EU’s Open-Source Age Checks Tie Identity to Hardware, Sparking Open-Source Debate
The EU’s open-source age-verification project now mandates hardware-bound attestation, requiring credentials to be tied to protected hardware (like Android TEE/StrongBox or Secure Enclave) to prove age without revealing personal data. Critics warn this dependence on specific devices, operating systems, and attestation providers could undermine open systems, even though Linux isn’t explicitly banned. Stricter checks may remain optional for deployers, and credentials are issued only to apps on a Commission-maintained list, which could limit community-driven implementations. A forthcoming security review and threat model are expected to explain the trade-offs and whether alternative trust models could still comply.