(1)

Secure, privacy-preserving ways of proving anyone’s age will be increasingly important for all aspects of EU citizens’ daily lives. For example, in-store purchases of age-restricted products, such as alcohol or cigarettes, or accessing age restricted content online, such as pornographic or gambling content, all require some form of age verification. This includes proving minors’ age in online environments, especially as minors are increasingly using information society services in their daily lives, such as online platforms or online games. On the one hand, this provides opportunities for minors in the areas of identity development, learning, education, civic participation, relationship development, communication, connection and creativity. On the other hand, use of information society services can give rise to risks or harms to minors, for example, by exposing them to illegal or harmful content, such as violent, terrorism or pornographic content, or contact risks, such as cyberbullying or individuals seeking to groom minors or recruit them for organised crime. These risks also include excessive, compulsive or addiction-like use of the information society service and exposure to other exploitative practices, such as gambling. Since minors’ brains are still under development, they are more vulnerable to risks and harms which can originate from their direct experience on the information society service. These risks make it increasingly important to prove citizen’s age to ensure that they have a safe online experience, in due respect of the rights of the child as laid down in article 24 of the EU Charter of Fundamental Rights, while also safeguarding the proper functioning of the internal market by promoting consistent standards and preventing fragmentation across EU Member States. Providing minors with age-appropriate and safe online experiences is paramount to protect them in an increasingly online environment.

(2)

The Commission has taken major steps to ensure that the EU regulatory framework is fit for purpose in the current digital landscape and to protect minors online. Regulation (EU) 2022/2065 of the European Parliament and of the Council (1), which applies in full since February 2024, introduced fully harmonised rules to ensure that minors are protected online. Article 28(1) of Regulation (EU) 2022/2065 obliges providers of online platforms accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors on their service. Furthermore, pursuant to Articles 34 and 35(1) of Regulation (EU) 2022/2065, providers of services designated as Very Large Online Platforms or Very Large Online Search Engines are required to assess and mitigate actual or foreseeable risks that their service may pose to the protection of minors, the rights of the child, and the user’s mental and physical well-being. Finally, Article 44(1)(j) of Regulation (EU) 2022/2065 enables the Commission to support and promote the development and implementation of voluntary targeted standards to protect minors online. While no such standards have yet been developed, this could include technical standards for age assurance, including age verification.

(3)

In view of the importance of protecting minors online, and in accordance with Article 28(4) of Regulation (EU) 2022/2065, the Commission has adopted guidelines setting out measures that it considers that providers of online platforms accessible to minors should take to ensure such a high level of privacy, safety and security of minors online and to assist providers of online platforms in complying with Article 28(1) of that Regulation (‘the Guidelines’) (2). These measures include, amongst others, making minors’ accounts more private by default and preventing unknown accounts from contacting children, modifying recommender systems to minimise the risk of minors coming across illegal or harmful content, disabling by default features that contribute to excessive use, putting safeguards around AI chatbots integrated into online platforms and improving moderation and reporting tools.

(4)

While neither Regulation (EU) 2022/2065 nor the Guidelines define what is illegal or harmful content for minors on online platforms, nor do they prescribe specific minimum age requirements, the Guidelines set out clear measures that the Commission considers providers of online platforms accessible to minors should adopt for age assurance purposes, whereby the providers of high-risk platforms, such as pornographic or gambling platforms, should put in place age verification methods. Furthermore, the Commission considers that providers of online platforms accessible to minors should put in place age verification methods where Union or national law, in compliance with Union law, prescribes a minimum age to access certain products or services offered and/or displayed in any way on an online platform, including specifically defined categories of online social media services. The Guidelines explain that age verification should only be considered appropriate and proportionate in accordance with Regulation (EU) 2022/2065 if it is in line with the criteria of accuracy, reliability, robustness, non-intrusiveness and non-discrimination.

(5)

Furthermore, Directive 2010/13/EU of the European Parliament and of the Council (3), as amended by Directive (EU) 2018/1808 of the European Parliament and of the Council (4), sets out sector-specific obligations for providers of video-sharing platforms concerning harmful audiovisual content. Under that Directive, video-sharing platforms must include EU media content standards, including those aimed at protecting minors from harmful audiovisual content, in their terms and conditions. Providers of video-sharing platforms are also required to take appropriate measures to prevent minors from viewing such harmful audiovisual content, such as mechanisms to report or flag harmful content, age verification, parental control and content rating systems. The ongoing evaluation and upcoming review of Directive (EU) 2010/13/EU will consider the relevance of the current rules and identify potential shortcomings in the existing framework.

