To Enforce Its Proposed Social Media Ban for 450 Million Pre-Teens, EU Builds an Open Source App (reuters.com)
- Reference: 0185713954
- News link: https://yro.slashdot.org/story/26/09/20/0712211/to-enforce-its-proposed-social-media-ban-for-450-million-pre-teens-eu-builds-an-open-source-app
- Source link: https://www.reuters.com/legal/litigation/how-eus-age-verification-app-children-would-work-2026-09-18/
"Enforcement would rely on a tool Brussels built itself" — a free, open-source age verification smartphone app "that tells a platform whether a user meets an age threshold without revealing their identity..."
> If passed, the proposed Kids Act would create the world's largest social media access restriction, covering 450 million people across 27 countries... [The EU-built age-verification app] is being rolled out through member states, with seven pilot countries: Cyprus, Denmark, [3]France , [4]Greece , Ireland, Italy and Spain. The Commission expects EU-wide availability by the end of 2026.
>
> It will also be used to prove users are over 18 when accessing adult sites, a restriction already implemented under the Digital Services Act...
>
> [T]he system itself is decentralised. Member states run it through issuers they designate, and the proofs live on the user's phone. There is no central EU database of ages or of who verified whom... A user proves their age once to a nationally designated issuer — a body vetted by the member state, which can be a digital ID provider, a bank or a post office. At a restricted site, the app certifies that the user is above the required age threshold. The platform receives only a yes-or-no response. Issuance and verification are handled by separate entities. The proof provider is not told which service the proof was used for. Each proof works only once, preventing cross-service tracking. No identity documents or biometric data are retained. The code is open-source, allowing independent scrutiny.
>
> The significance of the EU approach is that it provides a common age-verification mechanism rather than leaving individual platforms to develop and enforce their own systems. "Online platforms can easily rely on our age verification app. So there are no more excuses," [EU Commission President Ursula] von der Leyen said...
>
> The proposal must be approved by EU member states and the European Parliament before becoming law.
Non-compliance would risk fines of up to 6% of a tech company's global annual sales, plus supervisory fees, Reuters [5]reported earlier . The EU's plan follows [6]similar initiatives in Australia, Britain, China, India, Turkey and several European Union countries.
[1] https://www.reuters.com/world/eu-commission-proposes-social-media-ban-children-under-13-2026-09-17/
[2] https://www.reuters.com/legal/litigation/how-eus-age-verification-app-children-would-work-2026-09-18/
[3] https://www.reuters.com/legal/litigation/macron-urges-eu-ban-social-media-under-15s-letter-von-der-leyen-2026-09-08/
[4] https://www.reuters.com/business/media-telecom/greece-ban-social-media-under-15s-2027-pm-says-2026-04-08/
[5] https://www.reuters.com/legal/government/australia-europe-countries-move-curb-childrens-social-media-access-2026-09-17/
[6] https://www.reuters.com/legal/government/australia-europe-countries-move-curb-childrens-social-media-access-2026-09-17/
Have they heard of a PC? (Score:2)
So how does "a free, open-source age verification smartphone app" run on a PC?
Re: (Score:3)
The same way your online banking website runs on your PC but verifies your login via an app. App based digital handshakes are a thing, not just for 2FA, but for all sorts of certifications.
Remember you're using a service, the service is responsible for implementing it. I suspect social media sites being social media sites will simply get users to use the app on their phone once or handshake via a QR code.
Re: (Score:3)
> The same way your online banking website runs on your PC but verifies your login via an app.
Does it? I regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them. Perhaps it is different in other countries. I sometimes have to receive an access code sent to my phone (an old feature phone) via SMS, but that's it. I also have a gadget which a couple of the banks sent me where I install my debit card, enter the PIN and then it gives me a one-time code, but I haven't needed to use that for some time.
My 80 year old mother-in-law liv
Re: (Score:2)
It's standard here in Iceland. *Everything* verifies via the phone, using the same authorization mechanism (SIM-based wireless PKI). The service sends out a special-coded SMS, which gets intercepted and routed to a SIM that has cryptographic applet flashed into it, which triggers a system-level authorization popup for you to confirm (the popup displays a verification code which was included by the site, so you see the same code on both the site and your popup), and which you can then confirm (with your PI
Re: (Score:2)
> Does it? I regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them.
You need 2FA since EU directive "PSD2" from 2015 (since then, the EU has updated to PSD3). It was implemented in the UK and requires "Strong customer identification" [1]https://sprintlaw.co.uk/articl... [sprintlaw.co.uk] However, it is possible that the UK legal implementation imposed 2FA only for payment (money getting out of your account) and maybe not for consulting your balance.
[1] https://sprintlaw.co.uk/articles/psd2-explained-what-uk-businesses-need-to-know-about-the-payment-services-directive-and-compliance/
Re: (Score:2)
> "regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them."
