The EU's open-source age checker requires locked-down phone hardware

The EU is building an open-source age checker, but your custom phone or Linux desktop might not be allowed to use it.

Project maintainers confirmed on GitHub that hardware-bound attestation—tying security keys to physical device chips—is a mandatory requirement for the EU's age-verification system. The app lets users prove their age without revealing their name or birth date. To stop people from copying or cloning credentials, it locks keys inside chips like Apple’s Secure Enclave or Android’s TEE.

Why it matters: Requiring specific security hardware clashes with open systems. Custom Android ROMs, community builds, and alternative mobile operating systems will struggle to meet the trust checks. On top of that, the European Commission plans to limit credentials to an official list of compliant apps, meaning a self-compiled build won't automatically work even with open source code.

Know this: Desktop Linux users can still verify by scanning a QR code with a supported phone wallet. The project maintainers also plan to publish a security review and threat model soon to explain why they chose this trade-off.

Open-source code isn't truly open if only approved hardware gets to run it.