- within Privacy, Technology, Litigation and Mediation & Arbitration topic(s)
- with Inhouse Counsel
- in Australia
- with readers working within the Banking & Credit, Healthcare and Property industries
On 15 April 2026, European Commission President Ursula von der Leyen and Executive Vice-President Henna Virkkunen announced that the EU’s long-anticipated age-verification app is now “technically ready”. Positioned as a “gold standard” to protect minors online, the app is designed to give platforms and Member States a privacy-preserving way to support age checks under the EU’s Digital Services Act (‘DSA’). But, for online providers operating in Europe, this technical solution arrives amidst a rapidly fragmenting patchwork of national age-restriction laws and does not resolve the harder question of how to comply as national rules on children’s access to online services continue to diverge, leaving key compliance questions unanswered.
For US-based companies with European users, the takeaway is straightforward: a common technical tool is emerging, but the compliance burden is still likely to vary by Member State.
A Privacy-Preserving Technical Blueprint
The EU age-verification app was developed to address longstanding privacy concerns associated with age assurance. According to the specifications for the app, interoperability, privacy and security are key concerns for the Commission in designing the main requirements of the app. The Commission acknowledges that the development of the app is far from finished, but an interactive process, and that key areas require feedback from stakeholders across industry and civil society.
The Commission says the app allows verification through electronic identification, on-device passport or ID card scans, or QR codes issued by trusted third parties like schools. Importantly, the app is designed to let users prove they meet an age threshold without disclosing unnecessary identity data.
Crucially for online services, the EU app is not currently a strict legal mandate. It is better understood as a reference implementation than as a standalone legal requirement. The Commission has presented the open-source blueprint as a benchmark solution to help platforms demonstrate compliance with the DSA.
The EU app is being built on the same technical specifications as the European Digital Identity Wallet framework, which is expected to roll out by the end of 2026, with the goal of supporting cross-border interoperability as national solutions emerge.
National Rules Are Moving Faster Than EU Harmonization
While the Commission has provided a unified technical architecture, the underlying policy landscape across Europe is highly fractured. Driven by concerns over addictive algorithms, infinite scrolling, and harmful content, individual Member States are moving ahead with national restrictions rather than waiting for a single EU-wide legislative solution.
France has adopted an under 15 social media ban, while Greece has announced plans for a similar restriction and Austria has proposed limiting access for children under 14. Ireland has also said it is working with other Member States on possible age-based social media restrictions. These initiatives are not all at the same legislative stage, but together they point to growing pressure on providers to operationalize age checks across multiple jurisdictions.
This creates a complex enforcement dynamic for platforms. The EU DSA gives the European Commission central supervisory authority over Very Large Online Platforms (“VLOPs”) for DSA purposes, but Member States are continuing to pursue national child safety measures that can shape how providers assess risk and design access controls in practice. The result is a growing mismatch between a more centralized EU enforcement framework and increasingly varied national policy approaches.
Industry groups, including DOT Europe, counts Meta, Snap, and TikTok among its members, have criticized the emerging patchwork of rules, arguing that divergent national restrictions risk legal fragmentation, inconsistent user experiences across Member States, and heavy compliance burdens for cross-border platforms. Critics also warn that divergent national rules may be easier for minors to work around. Civil society advocates, meanwhile, have argued that regulators should focus less on blanket access bans and more on limiting harmful platform practices and high-risk product features for younger users.
What Providers Should Do Now
For now, platforms in the EU face evolving compliance expectations. The EU DSA requires online platforms accessible to minors to adopt appropriate and proportionate measures to ensure a high level of privacy, safety, and security for minors. In its guidance, the Commission has said age verification is appropriate for adult content such as pornography and gambling, but the corresponding obligations for social media and other services remain far less explicit.
Online providers should closely monitor the EU expert panel on child protection, which is slated to deliver its policy recommendations by the summer of 2026. These recommendations could eventually lead to a harmonized EU-wide age limit, though formal legislation would take years to negotiate.
In the immediate term, companies should prepare for increased regulatory scrutiny by assessing their existing age assurance methods against the Commission’s privacy and reliability expectations, track fast moving national proposals, and plan for possible interoperability with wallet-based or state-backed verification tools. Enforcement pressure from both national governments and the EU Commission will only intensify.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