Topic shift, but.... I believe this is why so many companies have fought against TOTP. They want to FORCE you to use their proprietary "app" so they have full control over you. Walmart JUST DID THIS. I can no longer order online with Walmart because they stopped supporting 2FA with Email. I will not use their spy app, and I will not give them access to my phone number becaus
Re: (Score:1)
If you mean a desktop PC as opposed to a handheld PC, maybe it doesn't run. The summary suggests a phone is required.
I've been noticing this lately: a phone requirement. Twitter/x.com seems to have created this requirement in the last year (it won't let me log in unless I follow a qrcode using a phone; if you just decode the qrcode and follow the link in your usual browser, it refuses login).
For some reason, everyone is trying to force 100% phone adoption. There must be some vast extra attack surface on pho
Re: (Score:2)
"QR" code on screen (a RGB using code works better) mobile phone app sends confirmation with data from the code.
Goodbye (Score:2, Insightful)
"Member states run it through issuers they designate,"
Say goodbye to online anonymity then.
Re: (Score:2)
Yes, appears to be a less intrusive version of that the USA is implementing now.
Re: (Score:3)
> "Member states run it through issuers they designate,"
> Say goodbye to online anonymity then.
Except not. The member state's issuers only issue the certificate of certification that doesn't leave your device. The rest of the online world gets a yes/no token. Such systems are implemented in many different ways by member states for other purposes already.
But hey you don't even need to trust anyone about this. The app that sits in the middle of it all is open source. Go read the code yourself.
Re: (Score:3, Informative)
> Go read the code yourself.
Can I compile it myself, or install it on my GrapheneOS phone? No to both since each country makes its on version and those versions require device attestation.
Re: (Score:3)
Except not to you. You're confusing data minimization (the website doesn't get your name from the token) with unlinkability (nobody can connect your activity to your identity). The *token itself* doesn't reveal your identity, but it leaks data in a wide variety of ways.
Even if you browse via a proxy, if the authorization service gets a token directly from your phone, it has now correlated your phone with your proxy-browsed history. A very common means to do secure authentication these days is SIM-based wi
in our owners we trust (Score:2)
agreed very much, and valid points, except your faith in brussels is ... surprising? i'm guessing you're thinking about the likes of afd and rn, and there's some legitimate concern there. however ... is an opaque supranational institution ruled by a banking cartel any better? if they can't supress it (and they're trying hard) in no time they will own any "right wing menace" coming up anywhere just the same, so i don't think national political alternatives will mean much except some initial noise, new faces
Re:Goodbye (Score:4, Insightful)
You visit an online liquor store. The store asks your mobile phone whether you are of sufficient age. Your mobile phone asks the issuer, gets a yes/no token, forwards it to the liquor store. No data was leaked.
In countries where the issuer is "the bank", then in any case both the liquor and the bank already knew everything (the online liquor store already knew your payment details, and your bank already knew you make purchases at the online liquor store).
Re: (Score:2)
A nation can obviously make it traceable if it wants, it can also make it untraceable if it wants.
The app can just check your physical ID with NFC offline, set a flag "yep, older than 15" and be done with it.
Not completely safe (Score:3)
> "The platform receives only a yes-or-no response. Issuance and verification are handled by separate entities. The proof provider is not told which service the proof was used for."
And yet you still have to trust that this system doesn't get back-doored by three-letter agencies. Because if they do, then, suddenly, they have WAY more power than before.... now able to track where EVERYONE goes. And that is down to the individual level with confidence, not just an IP address or guess.
This gives the "yes/no" entity the power to completely shut down any person's ability to do anything meaningful online if they are able to match a device to a certificate with other means, and directed to do so by the government or some other powerful organization.
And it gives this cabal the ability to shut all sites/services out of the market they don't "like." Requiring they all use this yes/no entity and then refusing participation. (Granted, they kinda already have the option of mucking with DNS and ISP's).
And how are open source projects going to be forced to use the system? And why should they? Perhaps you can get coverage by the major sites and devices, but it won't cover the freedom-loving projects nor the shady sites/projects who simply won't use the system. Minors will have full access there. And all it takes is recompiling an open-source browser, IM, VOIP client, whatever, to issue a bunch of vetted "adult" certificates from a nefarious collection of them online, and now you have full access. And you also set off a war between legit users and the "system" trying to blacklist compromised certificates/identities... which, meanwhile, RUINS the lives of those who had their certificates/identities "stolen."
I am certain there are other issues smarter people than me could find with this arrangement. It could be worse, for sure, but...
Why not stop this madness and focus on PARENTS? Firstly, not giving unrestricted devices to minors. Secondly, having PARENTS be in the driver's seat to control what sites/people/services are allowed for their children. Thirdly, supporting a voluntary age appropriate tag for sites/systems that can be used by local device whilelists by the parents. And fourthly, changing the social norms that it is not OK for minors to have unrestricted devices anywhere. Then adults are not impacted at all. And most of the burden falls on the actual responsible party, who should have intimate knowledge about what is or isn't appropriate at their children's developmental stage.
