"Old Enough?" App Cracked in 2 Minutes — Now They Want Your Whole ID

The European Union spent months building an app to check your age online. It launched on 4/15/2026. A security researcher broke it in under two minutes.

Not two hours

Not two hours. Not two days. Two minutes — by editing a plain text file, the kind of thing you could open in a basic notepad program.

If you've ever been asked to confirm you're old enough to visit a website, this story is about you. Governments across Europe want a better way to do that check. The promise was simple — prove your age without handing over your name, your face, or your passport. Anonymous. Private. Safe. The researcher who cracked it says that promise was broken from the start. And the real worry isn't the hack itself. It's what regulators might do next.

Let's start with the break-in. The E.U. released this app as open source, meaning anyone could read the code and inspect how it worked. Within hours of launch, a researcher found he could edit one configuration file and walk right past the age check. The E.U. had declared the app ready for member states to use. It wasn't. Previously in this series: Eu Age Verification App Hack Identity Risk.

The deeper problem isn't a bug someone can patch

But the deeper problem isn't a bug someone can patch. The app can't actually confirm that your passport got checked on your own phone. That verification is supposed to happen on your device, privately. The trouble is, the system has no way to prove it really did.

So how do you fix that? According to security researchers, the obvious fix would mean sending your full passport data to a server. And that would demolish the entire point of the app. The privacy was the promise. Fixing the flaw breaks the promise.

That's the Catch-22 at the center of this. For engineers, it's a design dead end. For you, it means the private version and the working version may be two different things you can't have at once. Up next: Eu Age Verification App Hack Identity Risk.

Back in March, more than four hundred privacy and

Back in March, more than four hundred privacy and security researchers wrote to the European Commission. They asked for a pause. Their request — stop deploying this until the science on age verification actually settles. Four hundred experts, raising their hands before launch. The app shipped anyway.

One expert put the core dilemma plainly. He argues that age and identity can't really be pulled apart. The moment you strip away who someone is, he says, you can't reliably answer how old they are. To trust the age, you may have to know the person.

And that's the turn that should stick with you. When an anonymous system keeps failing, the fix on the table isn't more anonymity — it's less. The researcher who broke the app warns the next step will be proving who you are. A tool sold as privacy-respecting could quietly become a surveillance tool.