EUROPEAN UNION — The European Commission released a free, open source age verification app for social networks and pornography websites on Wednesday under the EU Digital Services Act. The app is available for any company to use and will let EU member states decide whether to integrate it into national digital wallets or develop independent apps.

"One of the central issues is the question, how can we ensure a technical solution for age verification that is valid throughout Europe? Today, I can announce that we have the answer," said Ursula von der Leyen, president of the European Commission, at a press conference Wednesday. "There are no more excuses" for platforms that fail to check users' ages, she said.

The app is compatible with passports or ID cards, works on smartphones, tablets and PCs, and is built to be anonymous for users. It does not store personal data such as names, dates of birth or ID numbers, only a confirmation of age, according to the European Commission. Users download the app, agree to terms, set up a PIN or biometric access, and verify their age via an electronic identification system or by presenting a passport or ID card with biometric verification. When accessing age-protected content from a computer, users scan a QR code; on smartphones, the app sends proof of age directly without platforms accessing users' original documents.

The Digital Services Act, effective in 2024, requires online platforms with more than 45 million monthly users in the European Union to mitigate systemic child protection risks and imposes heavy penalties for noncompliance. European institutions plan to take action against Facebook, Instagram, Snapchat and four pornography sites following an investigation into TikTok, said Henna Virkkunen, executive vice president of the European Commission. "And that's why Europe has the DSA: to call online platforms to their responsibilities," Virkkunen said.

Security researchers identified vulnerabilities in the app shortly after its release. The app stores a user-created PIN in a manner that could allow an attacker to take over a user's app profile. Security consultant Paul Moore claimed on X that he exploited the vulnerabilities to hack the app in less than two minutes. "This product will be the catalyst for an enormous breach at some point. It's just a matter of time," Moore said.

Several online platforms have experimented with age verification measures, including AI-powered age estimation systems. "Understanding the age of people online is an industry-wide challenge," Instagram wrote in a blog post last year. "We'll continue our efforts to help ensure teens are placed in age-appropriate online experiences, like Teen Accounts, but the most effective way to understand age is by obtaining parental approval and verifying age on the app store," Instagram wrote.

Critics have raised privacy concerns about age verification requirements. "Why would we, then, in the name of protecting people, create a whole other legal mandate that requires the collection and storage of even more personally identifying information that would be subject to either data thieves or data breaches?" said Aaron Mackey, deputy legal director of the Electronic Frontier Foundation.