From Age Checks to the EU Kids Act: The Role of the EU’s Age Verification App

On 15 April 2026, President of the European Commission Ursula von der Leyen and Executive Vice-President and Commissioner for Tech Sovereignty, Security, and Democracy Henna Virkkunen announced that an EU age verification app was “technically ready” and would be rolled out “soon”. While the announcement may have sounded vague at the time, its implications remain far-reaching: the app could become the tool allowing governments and platforms to enforce age limits online in a consistent way across the European Union. Von der Leyen framed the tool as a major step in the “enforcement of our rules”, particularly with regards to obligations under the Digital Services Act (DSA), which entered into force in November 2022. In a further development, last week, at her annual State of the European Union speech, on 16 September 2026, President von der Leyen once again stressed the importance of age limits in protecting minors online. The day following the speech, the European Commission unveiled new legislation — the EU Kids Act — with key discussions now taking place on the adoption and implementation of these various political as well as technical proposals.

What is the age verification app?

At its core, the EU age verification app is designed to solve a simple but sensitive problem: how can users prove they are old enough to access age-restricted online content without revealing their full identity? The app is meant to provide a harmonised, EU-wide standard for age assurance. A central aim is to avoid the emergence of 27 different national age verification systems, with each Member State preferring or requiring its own version. Alongside the app itself, the Commission also intends to create an EU-wide framework for mutual recognition of age credentials so users can rely on a single, interoperable standard across the EU.

The app, developed by Scytáles and T-Sytems (respectively, a Swedish company specialised in digital identity and a German telecom IT and digital transformation provider), is built on the “European Digital Identity Wallet” framework and is meant to be easily integrated into a wide variety of digital services throughout the European Union. The Commission built the project around three pillars: privacy, transparency and ease of use. The software will be open-source, designed to minimise data collection and intended to work seamlessly across digital platforms. It should minimise data exposure and avoid platforms’ collecting sensitive identity-information themselves, consistent with the 2016 General Data Protection Regulation (GDPR). In this regard, the app is designed to let users prove their age without revealing personal data, using zero-knowledge-proof (ZKP) cryptography. In practice, users verify their identity once using a biometric passport or national ID to generate an age credential; platforms then receive only a yes/no age confirmation.

The age verification app is not a centrally managed EU application. Instead, Member States, and potentially private providers, will be able to deploy their own versions based on the common European framework. These solutions can either be offered as standalone applications or integrated into national European Digital Identity (EUDI) Wallets, which Member States must make available by the end of 2026 under the 2024 Electronic Identification and Trust Services Regulation 2.0 (eIDAS 2.0). To avoid fragmentation, the Commission has also proposed an EU-wide coordination mechanism to ensure age credentials are recognised across borders. The app was brought forward as a non-binding recommendation; this means it is not a new legal obligation but rather operationalises existing obligations under the DSA.

Why now?

The timing is no coincidence. Across the EU, policymakers have become increasingly concerned about children’s exposure to harmful content online. Several EU Member States have embarked on formal discussions — or already announced restrictions — on social media use for certain age groups. This has in turn fuelled debate on how to enforce such age limits.

It is in this context that the European Commission on 17 September 2026 proposed an “EU Kids Act” seeking to set clear digital boundaries. Under the proposed EU-wide legislation, children under 13 would not be able to access social media; children under 15 would not be able to create a personal account; and children between 15 and 18 would only have access to a limited, safely designed version. In the press conference explaining the EU Kids Act, European Commission President Ursula von der Leyen and Commissioner for Tech Sovereignty, Security and Democracy Henna Virkkunen explicitly pointed to the EU age verification app as the proper tool for enforcing such rules. (N.B. — The technology is not only useful for protecting children; it can also be used by websites to assess age-related discounts or offers, without requiring users to disclose their entire identity online).

Who will feel the impact?

The online gambling sector should be paying close attention. The European Commission has already, in 2025, classified online gambling as high-risk for minors under the DSA. The age verification app and EUDI Wallet are seen as the reference standard for this category, alongside sexual content and alcohol/tobacco advertising. Self-declared age verification alone is not adequate. (Alcohol and nicotine e-commerce, however, by contrast, don’t face a single EU-verification mandate, as age limits for these products remain nationally defined. In these sectors, therefore, the app is merely a technical option rather than a new legal driver.)

And social media platforms will of course be impacted. The Commission’s proposed EU Kids Act links access restrictions directly to age verification technology. In other words, debates around age limits and age verification are increasingly becoming one and the same discussion. Policymakers and stakeholders increasingly argue that age limits are only enforceable given robust verifications tools. Once a recognised age verification solution exists, arguments that robust age checks are technically impossible become less convincing.

Controversy

At the moment, the age verification app project is still far from being universally embraced. What was first presented as a technical solution to a regulatory problem has quickly become the subject of legal debate. After the app was unveiled by the Commission as ready — but not yet available to the public — reports by security experts quickly appeared pointing to critical vulnerabilities. Despite the Commission’s claiming to have fixed these problems, various Member States, including France, Ireland and Poland, remain sceptical and favour developing their own app. Additionally, some cybersecurity experts and civil liberties defenders, such as the Electronic Frontier Foundation (EFF), point to the dangers inherent in ZKPs. And civil society organisations, including European Digital Rights (EDRI), have argued verification tools can easily be circumvented and could actually limit children’s rights while not helping young people navigating risks online. Others have argued that requiring adults to verify their identities before accessing legal content shifts the burden from platforms to users. And some Members of the European Parliament have pointed out that the Commission should rather focus on enforcing the DSA — to further ensure the safety of the online environment — than attempt to build walls around unsafe content.

Conclusion

Ultimately, the success of the EU’s age verification framework will depend less on whether the technology works and more on whether citizens, platforms and Member States trust it. This is as much a political as technical question. The coming months will therefore be crucial. As the EU Kids Act moves through the EU’s legislative process and national governments prepare their own child safety initiatives, the EU will test whether privacy-preserving age verification can reconcile two objectives which have often seemed incompatible: preserving digital privacy and protecting children online.