Observatory · EU Age Verification
The EU's age verification apps, country by country
Seven Member States are rolling out the EU Age Verification Blueprint, each in their own way: dedicated apps, national wallets, different timelines and different technical profiles. This inventory tracks what is actually live, what is piloting, and how they differ.
Last updated: October 2026 · Sources linked in every entry · Trusted Lists verified against the official XML
The common framework: the Commission's Blueprint
The EU Age Verification Blueprint is the European Commission's reference solution for proving "over 18" online without revealing anything else: an mDoc credential (ISO/IEC 18013-5, docType eu.europa.ec.av.1) issued by providers registered on a European Trusted List and presented via the W3C Digital Credentials API or OpenID4VP. It is developed by the T-Scy consortium (Scytáles + T-Systems) under a Commission contract, as a bridge until the EUDI Wallets arrive.
Each Member State decides how to deploy it — as a dedicated national app or integrated into its state wallet, with its own issuers and its own timeline. Hence the fragmentation this page documents.
- 14 Jul 2025Blueprint v1, published the same day as the DSA Article 28 guidelines. Five front-runners: Denmark, France, Greece, Italy and Spain.
- 10 Oct 2025Blueprint v2: passport/ID-card onboarding and presentation via the Digital Credentials API. Cyprus joins the pilot; Ireland shortly after.
- Jan 2026The white-label apps add Zero-Knowledge Proof support (longfellow-zk scheme; Android release 2026.01-1), still experimental.
- 15 Apr 2026The Commission declares the solution "technically ready".
- 29 Apr 2026Recommendation C(2026) 4225: an EU Age Verification Scheme with lists of trusted providers and solutions, and a target of at least one compliant solution per Member State by 31 December 2026.
- 13 Jul 2026The Commission's Special Panel on Child Safety Online delivers its final report: no independent access to social media under 13, and the burden of proving a service is safe placed on the platforms.
- Jul 2026Active reference-app releases (Android 2026.07-1, iOS 2026.7.1). Verified against the official XML: the production Trusted List (seq. 4, issued May 2026) holds a single entry — Denmark; the acceptance list holds test issuers from IE, ES, IT, FR, DK and AT, plus the blueprint's reference issuer (registered under Iceland).
- 31 Jul 2026espuni verifies a real Zero-Knowledge proof from the reference AV app end to end (DC API / ISO 18013-7): the app presents a genuine Proof-of-Age credential (issuer 'Age Verification Reference Implementation') and our independent verifier accepts it in ~317 ms. The reference ecosystem also verifies ZK via its DC API backend (built on Multipaz); espuni's angle is a managed relying-party layer.
- 26 Aug 2026Acceptance AV Trusted List seq. 18 (official XML): a second Austrian test issuer appears — the Federal Chancellery's "T-Environment", recognized since 30 Jul 2026. The production list is unchanged: seq. 4, a single entry (Denmark), next update due Nov 2026.
- 17 Sep 2026The Commission proposes the EU KIDS Act (COM(2026) 681), announced the day before in the State of the Union: no accounts under 13, supervised accounts at 13–14, an autonomous account from 15. Platforms would have to check age with methods on a Commission-approved list — the EU age verification app among them — and self-declaration would no longer count. It is a proposal: Parliament and Council still have to adopt it (consultation open until 26 Nov 2026).
Comparison at a glance
| Country | Solution | Model | Status |
|---|
| 🇩🇰 Denmark | AltID | National identity wallet | Live |
| 🇬🇷 Greece | Kids Wallet + Gov.gr Wallet | Two state apps | Live (partial) |
| 🇫🇷 France | France Identité (preuve d'âge) | State eID app | Pilot |
| 🇮🇪 Ireland | Government Digital Wallet | Government wallet (MyGovID) | Opt-in testing |
| 🇪🇸 Spain | Cartera Digital Beta | State app → Blueprint integration | Pending launch |
| 🇮🇹 Italy | State app (unnamed) / IT-Wallet | State app + IT-Wallet (IO app) | In development |
| 🇨🇾 Cyprus | Digital Citizen (Ψηφιακός Πολίτης) | Existing national app | Announced 2026 |
Country profiles
The first front-runner solution in production. AltID (Digitaliseringsstyrelsen, launched 3 June 2026, regulated by Act 301/2026) is a national identity wallet — the first step towards Denmark's eIDAS 2.0 wallet — shipping with two credentials: a digital ID and the "aldersbevis", an mDoc age proof with nine thresholds (13+ to 67+) that reveals no name, CPR number or exact age, usable both online and in person.
