Vasilis Ververis is postdoctoral researcher for Path to Power, a team at Hasso Plattner Institute of the University of Potsdam and PrivacyLx co-founder. In this article he answers the main on standardized age-verification accross the EU. This is an excerpt and the full post can be found here.
In 2026, the European Commission formally asked all EU Member States to deploy a standardized EU age-verification app by the end of this year, either as a standalone application or as an integration into national or EU digital identity wallets, framing it as a key tool to protect children from harmful online content while preserving user privacy. This initiative is supposed to allow EU users to prove they are old enough, starting with being over 18 years of age, to access adult-restricted online content, such as pornography, gambling, purchasing alcohol, and others. In a joint statement, Commission President Ursula von der Leyen and executive vice president Henna Virkkunen announced that “our European age verification app is technically ready and soon available for citizens to use” and declared that platforms now have “no more excuses” not to protect children online.
What are the Privacy Concerns about this System?
From a privacy perspective, experts from The Internet Engineering Task Force (IETF) warns that mandatory age verification will inevitably erode the anonymity online and access the Internet without being bound to an identification process. This has direct implications for the right to privacy in the digital age, as recognised by the UN Human Rights Council, because these measures will increase the amount of personally identifiable or linkable data collected and processed as a condition of ordinary internet use.
Security-focused critiques argue that while age verification is framed politically as a child safety measure, its practical implementation could lead to normalise an identity check infrastructure across the internet for general purposes. Once a mechanism for identity verification, including age, exists at scale, it rarely remains confined to its original purpose or to the systems built to require it. What concerns technical specialists is that the same infrastructure could become available to whichever actor is best positioned to compel, purchase, or otherwise acquire access, including governments or private entities, who are eager to force individuals to disclose personal information, but are unable to do so now lawfully.
What is the Academic Consensus about the Age-Verification App?
It’s hard to say for all the academic community, but in March 2026, 438 security and privacy scientists from 32 countries published a joint open letter calling for a moratorium on the large-scale deployment of age-assurance systems for online services. The signatories argue that policymakers are moving ahead with mandatory age checks without first establishing, at a scientific level, whether such systems are effective and what their full security and privacy impacts are.
The letter identifies two issues: whether age assurance is in fact efficacious at achieving its stated policy goals, and what harms large-scale deployment might cause to individual and national autonomy, equality, security and privacy.
The open letter describes the EU Commision measures as “dangerous and socially unacceptable” for introducing a massive access-control infrastructure without a clear understanding of these implications, and therefore urges to pause until a robust evidence base and technical consensus have been established.
This is an excerpt from the full article available here.