European &quot;age verification&quot; &quot;app&quot; forcing everyone to use Android or iOS

Do not add Google Play Integrity integration

General

@TheLastProject

Return to top

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

TheLastProject

Jul 16, 2025

In the README, the following is listed:

App and device verification based on Google Play Integrity API and Apple App Attestation

I would like to strongly urge to abandon this plan. Requiring a dependency on American tech giants for age verification further deepens the EU's dependency on America and the USA's control over the internet. Especially in the current political climate I hope I do not have to explain how undesirable and dangerous that is.

Beta

Was this translation helpful?

Give feedback.

👍

3116

👎

🎉

😕

❤️

220

🚀

135

👀

Replies:

277 comments

314 replies

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

{{editor}}'s edit

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

TheLastProject

Jul 16, 2025

Author

Furthermore I am surprised this is considered an important next step, given apps like the Dutch identity app Yivi (who has no such dependency) already exist and can be used for age verification by the government just fine (on the few select platforms that work with it). Yivi is even available on Open Source app stores like F-Droid.

I think Yivi's existence should be sufficient proof that Google Play Integrity integration is unnecessary.

Yivi (formerly IRMA) homepage: https://yivi.app/en/

https://yivi.app/en/

Beta

Was this translation helpful?

Give feedback.

👍

867

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

thgoebel

Jul 16, 2025

thgoebel

This this seems to be a fork of the EUDI wallet, see also:

Please remove the requirement for Google Play Integrity eudi-app-android-wallet-ui#287

use the standard Android hardware attestation API to verify the device, OS and app instead enforcing licensing Google Mobile Services eudi-app-android-wallet-ui#390

Beta

Was this translation helpful?

Give feedback.

👍

220

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

duncan-bayne

Jul 16, 2025

duncan-bayne

In addition, tying age verification to specific operating systems and their vendors (large American tech companies) violates two of the three principles listed elsewhere in this org:

made available to anyone who wants to use it

controlled by users

Beta

Was this translation helpful?

Give feedback.

👍

620

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

duncan-bayne

Jul 16, 2025

duncan-bayne

https://ageverification.dev/Technical%20Specification/architecture-and-technical-specifications/#24-design-principles

Furthermore, from https://ageverification.dev/Technical%20Specification/architecture-and-technical-specifications/#24-design-principles -

Interoperability: The solution ensures seamless integration across diverse device operating systems, wallet applications, and online services.

Tying age verification to specific operating systems will directly violate this design principle.

Beta

Was this translation helpful?

Give feedback.

👍

477

❤️

🚀

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

k0nstruct

Jul 16, 2025

k0nstruct

I've made that argument here.

Digital sovereignty is a necessary step to reduce the risks of data processing. There should be no dependencies for external services from third parties at all since each one adds a whole ecosystem of potential security issues.

Beta

Was this translation helpful?

Give feedback.

👍

292

🚀

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

{{editor}}'s edit

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

orazioedoardo

Jul 17, 2025

orazioedoardo

Jul 17, 2025

This is insane, what's the threat model? Someone remotely exploiting a device to steal proof of age of majority just to watch p__n (most common use case)? Is it even realistic? Why does this service need an app at all? Just create a modern web app, maybe even leveraging Digital Credentials API. I'm tired of app-for-everything.

Beta

Was this translation helpful?

Give feedback.

👍

247

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

{{editor}}'s edit

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

BoGnY

Jul 17, 2025

BoGnY

Jul 17, 2025

This happens because those who draft the technical specifications don't know how the technologies they propose work.

As I've explained elsewhere, this is ridiculous. Here's a brief excerpt from one of my posts elsewhere:

It's incredible that the European Commission sanctions Google for abuse of dominant position and asks to open the operating system to other stores to allow "free" competition and you [the writer of technical specifications] impose the use of tools that exclude the free choice of the user and give to Google all the power of choice, that's really INCREDIBLE...

There are dozens of ways to secure these apps' certificates without using proprietary systems.

Not to mention that Play Integrity systems are 100% illegal.

Beta

Was this translation helpful?

Give feedback.

