To Enforce Its Proposed Social Media Ban for 450 Million Pre-Teens, EU Builds an Open Source App (reuters.com) 43
The European Commission "proposed on Thursday banning children under 13 from social media, with parent-supervised accounts until 15," reports Reuters.
"Enforcement would rely on a tool Brussels built itself" — a free, open-source age verification smartphone app "that tells a platform whether a user meets an age threshold without revealing their identity..." If passed, the proposed Kids Act would create the world's largest social media access restriction, covering 450 million people across 27 countries... [The EU-built age-verification app] is being rolled out through member states, with seven pilot countries: Cyprus, Denmark, France, Greece, Ireland, Italy and Spain. The Commission expects EU-wide availability by the end of 2026.
It will also be used to prove users are over 18 when accessing adult sites, a restriction already implemented under the Digital Services Act...
[T]he system itself is decentralised. Member states run it through issuers they designate, and the proofs live on the user's phone. There is no central EU database of ages or of who verified whom... A user proves their age once to a nationally designated issuer — a body vetted by the member state, which can be a digital ID provider, a bank or a post office. At a restricted site, the app certifies that the user is above the required age threshold. The platform receives only a yes-or-no response. Issuance and verification are handled by separate entities. The proof provider is not told which service the proof was used for. Each proof works only once, preventing cross-service tracking. No identity documents or biometric data are retained. The code is open-source, allowing independent scrutiny.
The significance of the EU approach is that it provides a common age-verification mechanism rather than leaving individual platforms to develop and enforce their own systems. "Online platforms can easily rely on our age verification app. So there are no more excuses," [EU Commission President Ursula] von der Leyen said...
The proposal must be approved by EU member states and the European Parliament before becoming law.
Non-compliance would risk fines of up to 6% of a tech company's global annual sales, plus supervisory fees, Reuters reported earlier. The EU's plan follows similar initiatives in Australia, Britain, China, India, Turkey and several European Union countries.
"Enforcement would rely on a tool Brussels built itself" — a free, open-source age verification smartphone app "that tells a platform whether a user meets an age threshold without revealing their identity..." If passed, the proposed Kids Act would create the world's largest social media access restriction, covering 450 million people across 27 countries... [The EU-built age-verification app] is being rolled out through member states, with seven pilot countries: Cyprus, Denmark, France, Greece, Ireland, Italy and Spain. The Commission expects EU-wide availability by the end of 2026.
It will also be used to prove users are over 18 when accessing adult sites, a restriction already implemented under the Digital Services Act...
[T]he system itself is decentralised. Member states run it through issuers they designate, and the proofs live on the user's phone. There is no central EU database of ages or of who verified whom... A user proves their age once to a nationally designated issuer — a body vetted by the member state, which can be a digital ID provider, a bank or a post office. At a restricted site, the app certifies that the user is above the required age threshold. The platform receives only a yes-or-no response. Issuance and verification are handled by separate entities. The proof provider is not told which service the proof was used for. Each proof works only once, preventing cross-service tracking. No identity documents or biometric data are retained. The code is open-source, allowing independent scrutiny.
The significance of the EU approach is that it provides a common age-verification mechanism rather than leaving individual platforms to develop and enforce their own systems. "Online platforms can easily rely on our age verification app. So there are no more excuses," [EU Commission President Ursula] von der Leyen said...
The proposal must be approved by EU member states and the European Parliament before becoming law.
Non-compliance would risk fines of up to 6% of a tech company's global annual sales, plus supervisory fees, Reuters reported earlier. The EU's plan follows similar initiatives in Australia, Britain, China, India, Turkey and several European Union countries.
Well .... (Score:1)
...surely if we can ban metal tubes with things that go boom inside them, then we can ban pre-teens from using social media, yes?
We've never let the impossible stop us before!
Re: Well .... (Score:4, Insightful)
Failure to achieve perfect compliance is not actually failure. I think anyone with a few braincells knows that a law is not perfect and will not stop every instance of a behavior.
Have they heard of a PC? (Score:2)
Re:Have they heard of a PC? (Score:4, Insightful)
The same way your online banking website runs on your PC but verifies your login via an app. App based digital handshakes are a thing, not just for 2FA, but for all sorts of certifications.
Remember you're using a service, the service is responsible for implementing it. I suspect social media sites being social media sites will simply get users to use the app on their phone once or handshake via a QR code.
Re: (Score:3)
The same way your online banking website runs on your PC but verifies your login via an app.
Does it? I regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them. Perhaps it is different in other countries. I sometimes have to receive an access code sent to my phone (an old feature phone) via SMS, but that's it. I also have a gadget which a couple of the banks sent me where I install my debit card, enter the PIN and then it gives me a one-time code, but I haven't needed to use that for some time.
