EU age-verification rules under the Digital Services Act create foundational elements for digital identity wallets and cross-border data sharing.

The primary source details three core issues: DSA fallback permitting non-private KYC providers that scan passports and perform liveness checks, attestation lock-in controlled by Google and Apple, and cryptographic weaknesses in the reference implementation where unlinkability relies on wallet behavior rather than mathematics (Bednar, https://juraj.bednar.io/en/blog-en/2026/04/17/eu-age-control-the-trojan-horse-for-digital-ids/). Repository edits on 12 May 2025 and 31 July 2025 reframed the app as a "white-label reference" for member states while removing prior production disclaimers. Coverage in Politico and Euractiv framed the rules narrowly as child protection and omitted the optional nature of privacy features (Politico, 2025).

The high-assurance path scans NFC passports to extract signed JPEG photos for local matching, yet the official trusted list contained zero production apps as of the source date; this aligns with eIDAS 2.0 wallet architecture requiring national electronic ID integration (European Commission, https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity-wallet_en). KYC providers have avoided cryptographic eID routes due to integration costs across 27 jurisdictions, favoring bitmap-based methods.

European Digital Rights reports document similar incremental expansions from voluntary pilots to mandatory systems in prior digital identity frameworks, a pattern replicated here where age attestation functions as entry infrastructure for broader credential use (EDRi, https://edri.org/wp-content/uploads/2023/06/EDRi-position-on-European-Digital-Identity-Wallets.pdf). Relay attacks and implementation variances by member states were underreported in initial coverage.