Summary:
- Pavel Durov warns the EU's age-verification app could evolve into broader identity tracking.
- Security concerns surfaced after claims the system can be bypassed in minutes.
- The European Commission says the app is "completely anonymous" and ready for rollout.
- Debate grows over privacy, security, and the future of digital identity in Europe.
The debate around digital identity in Europe just took a sharper turn. Pavel Durov, the CEO of Telegram, has warned that the European Union's new age-verification app could go far beyond its stated purpose. In a recent Telegram post, Durov pointed to security concerns raised by independent researchers and argued that the system may eventually open the door to wider tracking across online services. His comments came just days after the European Commission said the app was technically ready for rollout. The trigger for the criticism was a technical analysis by security consultant Paul Moore, who claimed the app could be bypassed in under two minutes.
According to Moore, the issue lies in how the app handles user authentication during setup. The system stores an encrypted PIN locally, but without properly linking it to the secure identity vault, making it possible for attackers to manipulate the process. Moore described a simple method where removing certain stored values could allow someone to bypass the PIN entirely. That, in theory, breaks the link between the user and the age verification process. Durov took that concern further. He argued that weaknesses :
EU Pushes Privacy-First Design, But Questions Remain
From the EU's perspective, the project is designed with privacy at its core. The European Commission introduced the age-verification framework as a way to let users prove they are over 18 without sharing personal details. The system works by separating identity verification from usage. When a user signs up, their age is confirmed using official data, such as a date of birth. But when they use the app on websites or platforms, only a simple confirmation is shared - without not sharing the personal information. Officials say this approach reduces the risk of data exposure and prevents cross-service tracking. Each verification is designed to be used only once, and the service receiving the proof does not know where else it has been used. Ursula von der Leyen reinforced that message earlier this week, stating:
The goal is clear that Policymakers want to give users control while ensuring age-restricted content is properly enforced. It is part of a broader push toward digital identity tools that can work across borders and services. But critics argue that even well-designed systems can create new risks. If widely adopted, age verification could become a default requirement for accessing parts of the internet. Over time, that could shift expectations around anonymity online. Durov's broader point reflects that concern. In a follow-up comment, he suggested that incidents like this could be used to justify tighter controls later, gradually moving from optional verification to more comprehensive identity checks across platforms.
Privacy vs Control in the Digital Age
This discussion goes beyond one app. It touches a deeper tension that has been building for years that balances privacy with regulation in a digital world. On one side, governments are under pressure to protect users, especially minors, and to enforce rules around harmful content. Age verification tools are one way to address that. They offer a way to apply rules without relying entirely on platforms to self-regulate. On the other side, privacy advocates worry about the long-term impact. Even if a system starts with limited scope, it can expand. What begins as age verification could eventually link into broader identity systems, especially as digital wallets and cross-platform authentication become more common.
Durov has been a consistent voice in that conversation. As the head of Telegram, he has often positioned himself as a defender of user privacy and free speech. At the same time, he remains under investigation in France over allegations tied to illegal activity on the platform, including claims that Telegram has not fully cooperated with authorities. For now, the EU's age-verification app is still in its early stages. It has not yet been rolled out at scale, and its real-world performance remains to be tested.