My 80 year old mother-in-law liv
Re: (Score:2)
It's standard here in Iceland. *Everything* verifies via the phone, using the same authorization mechanism (SIM-based wireless PKI). The service sends out a special-coded SMS, which gets intercepted and routed to a SIM that has cryptographic applet flashed into it, which triggers a system-level authorization popup for you to confirm (the popup displays a verification code which was included by the site, so you see the same code on both the site and your popup), and which you can then confirm (with your PI
Re: (Score:2)
Does it? I regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them.
You need 2FA since EU directive "PSD2" from 2015 (since then, the EU has updated to PSD3). It was implemented in the UK and requires "Strong customer identification" https://sprintlaw.co.uk/articl... [sprintlaw.co.uk] However, it is possible that the UK legal implementation imposed 2FA only for payment (money getting out of your account) and maybe not for consulting your balance.
Re: (Score:2)
>"regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them."
Topic shift, but.... I believe this is why so many companies have fought against TOTP. They want to FORCE you to use their proprietary "app" so they have full control over you. Walmart JUST DID THIS. I can no longer order online with Walmart because they stopped supporting 2FA with Email. I will not use their spy app, and I will not give them access to my phone number becaus
Re: (Score:2)
Does it? I regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them.
Congrats to you and your bank? I regularly access my bank from all sorts of web based devices and I log in with a QR handshake using a mobile app. Just because YOUR bank doesn't use a certain method doesn't mean the method doesn't exist.
My 80 year old mother-in-law lives in the EU and regularly accesses social media from her Windows PC. I don't think that she owns a smart phone either so she is going to be particularly irritated by this new imposition.
I've mixed feelings about your comment. On the one side we're starting to approach a society where access to services is increasingly required to be done via a smartphone / tablet device. Not doing so is an actual burden on users who have limited functionality (e.g. accessin
Re: (Score:1)
If you mean a desktop PC as opposed to a handheld PC, maybe it doesn't run. The summary suggests a phone is required.
I've been noticing this lately: a phone requirement. Twitter/x.com seems to have created this requirement in the last year (it won't let me log in unless I follow a qrcode using a phone; if you just decode the qrcode and follow the link in your usual browser, it refuses login).
For some reason, everyone is trying to force 100% phone adoption. There must be some vast extra attack surface on pho
Re: (Score:2)
"QR" code on screen (a RGB using code works better) mobile phone app sends confirmation with data from the code.
Goodbye (Score:2, Insightful)
"Member states run it through issuers they designate,"
Say goodbye to online anonymity then.
Re: (Score:2)
Re: (Score:3)
"Member states run it through issuers they designate,"
Say goodbye to online anonymity then.
Except not. The member state's issuers only issue the certificate of certification that doesn't leave your device. The rest of the online world gets a yes/no token. Such systems are implemented in many different ways by member states for other purposes already.
But hey you don't even need to trust anyone about this. The app that sits in the middle of it all is open source. Go read the code yourself.
Re: (Score:3, Informative)
Go read the code yourself.
Can I compile it myself, or install it on my GrapheneOS phone? No to both since each country makes its on version and those versions require device attestation.
Re: (Score:2)
Re: (Score:2)
Can I compile it myself, or install it on my GrapheneOS phone? No to both since each country makes its on version and those versions require device attestation.
The open source tool displays how the protocol functions and allows you to verify the only information sent to the service provider is a token. Given the services are not under the jurisdiction of any one provider you need to be of the belief that either it is just getting the yes/no token, or that they are in cahoots with each individual government separately implementing their secret privacy leaking info. And if you believe that I'm sure you have questions about the FBI's involvement in the trade centre c
Re:Goodbye (Score:5, Insightful)
Except not to you. You're confusing data minimization (the website doesn't get your name from the token) with unlinkability (nobody can connect your activity to your identity). The *token itself* doesn't reveal your identity, but it leaks data in a wide variety of ways.
Even if you browse via a proxy, if the authorization service gets a token directly from your phone, it has now correlated your phone with your proxy-browsed history. A very common means to do secure authentication these days is SIM-based wireless PKI, wheren it has now connected you to your phone number. To governments, it offers a broad range of brand new vectors to correlate you to an identity if you, say, mention you had an abortion or criticize your local strongman leader, since they control the backend infrastructure that establishes the connection between the token and the identity. And not just at signup time every real-world digital credential must be able to be revoked if the phone is lost or stolen, or credentials expire or are revoked. So how does how does the open-source app prove a credential is still valid without "phoning home"? If the app checks a revocation status list, then ISPs, CDNs, or state security services can correlate the exact millisecond of queries to the revocation server with the submission of a verification token to a platform - each time it's submitted. Assuming that they can't just get it with more direct means than timing attacks.
