Seriously, it is as if there would be a CVE because sudo allows privilege escalation.
Of course such widely spread tools should be audited and have eyes on them. On the other hand many people are tired of security strategies because half of the time it is about a platform doing it for market domination. Our thoroughly shitty mobile OS come to mind. This age verification crap isn't too different, just slightly different goals where real security isn't really considered too much.
Even if the app is bulletproof, age verification will get bypassed. Account sharing, file sharing, darknets, etc... It mostly prevents kids from stumbling upon content that isn't meant for them, but it won't resist deliberate attacks for long, especially if the parents are complacent. And for that, the EU Age Verification app looks fine, especially now what the easy bugs are fixed.
What the tech giants want is OS level attestation. They want to control what you can install on your device, to me the thing to avoid at all costs. This is not it, this is an open source app that you can run anywhere.
The proposed solution is the closest you can get to one that is designed to protect kids more than to control online activities. The weakness of the system, where a determined kid can get through is a feature, not a bug! More than that and it becomes more about control and less about kids (who will get through no matter what).
I am not commenting on how necessary age verification is. Personally, I am all for a wide open internet but many people actually want to "protect the children". The argument wouldn't be used as a justification for surveillance laws if they didn't.
The service for EU age verification app requires Google Play Integrity API check. So as much as you "can" run the app itself anywhere, you are forced to do it on whitelisted build of an OS on a whitelisted device.
Start here: https://news.ycombinator.com/item?id=47361235
And here's from the larger organisation, from another angle: https://techoversight.org/2025/07/29/bloomberg-meta-google-l...
Kids are parents kids not some context-less socialist/bureaucracy/german invasive ideology creatures.
If you want to do inventory checking for all that future migrants generations do it like you do with actual humans and not via some outdated and hackable inferior piece of hardware.
Notice how the latest mandatory age verification in iPhones in the UK has been introduced: not as a possible, easy switch one, but the default on, requiring adults to potentially deanonymise themselves. I repear: it's not something the parent could enable/lock in within a 10 seconds, it's something enabled with every adult's phone, something the kid will evade in the same way they buy tobacco or alcohol right now.
That was never about the kids. Otherwise the governments wouldn't tolerate Meta openly admitting they've been knowingly hooking up kids, knowingly worsening their mental health, or Musk's X keeping CSAM generator open while all the world's governments just grimaced and kept legitimizing it.