The European Commission recently declared its new age verification app 'technically ready' for deployment, enabling users to prove they are over a certain age when accessing online platforms without necessarily sharing full personal details. Framed as a child protection measure to combat harmful, illegal, or 'hateful' content, the tool builds directly on government-issued IDs and is designed to integrate with the forthcoming EU Digital Identity (EUDI) Wallets mandated under the eIDAS 2.0 regulation. Member states must offer these wallets by the end of 2026, allowing citizens to authenticate across public and private services, including very large online platforms under the Digital Services Act (DSA).

While EU officials emphasize voluntariness and data minimization features like Zero-Knowledge Proofs, civil society groups raise alarms about scope creep, exclusion, and surveillance. EDRi notes that many privacy safeguards in the architecture are optional rather than mandatory, warning that reliance on digital identities tied to national IDs risks constant tracking, a chilling effect on free expression, and digital exclusion for those without smartphones or official documents. They connect the app explicitly to eIDAS 2.0, which they argue lacks essential protections against online surveillance.

The Electronic Frontier Foundation (EFF) similarly criticizes the push, arguing that age verification under DSA Article 28 and GDPR provisions creates de facto mandates. Platforms seeking compliance have few alternatives, potentially undermining anonymity for adults and minors alike. EFF highlights mission creep risks, linking it to broader EU proposals on content scanning that could extend identity requirements into messaging and app ecosystems. This builds on infrastructure accelerated during COVID-19, where digital vaccination certificates normalized app-based attribute verification across borders — now repurposed for general online access controls.

Viewed through a heterodox lens, these initiatives represent more than incremental safety measures. They form a cohesive stack: DSA's war on 'dangerous trolling' and disfavored speech, eIDAS wallets for persistent digital identities, and age/ID gates as the on-ramp. What begins as 'prove you're over 18 to post or browse' evolves easily into attribute-based access — linking behavioral data, 'trust scores,' or compliance histories to internet privileges. Privacy advocates missed the deeper connection: this mirrors foundational elements of social credit architectures, where centralized digital profiles determine participation rights. Reuters fact-checks have debunked claims of outright mandatory digital ID for all citizens, yet the combination of regulatory pressure, platform obligations, and technical interoperability suggests a trajectory where opting out becomes impractical for full societal participation.

Connections often overlooked include alignment with the EU AI Act for automated content moderation and potential future ties to digital payment systems, creating a closed loop of identified, scored, and gated online life. Far from mere age checks, this infrastructure risks transforming the open internet into a permissioned network where anonymity is a relic and 'safeguarding society' justifies granular social control.