Also, you cannot just "read the code". The frontend is open source, but what is being done on the backend is not. You have no clue what logging polciies, database schemas, operational security, etc the "designated national issuers" or servers handling the credential revocation are using, and what government intrusion has been forced on them. I'd feel a more comfortable if it were all happening from Brussels but handing it over to individual states, some of which at any given point will be authoritarian, is just handing them an easy new vector to unmask people.
As for your "Such systems are implemented in many different ways by member states for other purposes already." - yes, for filing taxes, healthcare, online baking, etc - things that you intend to do and must do under your legal identity. Not for anonymous conversations on the internet. Your argument basically reverts to "But people already do things non-anoymously on the internet , which reinforces my point that yes, this taking something from the "anonymous" category and putting it into the "easily unmasked" category.
If you think this won't be abused, I cannot help you. Not even just abused from a criminal or extrajudicial perspective, but even from a civil one, because orders to unmask someone can be subpoenaed.
in our owners we trust (Score:2)
agreed very much, and valid points, except your faith in brussels is ... surprising? i'm guessing you're thinking about the likes of afd and rn, and there's some legitimate concern there. however ... is an opaque supranational institution ruled by a banking cartel any better? if they can't supress it (and they're trying hard) in no time they will own any "right wing menace" coming up anywhere just the same, so i don't think national political alternatives will mean much except some initial noise, new faces
Re: (Score:2)
it has now correlated your phone with your proxy-browsed history.
You're making wild assumptions into the implementation. There's no reason the authorisation service needs to have any information about your network condition. But since we're talking about an open source implementation the actual process can be verified, even if the direct application cannot.
To governments, it offers a broad range of brand new vectors to correlate you to an identity if you, say, mention you had an abortion or criticize your local strongman leader, since they control the backend infrastructure that establishes the connection between the token and the identity.
Yes I agree this system won't work well in shitholes like Russia, China, or the USA, but in the meantime we have actual evidence that the vast majority of European nations which do have privacy rules for citizens find
Re:Goodbye (Score:4, Insightful)
You visit an online liquor store. The store asks your mobile phone whether you are of sufficient age. Your mobile phone asks the issuer, gets a yes/no token, forwards it to the liquor store. No data was leaked.
In countries where the issuer is "the bank", then in any case both the liquor and the bank already knew everything (the online liquor store already knew your payment details, and your bank already knew you make purchases at the online liquor store).
Re: (Score:2)
Re: (Score:2)
A nation can obviously make it traceable if it wants, it can also make it untraceable if it wants.
The app can just check your physical ID with NFC offline, set a flag "yep, older than 15" and be done with it.
Not completely safe (Score:3)
>"The platform receives only a yes-or-no response. Issuance and verification are handled by separate entities. The proof provider is not told which service the proof was used for."
And yet you still have to trust that this system doesn't get back-doored by three-letter agencies. Because if they do, then, suddenly, they have WAY more power than before.... now able to track where EVERYONE goes. And that is down to the individual level with confidence, not just an IP address or guess.
This gives the "yes/no" entity the power to completely shut down any person's ability to do anything meaningful online if they are able to match a device to a certificate with other means, and directed to do so by the government or some other powerful organization.
And it gives this cabal the ability to shut all sites/services out of the market they don't "like." Requiring they all use this yes/no entity and then refusing participation. (Granted, they kinda already have the option of mucking with DNS and ISP's).
And how are open source projects going to be forced to use the system? And why should they? Perhaps you can get coverage by the major sites and devices, but it won't cover the freedom-loving projects nor the shady sites/projects who simply won't use the system. Minors will have full access there. And all it takes is recompiling an open-source browser, IM, VOIP client, whatever, to issue a bunch of vetted "adult" certificates from a nefarious collection of them online, and now you have full access. And you also set off a war between legit users and the "system" trying to blacklist compromised certificates/identities... which, meanwhile, RUINS the lives of those who had their certificates/identities "stolen."
I am certain there are other issues smarter people than me could find with this arrangement. It could be worse, for sure, but...
Why not stop this madness and focus on PARENTS? Firstly, not giving unrestricted devices to minors. Secondly, having PARENTS be in the driver's seat to control what sites/people/services are allowed for their children. Thirdly, supporting a voluntary age appropriate tag for sites/systems that can be used by local device whilelists by the parents. And fourthly, changing the social norms that it is not OK for minors to have unrestricted devices anywhere. Then adults are not impacted at all. And most of the burden falls on the actual responsible party, who should have intimate knowledge about what is or isn't appropriate at their children's developmental stage.