Issuer & enrolmentMitID + CPR number; available from age 13; optional photo via the passport's NFC chip. Issued by the "Bevisudstedelsesservice" (BUS) from the civil registry (CPR/Datafordeleren) — the single production entry on the European AV Trusted List, recognized since 3 Jun 2026 (verified against the official XML).
Regulatory driverA bill for a 15-year minimum age on social media (Facebook, Instagram, Snapchat, TikTok — with no parental opt-in for 13–14-year-olds) went to public consultation on 7 Sep 2026; it is due to be tabled in early 2027 and take effect on 1 Jul 2027. It does not prescribe the verification method. Background: Denmark's Council presidency leadership (Jutland Declaration, Oct 2025).
Technical notesISO 18013-5 mDoc with selective disclosure; batches of 30 single-use credentials, auto-replenished; OID4VCI issuance per HAIP with wallet attestation (WUA/WIA/WKA) and hardware-bound keys. Online presentation via OpenID4VP per the Commission's Age Verification Profile (+ HAIP §5/6) — no DC API and no ZKP at launch; a proprietary signed-QR protocol for offline scenarios (ISO 18013-5 proximity deemed immature). Verifying the aldersbevis requires no RP registration; the identity credential does (OCES certificate). Extra anti-linkability: the issuance date is always set 30 days before expiry so the birthday is never revealed.
Greece splits age verification across two pieces: Kids Wallet (May 2025) — parental controls and minors' age assurance with an age API under parental consent — and Gov.gr Wallet for adults, the intended Blueprint integration point. Since March 2026 the country runs its first live age verification: tobacco, alcohol and vaping sales with a green/red indicator per age group, revealing neither identity nor exact age.
Issuer & enrolmentParent authenticates with Taxisnet; the child's profile is validated against the civil registry.
Regulatory driverBill presented on 12 Oct 2026: minimum social media age of 15 from 1 Jan 2027, fines up to 6% of global turnover. It is method-neutral but names Kids Wallet and Gov.gr Wallet as suitable tools, sending only an above/below-threshold signal. Not yet passed by Parliament. No ARCOM/AGCOM-style adult-content mandate detected.
Technical notesKids Wallet predates the Blueprint and was built nationally; the European approach is slated for Gov.gr Wallet. Exact technical relationship with the white-label: not publicly documented.
France is not publishing a dedicated AV app: the age proof is integrated into France Identité, the state identity app based on the electronic ID card (CNIe) read over NFC. Since February 2026 it has been trialling threshold age proofs (15+, 18+, 21+) via QR under ARCOM's double-anonymity model; as of October 2026 it is still a beta feature, with no general-availability announcement. Meanwhile the actual French AV market is served by commercial providers (Yoti, VerifyMy, AgeVerif…).
Issuer & enrolmentFrance Identité / CNIe (NFC). App in production on Google Play and the App Store since 2023-24.
Regulatory driverThe SREN law (May 2024) + ARCOM's technical référentiel (Oct 2024): double anonymity mandatory for adult sites since April 2025, with real enforcement — Aylo (Pornhub) pulled out of France in Jun 2025. The under-15 social media ban adopted on 21 Jul 2026 was struck down by the Conseil constitutionnel (decision 2026-911 DC, 14 Aug 2026) as disproportionate, and the law was promulgated without it; a narrower text (risky features only, parental authorisation from 13) was notified to the Commission on 14 Sep 2026 (TRIS 2026/0500/FR).