(6)

Moreover, the EU consumer protection acquis, in particular Directive 2005/29/EC of the European Parliament and of the Council (5), recognises children as vulnerable consumers requiring enhanced protection. Directive 2005/29/EC prohibits aggressive and misleading commercial practices, including when they exploit minors’ credulity or lack of experience. It also prohibits exhorting minors to buy advertised products or persuade parents to buy those products for them. As highlighted in the Consumer Agenda 2030 (6), and in preparation of the upcoming proposal for a Digital Fairness Act, the Commission is assessing whether more needs to be done to address remaining gaps in consumer protection in the digital environment, including for minors.

(7)

The Commission recalls that there are a number of existing and upcoming initiatives to prevent and combat child sexual abuse under the EU Strategy for a more effective fight against child sexual abuse. In particular, the proposal for a Regulation laying down rules to prevent and combat child sexual abuse will set out obligations for online service providers to prevent and combat online child sexual abuse and the proposed recast of Directive 2011/93/EU will update the rules of the criminal law framework to ensure that all forms of child sexual abuse (including sextortion and grooming), even when facilitated by new technologies, are effectively criminalised. These measures will be complemented by the upcoming Action Plan on the protection of children against crime, announced in the ProtectEU Strategy (7), which seeks to set out a coherent and coordinated response to the multiplicity of threats faced by minors in relation to crime.

(8)

In addition, the Commission recalls that there are several existing or upcoming initiatives to empower and support minors and ensure their well-being online. Empowering and protecting children in their digital environment is central to the digital pillar of the EU Strategy on the rights of the child (8) and to the Commission Recommendation on developing and strengthening integrated child protection systems in the best interests of the child (9). The Commission also has a long-standing multistakeholder engagement under the new European Strategy for a Better Internet for Kids (10), through the co-funded EU Safer Internet Centres. Those centres, in cooperation with the Better Internet for Kids online platform, constitute the EU Hub for online child safety and implement EU child online safety policies at European and national level. This is complemented by the Action Plan Against Cyberbullying (11), which focuses on minors and on vulnerable youth, and among other things, establishes a common EU understanding of cyberbullying, improving digital literacy, reporting mechanisms, and victim support. Moreover, strengthening digital skills, including digital literacy, remains a key priority for the Commission, pursued through the implementation of the Digital Education Action Plan (2021-2027) (12), as well as the forthcoming 2030 Roadmap on the future of digital education and skills. The Commission will also launch an EU-wide inquiry on the broader impacts of social media on mental health and wellbeing, to underpin an evidence-based debate on protection of minors online. The deployment of age verification solutions should be accompanied by clear, accessible and age-appropriate communication to citizens, in particular minors, young people, parents and educators.

(9)

At the international level, the Commission regularly engages with international partners on protection of minors. Operational cooperation agreements with the Australian eSafety Commissioner, as well as the United Kingdom’s regulator for telecommunication services, Ofcom, both leading regulators in the area of online safety, are in place and include regular engagement on the topic of protection of minors, including on the technical means to effectively verify age.

(10)

At the Member States level, several Member States are adopting or are considering to adopt national measures to reduce the access of minors to certain information society services, which would require privacy preserving age verification solutions.

(11)

For all these reasons, having robust, effective, cybersecure, privacy-preserving and data protection compliant age verification methods available in the Union is key to ensure compliance with Regulation (EU) 2022/2065, and, more specifically, to protect minors online. Technical safeguarding measures are essential to protect minors from negative effects to their mental and physical wellbeing, as well as from exposure to illegal and harmful content. Given that minors merit special protection, it is crucial that the application of age verification methods is appropriate and proportionate and incorporates strong security safeguards and privacy-preserving features to prevent unnecessary data collection, unauthorized access, or misuse of personal information. Furthermore, to prevent fragmentation of the internal market, a harmonised European solution is necessary. This is not only important for minors, but is also important to ensure that every EU citizen has access to such technologies, encourage the uptake of age verification methods and ensure that at least one such method is available on the market in accordance with the criteria set out in the Guidelines. The Commission is facilitating the development of harmonised privacy-preserving, cybersecure, data protection compliant and robust EU age verification solutions in Member States via a blueprint, which consists of technical specifications that are aligned with those of the EU Digital Identity Wallets, and an open-source implementation as a mobile app that can be customised to national contexts.

(12)

To be privacy-preserving, age verification methods should at least provide for selective disclosure of information to the relying party and by default limit the information to a true or false response regarding the age-related information requested by the relying party without providing additional information about the citizen. Additionally, they should include technical safeguards to protect citizens from privacy and data protection risks, such as tracking of their online activity, including the use of zero knowledge proofs. The Commission further recalls that, in line with Article 28(3) of Regulation (EU) 2022/2065, a provider of an online platform should only process the age-related attributes that are strictly necessary for the specific purpose and age assurance should not be used to provide additional means for providers to identify, locate, profile or track natural persons.

