(EU age verification) Alternative protocol idea that doesn't require specific OS

roundabout-host3 pts1 comments

[Spec]: Proposal to introduce a mandatory alternative that does not require a specific OS. · Issue #64 · eu-digital-identity-wallet/av-doc-technical-specification · GitHub

//voltron/issues_fragments/issue_layout" data-turbo-transient="true" />

Skip to content

Type / to search

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

Uh oh!

There was an error while loading. Please reload this page.

eu-digital-identity-wallet

av-doc-technical-specification

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star<br>97

[Spec]: Proposal to introduce a mandatory alternative that does not require a specific OS. #64

New issue<br>Copy link

New issue<br>Copy link

Open

Open<br>[Spec]: Proposal to introduce a mandatory alternative that does not require a specific OS.#64

Copy link

Description

Secret-chest<br>opened on Aug 11, 2026

Issue body actions

Summary

Not everyone has or wants to have proprietary phones that they do not control, therefore an alternative is needed, and I propose one which uses the chip, which is already embedded in ID cards of EU member states.

Current specification text

No response

Proposed change

A protocol should be added, which is mandatory for member states and all age-restricted platforms to implement and accept:

The user tries to access an age-restricted platform.

The platform presents them with a random token.

Here, it should be allowed for the client to have a few minutes of delay in order to prevent timestamp-based deanonymisation.

The user logs in to the government portal using the ID chip in a card reader or even an account activated at an institution.

If the user is old enough, the government portal allows them to use the token signing service.

The token is blinded on the client. The specification for how to do this and the API of the government portal should be open, so that anyone can implement a client for any OS and they can be assured about its security, though, for convenience, the government portal would provide JavaScript to do this without needing to use any extra software (said JS should be libre too).

The government server signs the blinded token.

The client can now unblind the signed token.

The client sends the signed token to the platform which the user wants to access.

It should be an alternative to the Android/iOS app, not replace it.

Rationale

Users of Internet services in the EU should not be forced to have a proprietary Android/iOS phone that they do not control.

Change type

New requirement

Impact

It would require governments to provide an extra service and for platforms to implement it, though the implementation is quite simple and does not depend on special browser or OS APIs (even if they could be used to enhance the user interface).

Alternatives considered

I would accept any reasonable alternative that is also private and doesn't depend on a particular OS. Or, find a way to regulate the platforms so that age verification is not needed at all.

References

It would resolve many, many, issues, such as #19.

Reactions are currently unavailable

Metadata<br>Metadata<br>Assignees

No one assigned

Labels

No labelsNo labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions<br>Open in GitHub Copilot app

You can’t perform that action at this time.

alternative token require issue signed user

Related Articles