EU age‑verification system mandates hardware‑bound attestation, drawing open‑source criticism

The European Commission’s digital identity framework (EUDI) includes an age‑verification component that will require cryptographic attestation tied to secure hardware such as Trusted Execution Environments (TEE), Android StrongBox, or Apple’s Secure Enclave. This hardware‑bound approach is intended to prevent tampering by modified devices.

Open‑source developers argue the requirement excludes open‑source operating systems like GrapheneOS and Linux, limiting interoperability. Project maintainers responded that hardware certification is a core requirement of the specification and not optional, though they invite concrete improvement proposals via the GitHub repository.