EU Age Verification Project Mandates Hardware-Bound Attestation

Key Points:

• The EU’s open-source age-verification project mandates hardware-bound attestation, requiring credentials to be tied to specific secure hardware like Android TEE or Apple’s Secure Enclave, sparking concerns about compatibility with Linux, custom Android ROMs, and independently compiled apps.
• Critics argue this hardware dependency limits the system to a small set of approved devices, operating systems, and attestation providers, potentially undermining openness and broad accessibility.
• The project’s specification requires native cryptographic hardware use but does not universally mandate stricter integrity checks, leaving uncertainty about how restrictive real-world deployments will be.
• Proof of Age credentials can only be issued to apps on a European Commission-maintained compliant list, meaning open-source availability does not guarantee access for community-built versions.
• While Linux is not explicitly excluded, the lack of a native Linux wallet and stringent trust conditions pose challenges for alternative operating systems, raising questions about the project’s ability to remain truly open and inclusive.