👍

208

😕

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

orazioedoardo

Jul 17, 2025

orazioedoardo

Jul 17, 2025

There are dozens of ways to secure these apps' certificates without using proprietary systems.

Does it need to protect those certificates at all? Maybe I'm too naive, but couldn't this simply be implemented by verifying random challenge signed by a national identity provider?

User goes to p__n website

Website detects user is visiting from Europe

Website downloads them a file containing a random string

Website tells them to visit verifyage.gov.example

User logs via identity provider and uploads the file

Challenge is signed and downloaded through the browser

User goes back to the p__n website and uploads the file

Website verifies the challenge is signed by a trusted entity

Avoids having to protect the signed challenge at all since it's single use, scheme is similar to authenticating with SSH or WebAuthn. I haven't checked the architecture thorough, perhaps does something similar in the end with more bloat in between.

Beta

Was this translation helpful?

Give feedback.

👍

👎

@feldim2425

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

{{editor}}'s edit

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

feldim2425

Sep 5, 2025

feldim2425

Sep 5, 2025

Perhaps the logical conclusion would be that strict age verification just isn't a useful thing to try, and instead parents should be encouraged to actually make use of the client-side filters that pretty much all smartphones have. I've made that argument here.

I agree, however given the people currently see the internet helped by certain incidences (cough Roblox cough*) I'm not very hopeful that this view will change in the near future. Maybe it could change once the system is implemented and fails horribly but that will take time.

Note: With "people" I don't just mean politicians. I've heard this from clueless parents as well as people from the "I've nothing to hide"-crowd that truly believe there is no way this could ever go wrong.

Beta

Was this translation helpful?

Give feedback.

👍

@nukeop

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

nukeop

Sep 5, 2025

nukeop

Sep 5, 2025

What the hell is a p__n website?

Beta

Was this translation helpful?

Give feedback.

@k8ieone

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

k8ieone

Sep 5, 2025

k8ieone

Sep 5, 2025

Porn, pornography. I see no reason fo the self-censorship here.

Beta

Was this translation helpful?

Give feedback.

👍

@lukefromdc

Sep 7, 2025

I know, I know. It wasn't aimed at you, @lukefromdc

@lukefromdc

Beta

Was this translation helpful?

Give feedback.

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

{{editor}}'s edit

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

andrew-ld

Jul 18, 2025

andrew-ld

Jul 18, 2025

Please listen the ongoing issues with the Italian Wallet related to Play Integrity:

mega thread:

pagopa/io-app#6327

Duplicates:

pagopa/io-app#7014

pagopa/io-app#7199

pagopa/io-app#6942

pagopa/io-app#6820

pagopa/io-app#6763

https://github.com/pagopa/io-app/issues/6507

pagopa/io-app#6524

https://github.com/pagopa/io-app/issues/6507

pagopa/io-app#6524

Beta

Was this translation helpful?

Give feedback.

👍

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

cucumberslumber

Jul 27, 2025

cucumberslumber

Fuck Google

Beta

Was this translation helpful?

Give feedback.

👍

👎

😕

❤️

178

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

BillCipher-exe

Jul 27, 2025

BillCipher-exe

A mandatory Google account is unacceptable in a OSS Project

Beta

Was this translation helpful?

Give feedback.

👍

384

❤️

@Kobaxidze256

Getting access to a website as a EU citizen by accepting the TOS of EU-penalized American megacorp is peak 1984.

Beta

Was this translation helpful?

Give feedback.

👍

319

❤️

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

ksthiele

Jul 27, 2025

ksthiele

Besides the privacy issues, this feels like South Korea's IE6 problem back in the days, everything was so tied and dependent on it, that they couldn't get rid of it. But I guess we are just humans repeating mistakes, getting influenced by lobbyists, uninformed people, people who can't imagine how things will look like in 10 or more years

Beta

Was this translation helpful?

Give feedback.

👍

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

petervanstark

Jul 27, 2025

petervanstark

This would be massive hinderance to all South EU states, where adoption of non google phones is large.

This would be also massive dependency on google.

Furthermore, why on earth are you building digital ids but then not doing IDPs, then forcing users to use some extra app for agecheck... they and their OS maintains...

It is bad UX, it causes issues, not sure if adds any security.

