# ‘No more excuses’: Von der Leyen says EU age checking app is ready **URL:** https://discuss.privacyguides.net/t/no-more-excuses-von-der-leyen-says-eu-age-checking-app-is-ready/37166 **Category:** News **Tags:** article **Created:** 2026-04-15T17:57:39Z **Posts:** 16 ## Post 1 by @Encounter5729 — 2026-04-15T17:57:39Z > **[‘No more excuses’: Von der Leyen says EU age checking app is ready](https://www.politico.eu/article/eu-says-age-verification-app-is-technically-ready/)** > > Age verification app is central to EU effort to keep kids safe online. > The Commission expects European-wide apps to be ready to download in coming weeks, developed by companies that will be verified by the Commission, a senior official told reporters. EU countries will launch their own versions later this year, the official said. > There are three ways people can verify their age: via their passport, a national ID or via trusted providers such as banks or schools. That can then be used by the tech platforms to check if a person trying to access a service is of the required age. > > Von der Leyen has convened a panel of experts to draft a recommendation on an EU-wide social media ban by the summer. The panel will hold its second meeting on Thursday. Von der Leyen will attend the meeting, an agenda seen by POLITICO showed. I do think that it would be less worse if there are a range of non-government issues identity methods to verify your age. Your boss, your gym club, etc. Of course there would be a bit of fraud, but commonsense limits would limit it. Though even a bit of fraud is not the end, the goal is to make it harder for kids, not impossible. --- ## Post 2 by @Breeze7846 — 2026-04-15T18:20:13Z [https://www.reuters.com/world/eu-age-verification-app-ready-europe-moves-curb-childrens-social-media-access-2026-04-15/](https://www.reuters.com/world/eu-age-verification-app-ready-europe-moves-curb-childrens-social-media-access-2026-04-15/) Per reddit, in theory the app is zero knowledge “to let users cryptographically prove they meet an age requirement without revealing their identity or personal data. It works via a trusted credential issued once and stored locally, then generates privacy-preserving proofs on demand so services only receive a yes/no result rather than sensitive information.” Github is here. At least it is open source: > **[European Digital Identity](https://github.com/eu-digital-identity-wallet)** > > Official GitHub Organization of the European Digital Identity project. - European Digital Identity Really think devil is in details. This obviously isn’t an ideal situation. But it doesn’t seem to be as bad as it could be either. It certainly is a better situation than what is being proposed in USA regarding OS level age checks. If the app truly is zero knowledge, it might be the most privacy preserving way possible to address the moral panic and political hot button issue of protecting children online right now. Can anybody with more knowledge than I verify if the app is truly zero-knowledge? --- ## Post 3 by @Encounter5729 — 2026-04-16T14:07:33Z > [@Breeze7846](#): > > Really think devil is in details. So I found on this post that those verification aren’t one time-only, it seems it has an expiry date. This is really concerning. The id stops being a way to prove your age once, but becomes a necessity to continue proving it regularly. [https://xcancel.com/csmproject/status/2044732523368841220#m](https://xcancel.com/csmproject/status/2044732523368841220#m) --- ## Post 4 by @Regime6045 — 2026-04-16T15:54:30Z Does this app run on any OS, including free and open source ones, or is it iOS+Android only (with Play Integrity checks on Android) like the EUDI wallet app? --- ## Post 5 by @ThePrivacyDad — 2026-04-16T18:37:10Z My understanding was that it isn’t an EU app but a technology that other app developers would then take and build into verification apps. --- ## Post 6 by @ThePrivacyDad — 2026-04-16T18:50:38Z I’m confused as to why Von der Leyen is referring to “an app” ([3:05 min](https://audiovisual.ec.europa.eu/en/media/video/I-287690)). I don’t think there will be one app for all EU citizens: “One common set of standards and specifications, many different wallets” “Every Member State will need to provide its citizens with at least one EUDI wallet.” “Start building your EU Digital Identity Wallet solutions” > **[Technical Specifications - EU Digital Identity