Re: (Score:3)
I was expecting these types of comments. It is a typical programmer mindset. I have it myself. Sure it is a leaky solution, but when trying to push humanity in a direction, you need to look at it statistically. If it changes the behavior of more than 25% of the people, it is nice. 50% is great. 75% is astonishing, 95%? Nazi terrirtory ;-)
My kids have time limits on their smartphone and the tv. All they need is an "external impulse" that says stop. For the TV, it is a simple stopwatch. Very easy to manipu
Re: (Score:2)
I guess this is very relevant for 2026. The control approach is classic programming, the other approach is training the llm..."
Re: (Score:2)
> "I was expecting these types of comments. It is a typical programmer mindset. I have it myself. Sure it is a leaky solution, but when trying to push humanity in a direction, you need to look at it statistically. If it changes the behavior of more than 25% of the people, it is nice. 50% is great. 75% is astonishing,"
Oh, I know. I actually have to defend my position on empowering parents and making THEM responsible for THEIR children on the same basis. I get comments that kids could go to their neighbor
Re: (Score:2)
> And yet you still have to trust that this system doesn't get back-doored by three-letter agencies.
The "three-letter agencies" discover no new information here. They ALREADY know your name, date of birth, browsing history, online purchase history.
> This gives the "yes/no" entity the power to completely shut down any person's ability to do anything meaningful online
Nothing new. The entity is under the same regulatory framework as your bank or your ISP, which already can shutdown your abilities of doing things. It's just another, very limited channel where a bug or intentional action can restrict your abilities to buy liquor and dildos.
> And it gives this cabal the ability to shut all sites/services out of the market they don't "like." Requiring they all use this yes/no entity and then refusing participation. (Granted, they kinda already have the option of mucking with DNS and ISP's).
Besides your acknowledgement that they already had the DNS option, the whole "can shot do
Re: (Score:2)
> "The European approach has always been, in any problem, to make the burden lie on the business side."
Or the government.
But, agreed. And the USA approach has always been (or at least used to be) to look towards the parents, family, and community, not the government or businesses. Which is why there will (hopefully) be more pushback here.
Re: (Score:2)
> And yet you still have to trust that this system doesn't get back-doored by three-letter agencies.
Congratulations, you just described electronics. I hope you made this post via telegram and got someone to type it into a burner laptop from an internet cafe, otherwise you may be being watched by the boggieman.
Re: (Score:1)
> Why not stop this madness and focus on PARENTS?
Why not indeed? I'm sure that Eurocrats and their supporters are widely known for their devotion to parents being in control, right?
> Firstly, not giving unrestricted devices to minors.
Oh sure, society will support that. Why, let's take a poll right here on /., shall we? Bark phones for all!
> Secondly, having PARENTS be in the driver's seat to control what sites/people/services are allowed for their children.
Fine with me. Actually fine with the people here who are complaining about this system? Not so much.
Well, you get the idea. Complainers are fine with blaming parents for everything. Letting parents have actual control over their own children though (which would be needed
Wife was fascinated with the exchange at home (Score:2)
(son's voice): Herr Fatherland?
(husband's voice): Ich bin gleich bei dir, mein Junge
Wife: "What's going on?"
Husband: He wants me to log in to an adult site
Wife: Oh.
Why not build a social media app? (Score:2)
Instead of a ban, why not have an open source, social media app that is certificate based and allows each geographic region to dictate policies for the app on their turf, with the app using GPS coordinates and maybe other authentication methods to reduce spoofing? Yes, it would have boundaries in place (keep 18+ who are not family away from those below 18+, have geographic regions fenced off from each other), but why not offer something.
Outright bans don't help. However, having alternatives that do the sa
Let us ban social apps (Score:1)
By... building a social app?!
Where is the logic here?
Winos as bypass - ? (Score:2)
In our day, we got some older guy to buy booze for us, and gave him a buck or two for his trouble. What's to stop some enterprising kids from having an adult register as them, so they appear "of age," thereafter?
The stupidity increases (Score:2)
Kids are smart and good at finding workarounds
Banning something makes it more desirable
It also trains kids to hate the government at an early age
Completely wrong approach (Score:2)
This is the wrong approach. Social media is just as dangerous for adults as it is for kids.
We need to ban the current social media business models for everyone . That means: No advertising allowed; only show content from people or groups you actually follow; show content strictly in descending chronological order; do not allow sponsored content; charge people to have an account (Facebook probably makes around $3-$5/month/user, so that's a good benchmark.)
Also: Any sort of age verification as described s
Well .... (Score:1)
...surely if we can ban metal tubes with things that go boom inside them, then we can ban pre-teens from using social media, yes?
We've never let the impossible stop us before!
Re: Well .... (Score:3)
Failure to achieve perfect compliance is not actually failure. I think anyone with a few braincells knows that a law is not perfect and will not stop every instance of a behavior.