Online age checks are coming in Europe

BRUSSELS — The EU is rolling out a way to check people’s ages online within weeks as it plows ahead with efforts to protect kids on the internet — claiming to have solved longstanding concerns over privacy and security in the process.

The move comes as European leaders including France’s Emmanuel Macron and the United Kingdom’s Keir Starmer amp up the pressure on social media platforms to do more to protect their users from mental and physical health risks.

Macron will host a ​call with EU leaders on Thursday as well as with European Commission President Ursula von der Leyen ​to push for action on banning social ⁠media for kids.

Announcing a new age-verification tool in Brussels on Wednesday, von der Leyen said the world’s biggest tech platforms have “no more excuses” for not checking users’ ages before letting them access restricted content like pornography or gambling — or, soon, social media.

If the Commission manages to bring platforms in line, internet users in the EU — even those just visiting the bloc — will soon be asked to verify their age to access age-restricted online services.

But age checks are widely seen by privacy advocates as a Trojan horse of surveillance, and several said Brussels’ initiative needs much more work before it should go live.

“We are deeply worried by the Commission plans to tie digital identity with the technical implementation of age verification,” Thomas Lohninger, executive director of Austrian privacy NGO epicenter.works, told POLITICO.

Arguing that the source code is “nowhere near a production-ready state,” Lohninger said the Commission must “rethink their plans for age verification and instead focus on overdue enforcement” of the EU’s online content laws.

Critics say that any effort to verify age will undermine online anonymity and risks hurting the right of children to have access to information.

Wednesday’s move comes as the political momentum behind age restrictions for addictive social media platforms outruns the policy assessments. A panel of experts convened by von der Leyen to draft its recommendation will hold its second meeting on Thursday. It will deliver its policy proposal by the summer, von der Leyen said.

“It is for parents to raise their children and not for platforms,” von der Leyen said as she unveiled the new tool, saying the technology is ready to be rolled out in the coming weeks.

The age verification app will not be mandatory for platforms, but the Commission said it is their preferred solution for how platforms should check the age of users to meet legal requirements. If they want to use other solutions, they need to prove that they are equally good.

Macron will host a ​call with EU leaders on Thursday as well as with European Commission President Ursula von der Leyen ​to push for action on banning social ⁠media for kids. | Etienne Laurent/AFP via Getty Images

To assuage privacy concerns, the Commission said it has integrated so-called zero-knowledge proofs — a cryptographic solution that will allow the app to transmit only a yes-or-no answer about age to platforms, without revealing identifying information.

It’s a “gold standard” for privacy, a senior Commission official told reporters.

According to Simeon de Brouwer from EDRi, an umbrella privacy civil society group: “The Commission touts its tools as addressing privacy concerns, but other digital rights — the freedom of information, of expression of young people and of the adults who won’t be able to use the tool — are completely forgotten.”

Gaining momentum

Von der Leyen’s announcement — although technical — is indicative of the huge momentum behind social media bans to keep kids and teenagers away from platforms and their addictive algorithms.

Seven countries that had already been working on their own apps in coordination with the EU will deploy their versions by the end of the year, the senior Commission official said: Cyprus, Denmark, France, Greece, Italy, Ireland and Spain.

The app gives people three ways to prove their age: passports, national IDs and a third way dubbed a “QR code” under which a trusted provider such as a school or a bank can attest to a user’s age.

The application will then store the information as to whether the user is over 13, 15 or 18 years of age without retaining other data, the Commission official said. Online services, like adult content sites or social media, can then call on the app to check if a user is over a certain age.

Von der Leyen will present the solution to EU leaders on Thursday in a bid to gain political support. The call will be attended by eight heads of state as well as Macron — from Cyprus, Czechia, Germany, Greece, Italy, Ireland, Spain and Slovenia — as well as by Austrian, Dutch, Polish and Portuguese digital ministers, an Élysée official said.   

The app will work by using IP addresses, which show the location of users, meaning it can be circumvented with a virtual private network, the senior Commission official said.

Rand Hammoud, director of security at civil society group Center for Democracy and Technology Europe, said in an emailed statement that the plans “provide little reassurance around the many data protection, anonymity and security concerns for high-risk individuals” such as human rights defenders, people in exile or journalists “who all need to be able to access online services anonymously and in safety.”

Hammoud said it is also unclear what kind of data access governments and EU agencies would have through the system, and how the Commission would prevent tracking or sharing personal data with other companies or governments.