[Spec]: Proposal to introduce a mandatory alternative that does not require a specific OS. · Issue #64 · eu-digital-identity-wallet/av-doc-technical-specification · GitHub
//voltron/issues_fragments/issue_layout" data-turbo-transient="true" />
Skip to content
Type / to search
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading. Please reload this page.
eu-digital-identity-wallet
av-doc-technical-specification
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star<br>97
[Spec]: Proposal to introduce a mandatory alternative that does not require a specific OS. #64
New issue<br>Copy link
New issue<br>Copy link
Open
Open<br>[Spec]: Proposal to introduce a mandatory alternative that does not require a specific OS.#64
Copy link
Description
Secret-chest<br>opened on Aug 11, 2026
Issue body actions
Summary
Not everyone has or wants to have proprietary phones that they do not control, therefore an alternative is needed, and I propose one which uses the chip, which is already embedded in ID cards of EU member states.
Current specification text
No response
Proposed change
A protocol should be added, which is mandatory for member states and all age-restricted platforms to implement and accept:
The user tries to access an age-restricted platform.
The platform presents them with a random token.
Here, it should be allowed for the client to have a few minutes of delay in order to prevent timestamp-based deanonymisation.
The user logs in to the government portal using the ID chip in a card reader or even an account activated at an institution.
If the user is old enough, the government portal allows them to use the token signing service.
The token is blinded on the client. The specification for how to do this and the API of the government portal should be open, so that anyone can implement a client for any OS and they can be assured about its security, though, for convenience, the government portal would provide JavaScript to do this without needing to use any extra software (said JS should be libre too).
The government server signs the blinded token.
The client can now unblind the signed token.
The client sends the signed token to the platform which the user wants to access.
It should be an alternative to the Android/iOS app, not replace it.
Rationale
Users of Internet services in the EU should not be forced to have a proprietary Android/iOS phone that they do not control.
Change type
New requirement
Impact
It would require governments to provide an extra service and for platforms to implement it, though the implementation is quite simple and does not depend on special browser or OS APIs (even if they could be used to enhance the user interface).
Alternatives considered
I would accept any reasonable alternative that is also private and doesn't depend on a particular OS. Or, find a way to regulate the platforms so that age verification is not needed at all.
References
It would resolve many, many, issues, such as #19.
Reactions are currently unavailable
Metadata<br>Metadata<br>Assignees
No one assigned
Labels
No labelsNo labels
Type
No type
Projects
No projects
Milestone
No milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions<br>Open in GitHub Copilot app
You can’t perform that action at this time.