The European Union’s new age verification app is already facing serious criticism after security researchers uncovered major vulnerabilities within hours of its release.
Quick Summary – TLDR:
- EU launched an age verification app focused on privacy and data protection.
- Security experts quickly found flaws exposing biometric data.
- App can reportedly be bypassed in minutes using simple methods.
- Concerns raised over compliance with data protection laws and overall design.
What Happened?
The European Commission introduced a new age verification app to help users prove they are over 18 without sharing personal identity details. However, within hours of its release, researchers flagged serious security and privacy issues that could undermine its purpose.
Hacking the #EU #AgeVerification app in under 2 minutes.
— Paul Moore – Security Consultant (@Paul_Reviews) April 16, 2026
During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.
1. It shouldn’t be encrypted at all – that’s a really poor design.
2. It’s not… https://t.co/z39qBdclC2 pic.twitter.com/FGRvWtWzaZ
A Privacy Focused App With Immediate Concerns
The app was announced by Ursula von der Leyen, who said it meets the highest privacy standards while remaining easy to use. Built as an open source tool, the app aims to help online platforms comply with rules under the Digital Services Act by verifying user age without exposing identity.
Users can set a PIN, enable biometric authentication, and generate a proof-of-age credential through a mock identity system. The goal is simple: confirm age without storing personal data.
However, early testing has raised doubts about whether those privacy promises hold up in practice.
Biometric Data Exposure Raises Red Flags
Security researcher Paul Moore found that the app stores sensitive biometric data in ways that may not be secure.
Key concerns include:
- Facial images extracted from identity documents are saved as unencrypted files.
- These files may remain on the device if the verification process fails.
- Selfie images used for verification are stored and never deleted.
This directly conflicts with the app’s claim that it does not store personal data. Since biometric data is classified as highly sensitive under GDPR rules, this could lead to regulatory concerns.
App Can Be Bypassed With Minimal Effort
Beyond data exposure, the app’s authentication system appears weak.
Moore demonstrated that:
- The encrypted PIN is not properly linked to user credentials.
- By deleting certain configuration values, users can reset the PIN without losing access.
- Existing identity data can still be used after resetting access controls.
Even more concerning, he claimed the system could be bypassed in under two minutes.
In a separate test, he recreated the app’s logic using a browser extension. This allowed him to generate fake verification responses that platforms would accept as valid proof-of-age.
Weak Security Controls Add to the Problem
Additional flaws make the system even easier to manipulate:
- Rate limiting can be reset by editing a simple counter.
- Biometric authentication can be disabled by flipping a basic setting.
- Sensitive data is stored in editable files instead of secure hardware environments.
Developers have questioned why stronger protections like secure device storage were not used.
These issues suggest the problem is not just bugs but deeper design weaknesses.
Growing Debate Around Age Verification Systems
The controversy comes at a time when governments worldwide are pushing stricter age checks online.
Recent developments include:
- The United Kingdom enforcing age checks under its Online Safety Act.
- Australia banning social media access for users under 16.
- Platforms like Discord and Reddit facing pressure to verify user ages.
At the same time, critics argue that such systems can create centralized targets for cyberattacks and increase privacy risks.
More than 400 security researchers have already warned that these approaches could lead to surveillance concerns and unintended consequences.
SQ Magazine’s Takeaway
I think this situation shows how difficult it is to balance privacy and security in real world systems. The EU clearly aimed to build something privacy first, but in doing so, it may have overlooked basic security fundamentals. If an app designed to protect users ends up exposing sensitive data, it defeats its entire purpose. This should be a wake up call for regulators and developers to slow down and get the foundation right before rolling out such tools at scale.
