That "Prove You're 18" Pop-Up Is About to Be Everywhere — And Fakes Are Coming for Your Kid's ID

A major identity verification company left its login credentials sitting exposed online for over a year. In that time, anyone who found them could reach names, birthdates, national ID numbers — and photos of people's actual identity documents. The company's whole job was to keep that data safe.

If you've ever clicked a box that said "prove

If you've ever clicked a box that said "prove you're eighteen," this story is about you. And soon it'll be about your kids too. The European Union is rolling out a new app that asks people to verify their age online. The European Commission wants member states to speed up the launch by the end of two thousand twenty-six. Seven countries are already testing it — France, Italy, Spain, and a handful of others. So here's the question that follows all of us this fall — when a box pops up asking for your ID, how do you know it's the real one?

Let's start with what the real app actually does. According to the European Commission, you set it up once using your passport or ID card. After that, when a website asks if you're old enough, the app answers one thing — yes or no. It doesn't hand over your name. It doesn't send your birthdate. It just confirms you clear the age line and stops there. That's the design — share the absolute minimum. For a privacy tool, that's genuinely the right call. Previously in this series: Age Verification App Scam Warning.

But that's also where the trouble starts. Once age checks become normal, people stop questioning them. Psychologists call it authority bias — when something looks official, we hand over what it asks for. You've felt this. An official-looking logo shows up, a clock's ticking, and you just comply. That reflex is exactly what scammers are counting on.

Here's the part that should make you pause

Here's the part that should make you pause. A fake age check can look identical to the real one. Same clean layout. Same official-sounding language. The difference isn't how it looks — it's what it asks for. The legitimate EU app only wants to confirm one thing — are you over the age line. A fake one asks for everything. Your full name. Your birthdate. A scan of your driver's license or passport. If a prompt wants your whole identity just to let you watch a video, that's the red flag. Up next: Digital Identity Verification Three Layer Process Explained.

And think about who's most exposed here. A teenager, alone with a phone, hitting an age wall on some app. No parent in the room. A prompt says "upload your ID to continue." Would your kid know the difference between a safe check and a data grab? Most adults wouldn't either.

Now remember that breach I opened with. The Electronic Frontier Foundation documented it — a verification company exposed for over a year. When those systems leak, the fallout isn't abstract. Stolen IDs feed phishing, blackmail, and identity theft. And privacy advocates make a hard point — no age check is both perfectly private and perfectly accurate. You're always trading something.