Technical notesThe technical profile diverges from the Blueprint: OpenID4VP profiled per ISO 18013-7:2024 Annex B (not Annex A's DCQL + av:// profile) and a DC API surface documented in its playground for third-party verifiers (Animo, Docaposte, IN Groupe, Ver.iD…). France Titres (ANTS) has held a "France Identité" test issuer on the acceptance AV Trusted List since Jan 2026 (official XML).
Ireland integrates age verification into its Government Digital Wallet, built on MyGovID. In April 2026 it opened a public consultation and opt-in testing (people aged 16+ can download the app with limited functions); in July testing was widened to up to 10,000 participants, with an introduction targeted for the end of 2026. As of October 2026 no open beta has been confirmed. There is no dedicated AV app and no general-public availability.
Issuer & enrolmentMyGovID (existing state identity infrastructure).
Regulatory driverCoimisiún na Meán's Online Safety Code: Part B (in force since Jul 2025) requires effective age assurance from video platforms carrying adult content, with fines up to €20M or 10% of turnover; on 8 Sep 2026 the regulator opened its first formal investigation under the Code, into X's age assurance and parental controls. Ireland holds the EU Council presidency (Jul–Dec 2026) and is pushing for an EU-level digital age of majority.
Technical notesTimeline tied to the EUDI Wallet obligation (public-body acceptance by end-2026). Technical profile of the AV module: unpublished. The OGCIO has held a test issuer on the acceptance AV Trusted List since Oct 2025 — the oldest entry on the list (official XML).
Spain's solution (announced in July 2024 — a year before the Blueprint) finished technical development, including a National Security Scheme audit and CCN security verification, but its launch was parked to converge with the European solution, integrating it into the Cartera Digital. Not to be confused with miDNI (National Police, Apr 2026): in-person identification with a "DNI Edad" mode, not the online AV solution.
Issuer & enrolmentThe AEAD (State Agency for Digital Administration) as the first credential issuer; enrolment via DNIe, qualified certificate or Cl@ve. Original 2024 design: batches of 30 anonymous credentials, in sets of 3 per provider, valid one month.
Regulatory driverOrganic Law bill on the protection of minors in digital environments (121/000052): still not approved — in Oct 2026 it is at the drafting-subcommittee stage in Congress's Justice Committee, with a PSOE–Sumar amendment barring under-16s from social networks with harmful content. CNMC + AEPD supervise video platforms. In Sep 2026 Spain and the Netherlands co-signed a paper backing an EU-wide minimum age.
Technical notesThe 2024 design (QR + anonymous batches) anticipated Blueprint patterns (batch issuance). The final product's flows (QR / DC API) are unpublished; no app store listing as of October 2026. Verifiable progress: the AEAD has held a test issuer on the acceptance AV Trusted List since Dec 2025 (official XML).
Italy has the group's most aggressive regulatory regime — and still no published state app. AGCOM's Delibera 96/25/CONS mandates double anonymity through certified third parties and per-session identification + authentication; it has applied since Nov 2025 (sites in Italy and outside the EU) and Feb 2026 (rest of the EU), with a list of ~48 obligated sites, fines up to €250,000 and the first DNS blocks executed in March 2026. The state app (Department for Digital Transformation + PagoPA + Poligrafico: anonymous token, open source, integrable into IT-Wallet) remains in development with no official name.
Issuer & enrolmentCertified third parties that identify users via SPID, CIE or an electronic passport (SPID/CIE alone are not compliant: they are identity sources, not the AV mechanism). In real use today: commercial providers such as Yoti (OnlyFans, Chaturbate).
Regulatory driverArt. 13-bis of the Caivano Decree (Law 159/2023) + AGCOM Delibera 96/25/CONS. Judicial back-and-forth: the TAR Lazio (Apr 2026) partially annulled its application to sites in other Member States on procedural grounds (Directive 2000/31), but the CJEU (C-188/24 and C-190/24, 16 Jun 2026) upheld that a Member State may impose AV on providers from other Member States subject to conditions.
