyone to use Android or iOS” “they completely botched it by having the proof-of-concept app rely on Apple & Googles integrity APIs”
Comment from 30 Jul 2026 in “Google will expand age checks on Android worldwide till the end of the year” - Comment from 4 Sep 2026 in “Hackers had a live feed of every ID verification company scanned for over a year”
- Comment from 20 Apr 2026 in “Brussels launched an age checking app. Hackers took 2 minutes to break it”
Security flaws and data retention
“Devs forgot to delete images in some failed scenarios.”
Comment from 20 Apr 2026 in “Brussels launched an age checking app. Hackers took 2 minutes to break it” “the EU claims their own age verification app is the most private and most secure app in the world, yet it's already been hacked is laughable”
Comment from 12 May 2026 in “EU to crack down on TikTok, Instagram's 'addictive design' targeting kids” “Not immediately deleting the selfie is a pretty fundamental and egregious mistake to make.”
Comment from 21 Apr 2026 in “Brussels launched an age checking app. Hackers took 2 minutes to break it” Distrust of issuer and backend
“I will not use it for anything privately as I neither trust the issuer, nor the notified bodies providing the infrastructure.”
Comment from 16 Apr 2026 in “EU Age Verification Solution” “The app also requires that you first send your personal information to a closed source backend”
Comment from 30 Apr 2026 in “Online age verification is the hill to die on” “shun their lies and believe you on the subject of whether this age verification app is ready?”
Comment from 3 Jun 2026 in “Age verification for social media, the beginning of the end for a free internet?” Weak token ownership and tracking
“you are given a pseudonym per domain and websites can easily track you through it even without an account”
Comment from 16 Apr 2026 in “Statement by von der Leyen on the digital age verification app” “It does have an obvious flaw in that whoever you give the token to has no proof it's actually yours.”
Comment from 9 May 2026 in “Google Broke reCAPTCHA for De-Googled Android Users”
What people said
40 of the 54 comments that mention it, newest first. Each links to the original comment.
“having to open the EU's own (insecure) app on a smartphone for accessing, yes, Wikipedia and such, would in practice kill Wikipedia”
“requires you to use an Android device passing Play Integrity or iOS”
“requires tying yourself to Google/Apple (ie will not work with GrapheneOS) which is a non-starter”
“The direction is generally good, but I'm not very positive about the implementation”
“they completely botched it by having the proof-of-concept app rely on Apple & Googles integrity APIs”
“These corrupt bafoons talk of sovereignty and then they pull stunts like this.”
“The EU developed system excludes the 1% of people for which the popular mobile solutions do not work”
“there is no sign that the age verification will support this variant”
“They could have helped and made an alternative version of this system which used the ID chip plugged into a desktop PC, but they intentionally won't do so.”
“it requires attestation: even if you install Google Play on some Android in an emulator/container/VM, on an alternative Android distro or in a rooted device, the app will not accept it.”
“The "app" could be a good solution, if it didn't require attested Android or iOS.”
“"open source": this is the only reassuring part.”
“the EU Age Verification App seems to be vulnerable to relay attacks anyway”
“shun their lies and believe you on the subject of whether this age verification app is ready?”
“the EU claims their own age verification app is the most private and most secure app in the world, yet it's already been hacked is laughable”
“It does have an obvious flaw in that whoever you give the token to has no proof it's actually yours.”
“opens just a lot of new problems (new threats, attack vectors, gives incentive for identity theft)”
“The app also requires that you first send your personal information to a closed source backend”
“bans rooting/jailbreaking, bans third party operating systems like GrapheneOS”
“you are forced to do it on whitelisted build of an OS on a whitelisted device”
“Why it needs documents? From video of liveness check it clearly visible that 35 years old bearded man is over 18.”
“Not immediately deleting the selfie is a pretty fundamental and egregious mistake to make.”
“the EU Age Verification app looks fine, especially now what the easy bugs are fixed”
“Devs forgot to delete images in some failed scenarios.”
“The main issue appears to be that as per the blueprint user MUST use one of the mandated handsets”
“it just means there is a single government database to hack to get copies of all IDs”
“there is an option to guard the ID App with an additional PIN/Biometric”
“IMO selling this as an "EU age verification app" by the commission is dishonest.”
“all the promises of privacy and anonymity here cannot be trusted”
“I will not use it for anything privately as I neither trust the issuer, nor the notified bodies providing the infrastructure.”
“you are given a pseudonym per domain and websites can easily track you through it even without an account”
“this EU initiative is about the best design one can have”
“it is (afaik) conceivable that the ID authority could collude with social network providers”
“The same EU that is trying to backdoor every messaging app to "protect the children" TM? I 'll use their ID system on my dead body.”
“allows owners of ID wallets to verify their age, without their actual age or personal data being transmitted”
“All the specs are open and the reference implementations are also open source, so other jurisdictions could adopt this.”
“a much more secure and privacy preserving system than what they would get otherwise”
“it should consider developing a technology that makes it work in a privacy-respecting way”
“This looks like a private consortium of usual suspects Tales and T-Systems squandering taxpayers money”
“That page says ZKP are a "future roadmap" thing, to be maybe possible wink wink maybe implemented int he "future".”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.