Re: (Score:3)
My kids have time limits on their smartphone and the tv. All they need is an "external impulse" that says stop. For the TV, it is a simple stopwatch. Very easy to manipu
Re: (Score:2)
Re: (Score:2)
>"I was expecting these types of comments. It is a typical programmer mindset. I have it myself. Sure it is a leaky solution, but when trying to push humanity in a direction, you need to look at it statistically. If it changes the behavior of more than 25% of the people, it is nice. 50% is great. 75% is astonishing,"
Oh, I know. I actually have to defend my position on empowering parents and making THEM responsible for THEIR children on the same basis. I get comments that kids could go to their neighbor
Re: (Score:2)
And yet you still have to trust that this system doesn't get back-doored by three-letter agencies.
The "three-letter agencies" discover no new information here. They ALREADY know your name, date of birth, browsing history, online purchase history.
This gives the "yes/no" entity the power to completely shut down any person's ability to do anything meaningful online
Nothing new. The entity is under the same regulatory framework as your bank or your ISP, which already can shutdown your abilities of doing things. It's just another, very limited channel where a bug or intentional action can restrict your abilities to buy liquor and dildos.
And it gives this cabal the ability to shut all sites/services out of the market they don't "like." Requiring they all use this yes/no entity and then refusing participation. (Granted, they kinda already have the option of mucking with DNS and ISP's).
Besides your acknowledgement that they already had the DNS option, the whole "can shot do
Re: (Score:2)
>"The European approach has always been, in any problem, to make the burden lie on the business side."
Or the government.
But, agreed. And the USA approach has always been (or at least used to be) to look towards the parents, family, and community, not the government or businesses. Which is why there will (hopefully) be more pushback here.
Re: (Score:2)
And yet you still have to trust that this system doesn't get back-doored by three-letter agencies.
Congratulations, you just described electronics. I hope you made this post via telegram and got someone to type it into a burner laptop from an internet cafe, otherwise you may be being watched by the boggieman.
Re: (Score:1)
Why not stop this madness and focus on PARENTS?
Why not indeed? I'm sure that Eurocrats and their supporters are widely known for their devotion to parents being in control, right?
Firstly, not giving unrestricted devices to minors.
Oh sure, society will support that. Why, let's take a poll right here on /., shall we? Bark phones for all!
Secondly, having PARENTS be in the driver's seat to control what sites/people/services are allowed for their children.
Fine with me. Actually fine with the people here who are complaining about this system? Not so much.
Well, you get the idea. Complainers are fine with blaming parents for everything. Letting parents have actual control over their own children though (which would be needed
Wife was fascinated with the exchange at home (Score:2)
(son's voice): Herr Fatherland?
(husband's voice): Ich bin gleich bei dir, mein Junge
Wife: "What's going on?"
Husband: He wants me to log in to an adult site
Wife: Oh.
Why not build a social media app? (Score:2)
Instead of a ban, why not have an open source, social media app that is certificate based and allows each geographic region to dictate policies for the app on their turf, with the app using GPS coordinates and maybe other authentication methods to reduce spoofing? Yes, it would have boundaries in place (keep 18+ who are not family away from those below 18+, have geographic regions fenced off from each other), but why not offer something.
Outright bans don't help. However, having alternatives that do the sa
Let us ban social apps (Score:1)
By... building a social app?!
Where is the logic here?
Winos as bypass - ? (Score:2)
The stupidity increases (Score:2)
Kids are smart and good at finding workarounds
Banning something makes it more desirable
It also trains kids to hate the government at an early age
Completely wrong approach (Score:2)
This is the wrong approach. Social media is just as dangerous for adults as it is for kids.
We need to ban the current social media business models for everyone. That means: No advertising allowed; only show content from people or groups you actually follow; show content strictly in descending chronological order; do not allow sponsored content; charge people to have an account (Facebook probably makes around $3-$5/month/user, so that's a good benchmark.)
Also: Any sort of age verification as described s
Re: (Score:2)
Drugs and booze are just as dangerous for adults as kids. We assume that for a subset of these, adults have the maturity and judgement to regulate their own use. Not always a valid assumption, but what else are we going to do? Go through another prohibition?
Re: (Score:2)
Drugs and booze typically are regulated, to some extent, even for adults.
And I'm not proposing completely banning social media. Just regulating it for everyone to make it less dangerous.
To use one of your analogies: We carefully regulate the purity and safety of over-the-counter drugs. We need to do the same for social media.
vanderLeyen is back and worse than ever (Score:2)
The forsaken Zensursula now gets to enforce EU-wide what she very prominently failed to do on germany-level, before she was failed upwards towards Brussels.
Truly one of the worst merkel gifts that just keeps on giving..
Hardly, we are 450 million TOTAL! (Score:2)
And I doubt that we are all pre-teens, I wish, I'm 70.