Age Verification Should Prove Less

The European Commission has proposed the EU Kids Act, a plan to make online services safer for children. It addresses a real problem: products designed to hold our attention can shape how young people spend their time, what they see, and how they understand the world. I want children to grow up with better protections than the ones many of us had to figure out for ourselves.

In plain English, the proposal says: services used by children should be safer from the start, and platforms should have to show that they have taken children’s safety seriously. It would set 13 as the minimum age for children to access social media and 15 as the age for opening an independent account. Younger teens could use limited accounts with parental involvement. It also covers services such as video-sharing platforms, games, and AI companions, with protections like private-by-default profiles and limits on features designed to keep users scrolling.

There is an important legal detail here: the EU Kids Act is a proposal, not a rule that is already in force. The European Parliament and EU governments still have to discuss and agree on its final wording. The EU already has other online safety rules, including the Digital Services Act, but this proposed act would add a more specific set of protections for children.

What could this mean for games and game shops?

Games are part of the conversation too. The Commission says the proposal covers online games used by minors, and it refers to app stores using age-check tools. That could affect services such as PlayStation Store and Steam, as well as other console, PC, and mobile game shops. The exact duties will depend on the final law and on how each service is classified, so it is too early to say that every store will have to check every customer in the same way.

In practice, age checks could show up when someone creates an account, tries to access an age-restricted game, buys certain content, or uses features such as voice chat and messaging. Stores may also need clearer ways to connect a child or teen account with a parent, and platforms may need to set safer defaults for younger players. Some of these controls already exist through age ratings and parental settings; the proposal could make age assurance and child safety more consistent across services.

The privacy question is the same as for social media. A shop may need to know that a player meets an age threshold, but it should not need to collect and keep a copy of their identity document just to answer that question. A wallet or age-check app could provide a simple confirmation instead. For families, that could mean one trusted way to prove an age across multiple games and stores, rather than repeating intrusive checks on every service.

Age checks are part of that discussion. Think of one as a bouncer checking whether you are old enough to enter, without copying your passport or writing down your name. A service may need to know whether someone is over a certain age, but it usually has no reason to learn their full name, exact birth date, home address, or identity document number.

The Commission has built a technical design for an age-check app that could work this way. You first prove your age using a trusted source, such as an electronic ID or passport. The app then gives a website a simple answer, such as “over 18: yes.” The website does not receive your identity document. Member States and other providers still need to adapt and offer the solution, either as a separate app or inside a national identity wallet.

The risky way to check

Many existing checks ask people to upload an identity document, take a face scan, or hand personal details to a commercial verification provider. Those systems can create a sensitive trail: who tried to access which service, when, and from what device or network. Depending on the provider and implementation, documents or biometric data may also be collected or retained. A database built for routine checks can become a valuable target for criminals, or be repurposed beyond the reason it was collected.

These risks are not just theoretical. In 2025, a breach at a third-party provider used by Discord exposed photos of government IDs submitted for age checks; BreachHistory’s timeline summarizes the incident. Other recent breaches show what can happen when identity records are exposed elsewhere: Denmark’s population register breach involved names, addresses, and national ID numbers, while the AssuranceAmerica breach exposed names, contact details, and driver’s license numbers. Those two incidents were not age-verification breaches, but they show why collecting and keeping identity data creates lasting risks.

This is not an argument against protecting children. It is an argument for collecting less. If a website only needs to know that a visitor is old enough, requiring a government ID and selfie is a disproportionate default. The service should receive the answer to the question it actually needs, not a reusable dossier about the person asking it.

These risks have already shown up in real breaches. In Show Your ID to the Internet, I wrote about incidents involving exposed government ID photos and verification records, with links to the reporting and research behind those cases. The article also explains how a verifiable credential could let someone prove their age without sending a copy of their ID to every site.

Europe already has another direction

The European Digital Identity Wallet (EUDI Wallet) is intended to let people keep official digital documents and credentials on their phone and show only what a service needs. Imagine showing a ticket inspector a valid ticket without handing over your whole wallet. For age assurance, the wallet could prove “over 18” without disclosing your full date of birth or legal identity. The European Commission’s age-verification guidance describes this kind of age-threshold check.

Renting a car with a digital driving licence

This same idea could make an ordinary task like renting a car easier. A driving licence is one of the digital credentials being explored for EUDI Wallets, and the Commission lists car rental as a possible wallet use case. Instead of handing over a physical card or uploading a photo of it, you could present a digital licence from your wallet. The rental company could check that it was issued by a trusted authority, is still valid, and covers the vehicle you want to drive.

The company may still need your name, payment details, or other information to complete the rental. The point is that it should ask for each piece of information it actually needs, and be clear about why. For the driving check, it should not automatically get a copy of every detail on your licence or keep a scan after the check is over. This is not a requirement of the Kids Act, and the wallet does not remove other rental requirements; it is an example of how EUDI and eIDAS 2 could support useful, privacy-minded services for adults as well as age checks for children. The Commission’s wallet overview includes both renting a car and sharing a digital driving licence among the use cases.

The rule behind these wallets is called eIDAS 2. The name is not important; the simple version is that every EU country must make at least one approved digital identity wallet available to its residents, and the wallets should work across borders. It is like agreeing on a common plug: a wallet from one country should be usable with compatible services in another. The rule says countries must provide a wallet; people can choose whether to use it.

That is also where data sovereignty comes in. In everyday terms, it means people and European institutions have more say over who issues, stores, and checks their identity information. A shared EU rulebook can let a Belgian driving licence be checked by a compatible service in another country, while the driver chooses what to present. The wallet cannot guarantee that every company will handle data well, so clear limits on collection and retention still matter.

This infrastructure is moving from pilots and prototypes towards everyday services. Belgium already has MyGov.be for access to public services, and itsme is widely used for digital identification and authentication. Germany is developing its national wallet through the EUDI Wallet project. Across Europe, teams have tested ways to use wallets for public services, banking, travel, payments, education credentials, and health or social-security documents. These are possible uses being explored; the law does not make every service use every feature. The EUDI Wallet Hub has an overview of pilots, wallet prototypes, and use cases.

The next step is a production launch in January 2027. Most of the use cases researched so far are expected to go live in some form. That does not mean every country or service will switch on every feature at once. It does mean that the choices made in pilots and standards are about to affect real people and real transactions.

A wallet is not automatically private

Putting a credential in a wallet does not, by itself, guarantee privacy. We still have to ask who issues it, what data it contains, what a verifier can request, whether repeated checks can be linked, and what records the service keeps afterwards. A technically selective disclosure can still become a tracking system if every presentation is logged against a stable identifier.

Good age assurance should make the smallest possible claim, disclose it only to the service that needs it, and avoid creating a cross-service record of a person’s activity. It should also be usable without a smartphone or a particular commercial provider becoming a gatekeeper. Security, accessibility, independent review, and clear limits on retention matter as much as the cryptography.

Europe has spent years building shared rules and technology for digital identity. eIDAS 2 is the rulebook; the wallets are the tools people may choose to use; and age proof is one possible task those tools can handle. The January 2027 production launch you are preparing for is an opportunity to put the researched use cases into real services in stages, and to show that private age checks can work beyond a pilot.

There is a wider question of who controls the infrastructure behind these services, which I explored in my article on EU data sovereignty. Public digital identity can support European autonomy, but that only matters to citizens if it also earns their trust through strong privacy and meaningful control.

Protecting children online is necessary. So is protecting everyone’s ability to use the internet without surrendering more identity data than the task requires. We should judge the coming systems by both measures.