EU Age Verification App Security Analysis

The premise of the EU age verification app is to present a QR code to the user

but then assume it's the user that scans it in order to pass or fail verification.

But the concept and the specification can't protect against a relay attack

whereby the QR code is sent to a remote third party or even a web service

that passes verification on the child's behalf and in order to do that

they don't need to hack the platform they just need a device with the app installed.

This is the latest version as of the 27th of the 7th 2026

and there we go.

The child's now passed verification using an entirely automated device.

No one needs to interact with it it simply scans any QR code

that is presented to it and then verifies as that child.