EU age verification app: the blueprint explained

The EU age verification blueprint is a technical design for an app that proves you are old enough for a service without revealing who you are. It is open source, free for Member States to adopt and meant to be compatible with the EU Digital Identity Wallet. As of October 2026 it is in the pilot and rollout phase: the Commission has called on Member States to make a national version available by 31 December 2026.

Why it exists

Platforms accessible to minors are expected to protect them. Article 28 of the Digital Services Act (DSA) requires “appropriate and proportionate” measures for a high level of privacy, safety and security of minors. In July 2025 the Commission published guidelines under that article. They are non-binding but are used by the Commission as a benchmark, and they recommend age verification for high-risk services such as pornography and gambling, while other measures like age estimation may suffice elsewhere.

The practical problem is how to check age without building a giant database of identity documents. Uploading a passport to every site is a privacy risk and a gift to fraudsters. The blueprint is the Commission’s answer: a standard, privacy-preserving way to show only “over 18”.

How the blueprint works

According to the Commission’s fact page on the blueprint:

1. You install the app from a national provider or a pilot version.
2. You obtain a proof of age from an issuer. The routes include a national eID, a passport or identity card, a banking app, or an offline activation through a third party.
3. The app stores an attestation on your phone, for example “over 18”.
4. A website or app requests proof that you are over a given age. You see the request and approve it.
5. The service receives only the age statement. It does not receive your name, birth date or document details, and the Commission states that the link between user and proof provider is cut after verification.

The privacy design uses zero-knowledge techniques so that the platform and the issuer cannot easily correlate the proof with your identity. If you are curious about the building blocks, see our pages on verifiable credentials and the OpenID4VP presentation protocol.

How it differs from other age checks

Today most sites rely on one of three methods. Self-declaration, such as ticking a box, is easy to bypass. Age estimation analyses a face image and gives a probability, not a certainty. Document upload or card checks give certainty but expose a lot of personal data. The blueprint aims for the certainty of a document check with the data exposure of a tick box: the service learns one fact, and the evidence stays with an issuer you chose.

Timeline

• July 2025: the first blueprint version is released as an open-source toolbox and pilots start.
• October 2025: a second version adds support for proof of age based on passports and identity cards.
• April 2026: the Commission declares the app technically ready and adopts a recommendation on a common EU age verification framework. It asks Member States to deploy the solution, standalone or integrated in national wallets, by 31 December 2026 (Recommendation (EU) 2026/1035).

Who is piloting

Pilot projects are running in Cyprus, Denmark, France, Greece, Ireland, Italy and Spain. Denmark, France, Greece, Italy and Spain have been the most vocal in pushing for a common digital age at European level, and several of them plan to build the solution into their national digital identity wallets or to publish a national age verification app. Check your own country’s page in the country section or the EUDI Wallet timeline for current news. Rollout dates and features differ, and as of October 2026 not every pilot country offers a public app.

How it relates to the EUDI Wallet

The age solution is deliberately close to the wallet. It uses attestations of the same kind, can run standalone or be embedded in a national wallet, and can use a digital driving licence or ID card as a source for the age claim (see mobile driving licence). A user who already has a wallet should be able to prove age from it. The broader privacy debate is in our guide to EUDI Wallet privacy.

Open questions and criticism

Age verification is contested, and a fair look should include the concerns:

• Scope creep. Critics worry that a tool built for adult content could become a requirement for general internet use. The legal duty today comes from the DSA and national laws, not from the app.
• Exclusion. People without a smartphone, a compatible ID or a bank app need another route. The blueprint includes an offline activation, but availability depends on national implementation.
• Reliability of the privacy claims. The design aims at unlinkability, but real-world privacy also depends on how issuers, wallets and platforms implement it, and on whether proofs can be tracked through device or network data.
• Circumvention. Any proof of age can be lent or sold. The blueprint adds device binding and checks but cannot prevent every misuse.

What to do as a user or a platform

If you are a parent or a user, wait for your national version and use only the official one from your government or a verified store listing. Be wary of fake “EU age verification” apps. If you run a platform, read the DSA guidelines for your risk level, check whether your Member State has published technical requirements and consider supporting the standard presentation protocols rather than collecting documents yourself.