Beta

Was this translation helpful?

Give feedback.

👍

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

fuomag9

Jul 27, 2025

fuomag9

https://grapheneos.social/@GrapheneOS/116200110686604617

I work in cybersecurity and this is a privacy and security nightmare. Just stop.

Using a EU-controlled website with national credentials like it is proposed here #18 is the only reasonable solution.

#18

Or maybe just do not implement this at all. People are going to go to p*** websites a way or another anyway.

Beta

Was this translation helpful?

Give feedback.

👍

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

lukefromdc

Feb 23, 2026

lukefromdc

lukefromdc

Feb 25, 2026

Beta

Was this translation helpful?

Give feedback.

@solodeveloping

Mar 23, 2026

A European company called Volla is now pushing for their "Unified Attestation" service to replace Google Play Integrity, but their product still has all the same problems as Google's version does. It still bans rooting your device and restricts what OS you are allowed to run.

The GrapheneOS team went into detail on the various issues here: https://grapheneos.social/@GrapheneOS/116200110686604617

Beta

Was this translation helpful?

Give feedback.

👎

Apr 3, 2026

Skorpion96

Apr 3, 2026

Let's be honest.... Normal people who root their devices won't try to crack or tamper the app or bypass protections. Also.... If you care about the files of the app in /data/data/com.package.name you could just encrypt the most important ones even with a key generated during the first open of the app which will use entropy. What can do root now? Is the problem stuff like http toolkit? Detect it and in case block it or block adb, but even if someone can know what calls the app does, the app is opensource anyway so there is no point in doing it... You see? What is the point of fighting root? Are you scared that someone could replace the ID or values used during verification process? Don't store them but use identifiers and immediately drop them after verification is successful. This way unless the person provides a valid ID immediately they will fail to verify. Play integrity is unnecessary, are you scared of people tampering the apk itself? Add signature verification to the apk, if that's tampered app will fail to start displaying signature doesn't match. Are you scared someone will anyway beat the app internal signature system? Verify it as well by a server check. Again, play integrity being useless.

Beta

Was this translation helpful?

Give feedback.

👍

@ell1e

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

ell1e

Apr 10, 2026

ell1e

Apr 10, 2026

If the key is on your smartphone, some people are going to manage to extract theirs at some point no matter what security through obscurity attestation stuff is in the way...

Beta

Was this translation helpful?

Give feedback.

👍

@Skorpion96

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Skorpion96

Apr 10, 2026

Skorpion96

Apr 10, 2026

You see? What is the point of fighting root? Are you scared that someone could replace the ID or values used during verification process?

They don’t want people to pull the private key and host a fake age verification service where you can download or buy age attestation from a server.

As I said, if this key would be server side there would be no way of replacing it

Beta

Was this translation helpful?

Give feedback.

@nukeop

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

nukeop

Apr 10, 2026

nukeop

Apr 10, 2026

You should acquaint yourself with this technology: https://support.apple.com/en-gb/guide/security/sec59b0b31ff/web

https://support.apple.com/en-gb/guide/security/sec59b0b31ff/web

Beta

Was this translation helpful?

Apr 11, 2026

Secret-chest

https://support.apple.com/en-gb/guide/security/sec59b0b31ff/web

You should acquaint yourself with this technology: https://support.apple.com/en-gb/guide/security/sec59b0b31ff/web

So Apple devices have a hidden chip whose only purpose is for (cr)apps to deny the user's agency by hiding data from them. All the more reason to avoid Apple!

Beta

Was this translation helpful?

Give feedback.

