The EU's age verification app launched: technically ready, legally awkward?
The European Commission launched an age verification app this week. This is likely to serve as a start for a broader legislative initiative to legalise age-verification and subsequent restrictions on minors.
This week, the European Commission’s President Ursula von der Leyen presented the new European age-verification solution meant to protect children online - an open-source app, developed by a consortium, led by Swedish Scytales and German T-Systems (part of Deutsche Telekom).
Overall, the app appears to be a blueprint for EU Member States and foreign countries to prepare for either national or EU-wide age-verification legislation, with potential platform restrictions for minors to follow. If the EU reaches a political consensus on age-verification and social media bans, the app can be scaled to the EU level, if not, it will support individual Member States’ efforts in the meantime. The Commission cites that the solution is “fully open source, meaning partner countries around the world can also adopt it” - it’s an important message to politicians across the world who may want to jump on the age-verification bans’ bandwagon, but don’t have the capacity to develop strong technical solutions themselves
The EU Commission's President noted (by potentially preventing criticism for developing solutions before actual consensus is reached on an EU-wide level) that this is “not the first time the Commission comes forward with an innovative solution to a new problem”, citing Commission's COVID app that was developed in only 3 months. Although some do indeed like to compare minors being online to a “pandemic”, the comparison doesn't hold, especially in the context that some are still very critical about age-related bans, stating that it would bring even more isolation for the most vulnerable children and teens, push them to fringe websites, and otherwise circumvent the rules.
Legal basis: anchors in different legislations, strategies, joint letters, resolutions
Aside from technical experts questioning the app's functionalities, including the possibility of circumventing the system using virtual private networks (VPNs), the focus should be elsewhere - on legal preparations for age-verification, digital ID'ing, and age-related bans.
The European Union’s Digital Identity (EUDI) Wallets, long cited as primary future instruments for potential age-verification solutions, are likely to face limitations at the Member State level and not meet the 2026 Q4 deadline. As a result, the age verification app will aim to bridge “the gap until the EU Digital Identity (EUDI) Wallets become available by the end of 2026”, as per the apps’ official website. Although the app is stated to be compatible with the incoming EUDI Wallets with age-verification features, its functionalities differ significantly (see diagram below).
The legal basis is equally confusing. The General Data Protection Regulation (GDPR), the Digital Services Act (DSA) guidelines, the Audiovisual Media Services Directive (AVMSD), and eiDAS 2.0 all establish obligations for platforms to protect minors through minimising data use, taking other proportionate measures.
The EU Commission’s Better Internet for Kids strategy of 2022, and the Louvain-la-Neuve declaration “On promoting a safer, responsible and trustworthy online environment” of 2024 - both frequently cited on the apps’ official page - speak about developing age-verification solutions and contribute to the total narrative, but are not legally binding.
Interestingly, the app's official website does not state how this solution complies with local laws in individual EU Member States. Instead, the document states that “it is assumed that EU Member States have established appropriate legal frameworks to authorise the collection and processing of data required for issuing Proof of Age attestations”.
It is worth noting that in November 2025, the European Parliament has also adopted a resolution urging a minimum age of 16 for accessing social media, with parental consent required for those aged 13 to 15.
Ambiguous scope: an app for adult content or all content?
The tender for an age-verification solution (EC-CNECT/LUX/2024/OP/0073) was launched in October 2024, with an estimated value of €4 million. The technical specifications stated that this particular solution was intended to refer “specifically to access to 18+ online services, such as adult content platforms (pornography)”.
Later, the tender notes that the solution can be developed to be applicable further to cover a broader range of services - and judging from the public statements made this week, that pivot is already underway.
Next steps: no crystal ball needed
Greece was the first country in Europe to adopt age-based social media restrictions for minors, and several others are currently working on their own legislation and technical solutions. Politico EU reports that today, just one day after the app's launch, Commission representatives will meet with EU leaders to build political support.
It requires little insight to predict what will follow: EU leaders will likely urge the Commission to take further action, to respond to the European Parliament's resolution, and to begin the process of legislating mandatory age-verification and related platform restrictions for minors. If a legislative proposal has already been drafted - without waiting for the conclusions of the expert panels the Commission itself set up - the process could move fairly quickly. This could potentially include changes to eiDAS 2.0, where user authentication would change from passive (voluntary) to active, a legitimate/public-interest legal basis to circumvent the GDPR rules on data, and to either amend or enforce the DSA's guidelines and obligations for big platforms.
According to Reuters, the EC acknowledged that the app can be bypassed using a VPN, but stressed that “the initiative was not aimed at policing people online”. The explanation is not convincing and may signal that this is exactly what it appears to be: a pilot, designed to advance broader political goals and help countries prepare while the EUDI Wallets are built out and the legal basis for mandatory age verification catches up. When it does, large platforms will have little choice but to comply - the Digital Services Act will help that.
Egle Markeviciute
Egle Markeviciute