Wallet -](https://ec.europa.eu/digital-building-blocks/sites/spaces/EUDIGITALIDENTITYWALLET/pages/869793973/Technical+Specifications)** She (or her writers) should have said “software protocol” or something like that. Transcript is here: [Press corner | European Commission](https://ec.europa.eu/commission/presscorner/detail/en/statement_26_800) --- ## Post 7 by @Encounter5729 — 2026-04-16T19:32:03Z > [@Regime6045](#): > > Does this app run on any OS, including free and open source ones, Set-up and adding a (test) certificate works. Couldn’t verify the connection since the link didn’t open in the app. --- ## Post 8 by @ThePrivacyDad — 2026-04-16T19:34:53Z > [@Encounter5729](#): > > Set-up and adding a (test) certificate works. Couldn’t verify the connection since the link didn’t open in the app. Where are you getting the app from? --- ## Post 9 by @Encounter5729 — 2026-04-16T19:37:07Z > **[Releases · eu-digital-identity-wallet/av-app-android-wallet-ui](https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/releases)** > > Contribute to eu-digital-identity-wallet/av-app-android-wallet-ui development by creating an account on GitHub. --- ## Post 10 by @Encounter5729 — 2026-04-16T19:39:11Z Someone is proposing Play Integrity integrity for the app in the issues. That person seem to be using AI, as they filed dozens of issues. > > > Labels: security, enhancement, priority: high > Summary > The application performs n…o check for rooted devices, emulators, or tampered environments before allowing access to wallet credentials. Given that the SharedPreferences protection relies on Android's sandbox (see related issues for additional weaknesses), a rooted device completely negates all storage-level protections. Biometric authentication data, PIN encryption material, and the keystore alias are all recoverable on a rooted device. > Affected area > No relevant detection code was found in any Kotlin source file across the entire repository. > Impact > An attacker in possession of a rooted device can: > > Read eudi-wallet.xml SharedPreferences directly. > Extract CryptoAlias → use with KeyStore.getKey() (accessible to root) to recover the AES key. > Decrypt PinEnc using the recovered key and PinIv. > Reset PinFailedAttempts and PinLockoutUntil for unlimited brute-force. > > Suggested fix > Integrate Google Play Integrity API at app startup and before any credential access: > kotlin// In SplashInteractor or Application.onCreate() > val integrityManager = IntegrityManagerFactory.create(context) > val request = IntegrityTokenRequest.newBuilder() > .setNonce(generateNonce()) > .build() > > integrityManager.requestIntegrityToken(request) > .addOnSuccessListener { response -> > val verdict = decodeAndVerifyToken(response.token()) > if (!verdict.deviceIntegrity.deviceRecognitionVerdict > .contains(DeviceRecognitionVerdict.MEETS_DEVICE_INTEGRITY)) { > // Block access and inform user > } > } > As a fallback for devices without Play Services, consider a library such as [RootBeer](https://github.com/scottyab/rootbeer) for heuristic root detection. Also of note > > > ref: https://f-droid.org/docs/Inclusion_Policy/ > > on a quick look, I guess a FLOS…S flavor can be made with these changes: > * replacing `com.google.mlkit`: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/blob/2026.04-1/passport-scanner/build.gradle.kts#L59 > * removing `com.google.gms.google-services`: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/blob/2026.04-1/build.gradle.kts#L27 > * rebuilding or using a maven repo for `jj2000_imageutil.jar`: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/tree/2026.04-1/passport-scanner/libs > * rebuilding or using a maven repo for `libavfacelib.so` and `libonnxruntime.so`: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/tree/2026.04-1/passport-scanner/src/main/jniLibs > > but `eudi-lib-android-wallet-core` depends on https://mvnrepository.com/artifact/com.google.android.gms/play-services-identity-credentials and that's harder to fix (I guess https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/discussions/19 ) > > so, are there plans for this app to ever be open source or that was just a lie in https://ec.europa.eu/commission/presscorner/detail/en/STATEMENT_26_817 ? 