When Paul Moore heard the European Commission President saying that the EU age verification app will “give youngsters a safer begin on-line,” he was unconvinced.
“Bypassing the most recent EU age verification app (2026.07-1) with a Chrome extension,” he later posted on X. And it wasn’t the primary time.
With over 20 years of expertise below his belt, Moore managed to bypass the app again in April, proper after the Fee first launched it. Mixed, his experiences have led him to a simple conclusion: “nameless age verification does not work.”
Whereas the method he used to bypass the verification system doesn’t undermine folks’s privateness, Moore believes the long-term impression of its ineffectiveness will.
“All it’s an escalation path being drip-fed, little by little below the guise of kid security,” Moore instructed TechRadar. It gained’t simply be about proving your age. “The following step will likely be proving who you’re,” he mentioned.
The EU’s ‘privacy-preserving’ strategy
A lot of the present age verification strategies, which require scanning nationwide ID paperwork or biometrics, put folks’s delicate knowledge in danger. (Suppose, for instance, of the information breach that affected Discord’s age verification supplier and uncovered 70,000 folks’s government IDs and personal data final 12 months.)
For that motive, there is a rising sense of urgency to discover a answer that helps folks show their age with out accumulating delicate data. And the European Fee argues that it has discovered it.
Drawing on the framework of the COVID-19 certificates app, the Fee got here up with a template for a privacy-first, open-source device that EU member states can use to construct their very own nationwide apps.
The method — which is a part of the larger European Digital Identification Pockets (EUDI) challenge — leverages zero-knowledge proofs (ZKPs) and verifiable credentials (VCs) to confirm somebody’s age with out sharing delicate data.
In different phrases, your telephone scans your ID and shops that knowledge regionally. Web sites will then ask customers to scan a QR code by way of the app to show they’re sufficiently old to entry sure content material.
A European Fee spokesperson instructed TechRadar that on-line providers will not obtain any private details about the customers, saying: “The age proof merely confirms whether or not the person meets the age requirement.”
Moore doesn’t dispute the privateness credentials of the method. Maybe worse, he simply doesn’t suppose it is going to work.
Why the EU age verification does not work
Whereas the EU age verification blueprint appears like a welcome enchancment in comparison with the present strategy, the benefits do not maintain up.
That is as a result of Moore says age checks must be tied to an individual’s identification to be reliable. “The second you strip the identification away from how outdated any person is, an individual cannot reply that query,” he mentioned.
Because the April launch, the device’s safety credentials have even been improved, however Moore says the difficulty isn’t a bug however your complete course of, criticising the most recent efforts as mere “safety theater.”
How Moore bypassed the app
Bypassing the app wasn’t tough. In actual fact, Moore says he constructed two Chrome extensions on Claude in minutes.
The primary extension he constructed replicated the Android app, however with the ID checks eliminated. This meant he may skip the necessity for a person to scan a doc totally.
“It detects the QR code mechanically (when introduced by an internet site) and passes verification,” Moore explains, including that the method is totally automated without having to work together with the Chrome extension as soon as put in.”
This week, Moore went further and constructed a Chrome extension that may seize the QR code from an internet site and mechanically ahead it to a distant, automated telephone to get a real signature in seconds.
#EU #AgeVerification unfixable bypass:✅ Automate the system✅ Detect and relay the QR code⏱️ Push to GitHubOnce an age verification QR code seems, it is going to detect & mechanically relay to a authentic system that completes the verification remotely.If a “technically… https://t.co/O0Z0BpCOs8July 31, 2026
Generally known as an ‘automated relay bypass,’ these assaults imply nothing within the course of is faked, making prevention virtually unattainable.
“Even after they allow all different safety mechanisms, each will proceed to work,” Moore mentioned.
The EU’s response
When requested whether or not any steps had been taken to stop circumvention, a European Fee spokesperson mentioned: “We in fact rely additionally on mother and father and caretakers to examine what youngsters are doing on-line,” including that the app’s aim is “avoiding the unintended publicity of children to inappropriate content material.”
But, in response to Moore, lawmakers’ focus is misdirected. He mentioned: “What [lawmakers] are lacking is that the menace actor is not a 3rd celebration; the menace actor is the person.
“They do not need age verification within the first place, so they’ll search for methods to bypass the system. And if the system could be bypassed by design, they may do it.”
Deciding to not impose a brand new regulation or expertise just because it could possibly be bypassed is unlikely to persuade lawmakers. However the issue could lengthen past an ineffective system.
In actual fact, Moore fears that the app’s inevitable ineffectiveness may push lawmakers to show to extra invasive checks and an erosion of individuals’s privateness.
Subsequent step? Our identification
When Moore says the idea is damaged, he’s calling out what he sees as a basic flaw within the EU age verification framework’s design: client-side belief.
The app is extra privacy-preserving than passports and face scans as a result of the information gained’t go away the person’s system. However this can be precisely why its implementation is sure to fail. If nothing leaves the system, Moore explains, there isn’t a technique to belief or confirm what has been obtained.
This creates a problematic catch-22 for European lawmakers. When this ‘nameless’ app fails to maintain children off restricted websites, Moore contends that Brussels is unlikely to easily quit on its flagship security initiative and drop privacy-preserving practices altogether.
“For them to push forward with it below the guise of kid security is an escalation path to say we have tried this; the pure route is now you have to show your identification,” Moore instructed TechRadar.
It’s clear that age verification is right here to remain, regardless of steady outcry coming from privateness advocates, technologists, and knowledge scientists who warn it may do more harm than good.
For Moore, the hazard is that what’s marketed as a privacy-first breakthrough at this time could finally be used to undermine privateness tomorrow.
Follow TechRadar on Google News and add us as a preferred source to get our knowledgeable information, evaluations, and opinion in your feeds. Make certain to click on the Observe button!
