"Old Enough?" App Cracked in 2 Minutes — Now They Want Your Whole ID

The EU's big privacy promise lasted about as long as it took to make a cup of coffee. On April 15, 2026, European officials launched their new age-verification app — an open-source tool designed to let people prove they were old enough to access certain websites without handing over their identity. Within hours, a security researcher had broken it. The method? Editing a plain-text configuration file. It took under two minutes.

Before you scroll away thinking "that's a Europe problem," stick with this for a second. Because what happened here isn't really a story about one broken app. It's a story about a promise that age checks are making to everyone — and what it means when that promise cracks.

The Promise Was Simple. Maybe Too Simple.

The pitch for this kind of technology sounds genuinely good. You want to visit a website that has age-restricted content. Instead of handing over your driver's license or passport number, the app checks your documents on your own phone and sends back only one piece of information: "yes, old enough" or "no, not old enough." No name. No date of birth. No identity trail. Just a green light or a red one.

The EU was so proud of this approach they made the whole thing open-source — meaning anyone in the world could read the code and look for problems. They framed this as a feature. Transparency builds trust, the thinking went.

Here's what happened instead. Transparency let a researcher find the problems extremely fast.

The first bypass — the two-minute one — came from something almost embarrassingly basic. The app stored a critical setting in a file that wasn't encrypted or protected in any meaningful way. Change one value in that file, and the age check would report back a passing result regardless of what the user's actual documents showed. No hacking skills required. No special tools. Just knowing where to look.

That letter, signed by over 400 researchers and sent before the official launch, asked the Commission to slow down. They launched anyway. Weeks later, the bypass was public. It wasn't the researchers' finest "we told you so" moment — it was just a quiet, uncomfortable confirmation that the warning had been correct. This article is part of a series — start with Your Kids School Is Scanning Their Face No Law Says It Can.

The Hack Was Bad. The Fix Might Be Worse.

Here's where things get genuinely concerning — and this is the part that keeps security experts up at night.

The technical flaw in the app isn't just a bad setting that engineers can patch. It runs deeper than that. According to TechRadar's reporting, the app's verification component has no way to confirm that passport verification actually happened on the user's device. It has to take the device's word for it. And if you can't trust the device, you can't trust the result.

So what's the real fix? Technically, you'd need to send proof from the passport scan back to a central server — a server that could actually verify the check happened. But the moment you do that, you've broken the whole privacy promise. A central server that receives cryptographic data (think of it as a coded fingerprint) from your passport is, functionally, a database that knows your passport was checked. That's an identity trail. The very thing this system was built to avoid.

"The second you strip the identity away from how old somebody is, a person can't answer that question." — Security expert, as reported by TechRadar

Read that quote again slowly. It's saying that truly anonymous age verification might be, at a fundamental level, technically impossible. To know whether someone is old enough, you have to know something about who they are. The moment you try to protect identity completely, the age check becomes untrustworthy. The moment you make it trustworthy, the identity protection weakens.

That's not a bug. That's the whole dilemma, baked into the design.

The Ratchet: How a Failed Promise Becomes a Surveillance Tool

This is the part that a security expert described as a predictable regulatory pattern — and it's worth paying attention to. The sequence goes something like this.

First, introduce a system marketed as privacy-friendly. Second, watch it fail (or get bypassed) repeatedly. Third, use each failure as justification to tighten controls. End result: what started as "just prove your age" becomes "prove who you are, completely." A system sold as protecting privacy quietly becomes the opposite. Previously in this series: Your Kids Fitness Tracker Is Quietly Building A File Coaches.

"The next step will be proving who you are." — Security expert quoted in TechRadar's investigation, describing the likely regulatory escalation after repeated app failures

One expert put it more bluntly, describing the likely outcome as "a surveillance tool sold as privacy-respecting." That's a strong phrase. But look at the logic and it's hard to argue with it.

And this EU app doesn't exist in isolation. It's connected to something called the EUDI — the European Digital Identity Wallet (think of it as a government-backed digital ID card that lives on your phone and covers everything from your passport to your driving license). Age verification was supposed to be one small, safe feature of that larger system. A proof of concept. A privacy win.

Instead, it's a case study in how quickly "minimum possible information" can become "everything we need to know about you."

That last point deserves a moment. When you use one of these apps and something goes wrong mid-process — your phone dies, the app crashes, you cancel — what happens to the scan of your passport it was holding? Under European data protection rules (GDPR — the law that says companies can only collect what they genuinely need, and must delete it when they're done), storing a high-resolution scan of your passport with no clear deletion timeline is a problem. Not a theoretical one. A real one, happening right now on people's phones.

What You Can Actually Do With This Information

Look, nobody is saying you should refuse every age check you ever encounter. That's not realistic, and plenty of them are genuinely low-risk. But there are some things worth knowing before you hand your phone camera at a passport scan.

The research from New America's Open Technology Institute found that even the most privacy-friendly approaches to age verification — including techniques like zero-knowledge proofs (a method where a system proves a fact is true without revealing the underlying data) — have significant, unsolved limitations. There is currently no approach that is both fully anonymous and fully reliable. That's not pessimism. That's just where the science is right now.

So when you encounter an age check — for yourself or, parents, for your kid on a platform — the right question to ask isn't just "does this site need to know my age?" It's: "what does this system actually store, where does it go, and who can see it if something goes wrong?" Up next: Old Enough App Cracked In 2 Minutes Now They Want Your Whole.

If a platform's terms of service genuinely can't answer those questions in plain language, that's your signal. The Center for Democracy and Technology has argued that any age verification approach should come with clear safeguards — including transparent data retention policies and specific limits on what gets stored. If a platform can't tell you when it deletes your scan, assume it doesn't.

If you've ever wondered whether a photo or profile is really who it claims to be — or whether the information you hand over is truly going only where you're told it goes — that worry is exactly the right instinct. It's what good identity technology should be built to address. Watching whether any given system actually does that is more useful than trusting the marketing language around it.

The European Commission says this was a demo version, and updates are coming. That's probably true. But the researchers who read Cybernews's technical breakdown of the structural flaws aren't worried about the patch. They're worried about what gets built to replace it.

An age check that answers only one question — old enough, or not — is a genuinely good idea. What you should watch for is whether the "fixed" version still answers only that question, or whether it quietly starts answering a few more.

Would you trust an online age check more if it truly confirmed only "over or under age" and never connected that proof to your real identity? The honest answer right now is: you'd have no reliable way to know.