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

solodeveloping

Apr 3, 2026

https://www.hollywoodreporter.com/news/general-news/ashton-kutcher-resigns-thorn-danny-masterson-letter-1235591856/

Apr 3, 2026

Some articles people need to see about these people:

THORN guy defends a rapist https://www.hollywoodreporter.com/news/general-news/ashton-kutcher-resigns-thorn-danny-masterson-letter-1235591856/

More on THORN: https://www.jezebel.com/ashton-kutcher-thorn-sex-workers-1850852760

https://www.jezebel.com/ashton-kutcher-thorn-sex-workers-1850852760

Europol aske for unlimited access to data: https://balkaninsight.com/2023/09/29/europol-sought-unlimited-data-access-in-online-child-sexual-abuse-regulation/bi/

https://balkaninsight.com/2023/09/29/europol-sought-unlimited-data-access-in-online-child-sexual-abuse-regulation/bi/

Corruption scandal: https://balkaninsight.com/2023/09/25/who-benefits-inside-the-eus-fight-over-scanning-for-child-sex-content/uncategorized/

https://balkaninsight.com/2023/09/25/who-benefits-inside-the-eus-fight-over-scanning-for-child-sex-content/uncategorized/

THORN lies and probably harass sex workers: https://reason.com/2017/02/15/ashton-kutcher-plays-sex-worker-savior/

https://reason.com/2017/02/15/ashton-kutcher-plays-sex-worker-savior/

Beta

Was this translation helpful?

Give feedback.

@solodeveloping

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

solodeveloping

Apr 14, 2026

https://investigativejournalismforeu.net/projects/the-data-trap/

More here: https://investigativejournalismforeu.net/projects/the-data-trap/

Beta

Was this translation helpful?

Give feedback.

@solodeveloping

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

solodeveloping

Apr 14, 2026

I mean, the whole thing is public knowledge

"Star of That ‘70s Show and a host of Hollywood hits, 45-year-old Kutcher resigned as chairman of the Thorn board in mid-September amid uproar over a letter he wrote to a judge in support of convicted rapist and fellow That ‘70s Show actor Danny Masterson, prior to his sentencing."

Beta

Was this translation helpful?

Apr 14, 2026

https://fortune.com/2023/09/26/thorn-ashton-kutcher-ylva-johansson-csam-csa-regulation-european-commission-encryption-privacy-surveillance/

Beta

Was this translation helpful?

Give feedback.

@solodeveloping

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

solodeveloping

Apr 14, 2026

https://techcrunch.com/2024/01/10/eu-ombudsman-csam-thorn/

Beta

Was this translation helpful?

Give feedback.

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

thomaswebbers

Apr 11, 2026

thomaswebbers

Did my comment about my 1984 comment getting removed really get removed??

Damn.

Tells me all I need to know.

Beta

Was this translation helpful?

Give feedback.

👍

@solodeveloping

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

solodeveloping

Apr 14, 2026

see no evil, hear no evil, speak no evil 😂

Beta

Was this translation helpful?

Give feedback.

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Secret-chest

Apr 11, 2026

Secret-chest

This is a measure to ban general computers. We will all be made to give up real computers and own a locked phone with telescreen features and censorship.

Beta

Was this translation helpful?

Give feedback.

Apr 11, 2026

akku1139

Remember that EU actions, for better or worse, are imitated all over the world.

Beta

Was this translation helpful?

Give feedback.

@solodeveloping

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

solodeveloping

Apr 14, 2026

It's more like all the politicians are corrupts and taking order from oligarchs and private lobbies

Beta

Apr 15, 2026

The only true way to make it more effective is more biometrics, something like https://anuscan.com/

https://anuscan.com/

Beta

Was this translation helpful?

Give feedback.

😄

@solodeveloping

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

solodeveloping

Apr 15, 2026

Remember the goold old days where biometrics and creepy surveillance were seen as dystopian? 😂

Talking about effectiveness: the only way to make sure someone does not kill someone else is to cut his arm and legs, remove his teeth too, so this is probably what nukeop wants too

Beta

Was this translation helpful?

Apr 15, 2026

My opinion is "fuck this shit"

A reason for that is "it will never work"

Another is "they're not doing it for "the kids""

Beta

Was this translation helpful?

Give feedback.

👍

@Secret-chest

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Secret-chest

Apr 19, 2026

Secret-chest

Apr 19, 2026

No, the idea is that it only hurts legitimate users who simply do not want Android or iOS, and it's not even effective against the ones it attempts to block (and no sane system can be). So the best way is not to have it.

Beta

Was this translation helpful?

Give feedback.

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Uh oh!

There was an error while loading. Please reload this page.

[Please reload this page]()

Idcrafter

Apr 15, 2026

Idcrafter