😀 > > /LE: updated stuff that needs to be fixed --- ## Post 11 by @ThePrivacyDad — 2026-04-16T22:22:53Z > [@Encounter5729](#): > > Someone is proposing Play Integrity integrity for the app in the issues. Europe does seem to be waking up to their dependence on US Big Tech and the benefits of open source and Linux, so let’s hope that suggestion gets ignored. --- ## Post 12 by @ThePrivacyDad — 2026-04-17T00:40:55Z Thanks for this. I have taken some screenshots and done a quick write-up, which I’ll post in the projects section. --- ## Post 13 by @ThePrivacyDad — 2026-04-17T10:31:25Z Ok, that seems not to have been allowed or gone through in the Project section, so I’ll just link the screenshots here: [https://theprivacydad.com/a-first-look-at-the-eu-age-verification-app/](https://theprivacydad.com/a-first-look-at-the-eu-age-verification-app/) --- ## Post 14 by @Onscreen5341 — 2026-04-17T10:59:00Z Since the app tells the social media plattform if someone is old enough or not with an true or false bool. While on an actual ZKP (Zero Knowledge Proof) the website should not get the answer like that rather in a way more abstract and not 100% correct format. So the website can only say that to 99.999999999999999999999999999999999999999999999999999999999999999999999999% the user is over 18, while there might be a theocratic possibility that the system returned a false statement and the user is actually under 18. Ali Baba Cave analogy is one example of it. So I would assume that their ZKP is not an actual ZKP. --- ## Post 15 by @RandomRandomly — 2026-04-18T07:20:28Z [https://cybernews.com/security/eu-age-verification-app-hack/](https://cybernews.com/security/eu-age-verification-app-hack/) > According to Moore, the app stores an encrypted PIN locally, but crucially, the encryption is not tied to the user’s identity vault, where sensitive verification data is kept. > > That opens the door to a surprisingly simple bypass. By deleting specific values tied to the PIN from the app’s configuration files and restarting it, an attacker can set a new PIN while still retaining access to credentials created under the previous profile. > > In effect, the app accepts reused identity data under a newly defined access control. > Moore also pointed to additional weaknesses that make brute-force or bypass attempts even easier. > > Rate limiting, typically used to prevent repeated guessing of PINs, is stored as a simple counter in the same editable configuration file. Reset it to zero, and the system forgets how many attempts have already been made. > > Biometric authentication, meanwhile, is controlled by a single boolean flag. Flip it from “true” to “false,” and the app simply skips biometric checks altogether. > **[Brussels launched an age checking app. Hackers say it takes 2 minutes to...](https://www.politico.eu/article/eu-brussels-launched-age-checking-app-hackers-say-took-them-2-minutes-break-it/)** > > Cyber experts say they have found holes in Brussels’ age verification app, despite claims by the EU executive that it is “technically ready.” > Within hours of the EU’s app release, security consultant Paul Moore found it would store sensitive data on a user’s phone and leave it unprotected, he **[wrote](https://x.com/Paul_Reviews/status/2044436001611801072?s=20)** in a widely shared post on X. Moore **[claimed to have hacked](https://x.com/paul_reviews/status/2044723123287666921?s=46&t=DW5Ys-CQoVvG3--3ZCZhFQ)** the app in under 2 minutes. > > Baptiste Robert, a prominent French white hat hacker, confirmed many of the issues and told POLITICO it was possible to bypass the app’s biometric authentication features, meaning someone would be able to forgo entering a PIN code or using Touch ID to access the app. > > Olivier Blazy, a cryptographic researcher who is part of a French task force on digital identity, said: “Let’s say I downloaded the app, proved that I am over 18, then my nephew can take my phone, unlock my app and use it to prove he is over 18.” > **[EU Forced To Update New Age-Check App After Security Flaws](https://europeanconservative.com/articles/news-corner/eu-forced-to-update-new-age-check-app-after-security-flaws/)** > > Concerns over hacking risks and easy workarounds emerge just days after the system was declared “technically ready.” --- ## Post 16 by @WhyRhy — 2026-04-18T08:37:02Z > “effort to keep kids safe online” I just wish they would stop lying to gullible people. Further, it does nothing for online safety. Quite the opposite. _They_ know this, but peddle this nonsense to people who believe it. Sadly, this is the mainstream.