Technical notesPer-session anonymous-token model, no facial estimation. AGCOM has said the public option will ship inside the IO app (IT-Wallet), but as of October 2026 no launch is confirmed and which Blueprint flows it will support is unpublished; since Aug 2026 PagoPA is owned by the Poligrafico (51%) and Poste (49%). The Poligrafico has held a test issuer ("Italian POC Age Verification") on the acceptance AV Trusted List since Dec 2025 (official XML).
Cyprus joined the pilot in October 2025 and will not build a new app: the Blueprint's AV module will be integrated into Digital Citizen, the national app in production since December 2024 (~135,000 users as of Feb 2026) which already carries a digital ID and driving licence. The module was announced "within 2026"; as of mid-September 2026 it was still described as planned, as a yes/no check against the population registry.
Issuer & enrolmentCY Login (national e-gov identity; its exact role as the AV module's issuer is partially unconfirmed). Minors: enrolment at Citizen Service Centres (KEP) or an online interview with a parent present.
Regulatory driverPresident Christodoulides announced (Apr 2026) a minimum social media age of 15, with verification via Digital Citizen. The bill goes to Parliament in December 2026 (Deputy Ministry of Research, Sep 2026); platforms will get a few months to adapt and must re-verify existing users.
Technical notesWhite-label integration into an existing app — the group's purest case of "Blueprint inside a national wallet". Technical profile: unpublished.
The rest of the Member States
Outside the front-runner group the picture is one of divergence: each country is choosing between the European app, its national wallet, or waiting. The Jutland Declaration (Oct 2025, signed by 25 of 27 Member States) and the European Parliament's resolution (Nov 2025, a "digital majority age" of 16) set the political direction; the Commission's KIDS Act proposal (Sep 2026, an autonomous account from 15) would turn it into a single EU rule if adopted.
- 🇩🇪 GermanyWill not deploy the European app: age proof will live in the national EUDI-Wallet, whose launch is planned for 2 Jan 2027 — just past the Commission's end-2026 target. The Digital Identities Act (DIdG) is in parliamentary processing.
- 🇳🇱 NetherlandsBacks an EU-wide minimum social media age (its position: 15) in a joint paper with Spain (Sep 2026); building its own NL ID-wallet and has not committed to the European app.
- 🇧🇪 BelgiumOne of only two Member States that did not sign the Jutland Declaration. Nothing in force: Flanders drafted a decree setting 13 for harmful social media, and a federal under-15 plan (via itsme or MyGov.be) has not passed its first reading.
- 🇵🇹 PortugalBill approved in principle by Parliament (Feb 2026): minimum age 16, ages 13–15 only with parental consent via Chave Móvel Digital showing only the age. Final vote still pending as of October 2026.
- 🇵🇱 PolandGovernment plan to ban under-15s from social media (still a proposal) and a draft law making age verification mandatory for pornographic content (cabinet-approved Jun 2026, in Sejm committee since Jul; methods include banks, telcos and the mObywatel wallet).
- 🇸🇪 SwedenA government inquiry (Jun 2026) recommended a minimum social media age of 15 with platform age checks, from 1 January 2028; no government bill yet.
- 🇦🇹 Austria & FinlandAustria: draft law banning social media under 14 in consultation since Jul 2026, with mandatory "double-blind" age verification from 2027 (ID Austria one option) and age-18 checks for porn sites planned from Jan 2027; two Austrian test issuers already sit on the acceptance AV Trusted List (A-SIT, May 2026; Federal Chancellery, Jul 2026). Finland: considering an under-15 limit; no AV solution announced.
One integration, every app
Seven countries, seven timelines and at least three distinct technical profiles — and this is just the beginning. espuni absorbs that heterogeneity behind a single API: integrate age verification once and we maintain compatibility with each national app as it ships, including the transition to the EUDI Wallet.
Inventory compiled from official sources and specialised press, linked in every entry; claims we could not verify against a primary source are flagged as such. This content is informational and does not constitute legal advice. Spot something outdated? Write to hello@espuni.com.