Controversy: EU Age Verification "App" Mandates Android/iOS Ecosystems

A heated debate has erupted within the eu-digital-identity-wallet/av-doc-technical-specification GitHub repository regarding the proposed technical requirements for the European Union's age verification system. The central conflict stems from a plan to integrate Google Play Integrity API and Apple App Attestation for device and app verification.

🚩 The Core Complaint

The discussion was ignited by user TheLastProject, who strongly urged the developers to implement abandon the plan to rely on American tech giants. The primary concern is that this creates a deep systemic dependency on the USA's control over the internet, which is viewed as dangerous and undesirable given the current global political climate.

"Requiring a dependency on American tech giants for age verification further deepens the EU's dependency on America and the USA's control over the internet." — TheLastProject

The "Yivi" Precedent

To prove that such proprietary integrations are unnecessary, TheLastProject pointed to Yivi (formerly IRMA), a Dutch identity application.

• Yivi performs age verification for the government without these dependencies.
• It is available on open-source platforms like F-Droid.
• Conclusion: If Yivi works, Google Play Integrity is redundant.

---

🛠️ Technical and Philosophical Objections

Several other contributors joined the fray, highlighting contradictions in the project's own goals.

1. Violation of Design Principles

User duncan-bayne argued that the current path violates the organization's core tenets:

• User Control: The system should be controlled by the users.
• Universal Access: It should be available to anyone who wishes to use it.
• Interoperability: According to the Technical Specification, the solution must ensure "seamless integration across diverse device operating systems."

Tying the system to specific vendors directly contradicts these goals.

2. Digital Sovereignty and Security

k0nstruct emphasized that digital sovereignty is essential for reducing data processing risks. Every third-party external service introduces a new "ecosystem of potential security issues."

3. The "Irony" of Regulation

BoGnY pointed out a glaring contradiction in EU policy:

"It's incredible that the European Commission sanctions Google for abuse of dominant position... and you [the writers] impose the use of tools that exclude the free choice of the user."

---

📊 Comparison of Approaches

---

📐 Proposed Alternatives & Threat Models

orazioedoardo questioned the actual threat model of the system. Is the risk of someone stealing a "proof of age" to access adult content high enough to justify such restrictive measures?

Suggested Technical Path:

Instead of a native app locked to a vendor, they suggest:

1. A modern Web App.
2. Leveraging the Digital Credentials API.
3. A challenge-response system via national identity providers.

Proposed Logic Flow:

Mathematical Representation of Dependency

The risk can be viewed as a function of dependency: $\text{Risk} = \sum (\text{Third Party APIs}) \times \text{Political Instability}$ Where the goal is to reach $\text{Risk} \to 0$.

---

📋 Community Demands

The contributors are essentially calling for the following changes:

• Remove Google Play Integrity requirement.
• Remove Apple App Attestation requirement.
• Implement standard Android hardware attestation.
• Explore Web-based Digital Credentials API.
• Ensure compatibility with F-Droid.

Final Technical Suggestion

For those insisting on device verification, thgoebel suggests using the standard API:

# Instead of GMS-based integrity, use:
android.hardware.attestation.KeyAttestation