The European Union’s new age verification app, designed to help platforms confirm users’ ages online, is undergoing continued updates as officials respond to mounting security and privacy concerns raised by researchers and policymakers.
The app is part of a broader EU effort to enforce child safety rules under the Digital Services Act, aiming to prevent minors from accessing harmful or age-restricted content. It allows users to prove their age using methods such as national ID cards, passports, or trusted third-party verification, while sharing only a yes-or-no confirmation with platforms instead of full personal data.
European officials have promoted the system as a privacy-preserving solution that standardizes age checks across member states, reducing the need for companies to collect sensitive user data directly.
However, the rollout has been overshadowed by security concerns. Researchers have identified vulnerabilities in early versions of the app, including weaknesses in how authentication controls are stored and managed on devices. In some cases, these flaws reportedly allowed users or attackers to bypass protections by modifying local configuration data, raising questions about the robustness of the system’s design.
Additional criticism has focused on the broader risks of linking identity verification to online activity. Experts warn that even privacy-focused systems must temporarily handle sensitive data, which can create attractive targets for attackers if not properly secured.
The European Commission has acknowledged that earlier versions of the app were still under development and emphasized that ongoing updates are intended to address these issues before a full public rollout. Officials maintain that the final system will meet high privacy and security standards, though independent experts continue to call for further testing and safeguards.
The debate highlights a central challenge for regulators: balancing child protection with data privacy and technical reliability. While the app represents a significant step toward unified age verification across Europe, its long-term success will depend on whether it can withstand real-world security threats and maintain public trust.