(13)

EU age verification solutions based on the blueprint allow EU citizens to prove that they are over a certain age (for example 15+ or 18+), while meeting the highest privacy standards. The EU age verification solutions will use state-of-the-art technology and prevent identity tracking. They only serve to confirm that a user is over a certain age, without revealing any other information about the user to the trusted proof provider or to the information society service. The user’s identity and online activity will be shielded from disclosure throughout the whole process.

(14)

The blueprint is published as open source, so that Member States and market players can take it up and further develop it into EU age verification solutions customised to their needs. The open-source publication of the blueprint ensures public review and scrutiny of the code and contributes to transparency and trust. For end-to-end testing and implementation of the blueprint and of the solutions based on it, the Commission is working closely with Member States, online platforms and end users. Several Member States are planning to release an age verification functionality as part of their European Digital Identity Wallets (13). Regulation (EU) No 910/2014 of the European Parliament and of the Council (14) requires each Member State to provide at least one European Digital Identity Wallet on a voluntary basis and free of charge to natural persons residing in a Member State in accordance with Union or national law. The European Digital Identity Wallets provide a secure and privacy preserving means for users to identify and authenticate themselves, to store and share, under their sole control, person identification data and electronic attestations of attributes with public and private relying parties across the Union. These electronic attestations of attributes provide for attestations in electronic form that allow attributes, such as age, to be authenticated and to be stored and shared via the European Digital Identity Wallets.

(15)

A handful of Member States will place their first customised national EU age verification solutions on the market in the coming months. To ensure that all EU citizens have access to a robust and privacy-preserving age verification solution, and to ensure that at least one age verification method is available on the market in accordance with the criteria set out in the Guidelines, Member States should facilitate the effective deployment of EU age verification solutions based on the EU blueprint.

(16)

To strengthen public trust and ensure the widespread adoption of EU age-verification solutions, it is imperative that only reputable and rigorously vetted providers - fully compliant with the high standards set out in the EU age verification scheme - are granted the responsibility of delivering these services to minors. This approach not only safeguards young users but also reinforces the integrity of the Digital Single Market, aligning with our shared commitment to child protection, data security, and digital inclusion. By upholding these principles, we foster a safer, more reliable digital environment - one that earns the confidence of citizens, businesses, and Member States alike. Providers of EU age verification solutions and of proof of age attestations should therefore take appropriate and proportionate technical, operational and organisational measures of the type referred to in Article 21 of Directive (EU) 2022/2555 of the European Parliament and of the Council (15). Trust in the proof of age attestations shared through EU age verification solutions is established by setting up an EU Age Verification Scheme for the attestation of these attributes. An EU trusted proof of age attestation providers list will be available for consultation to provider of online platforms and other parties concerned in order to verify that a user's proof of age attestation has been issued by a provider included in the list.

(17)

An EU list of trusted solutions performs a complementary function by allowing identification of age verification solutions that have been recognised as conforming with the EU Age Verification Scheme.

(18)

To be registered on the lists managed by the Commission, providers of proof of age attestations and of age verification solutions should comply with the requirements set out in the EU Age Verification Scheme, in Regulation (EU) No 910/2014, in Commission Implementing Regulation (EU) 2025/2160 (16), and in Directive (EU) 2022/2555. The Commission will monitor that these requirements are continued to be met. In case providers fail to meet these high standards, the Commission will ensure that they are removed from the lists.

(19)

Based on the EU Age Verification Scheme, the Commission will make publicly available both the EU trusted proof of age providers list and the EU trusted solution list to ensure that the trust infrastructure is in place at the EU level to support the EU Age Verification Solutions. In addition, the Commission will include information on whether solutions offered by the providers included on the EU trusted proof of age providers list ensure conformity with the criteria of effectiveness set out in Section 6.1.4 of the Guidelines, namely accuracy, reliability, robustness, non-intrusiveness and non-discrimination.

(20)

The EU Age Verification Scheme will allow for the inclusion into the EU trusted proof of age providers list and in the EU trusted solutions list of public and private entities, including Member States, European foundations and consortia, and other public or private organisations.

(21)

As citizen demand for trusted, cybersecure and privacy-preserving and data protection compliant digital solutions increases, at national level, Member States are increasingly adopting or considering whether to adopt national measures to restrict access by minors to online platforms, often combined with specific age verification obligations to make such measures effective in practice. Regulation (EU) 2022/2065 aims at approximating national regulatory measures at Union level concerning the requirements for providers of intermediary services in order to avoid and put an end to fragmentation of the internal market and to ensure legal certainty. Given that Regulation (EU) 2022/2065 fully harmonises the rules applicable to intermediary services in the internal market with the objective of ensuring a safe, predictable and trusted online environment, including to ensure a high level of privacy, safety and security of minors pursuant to Article 28(1) thereof, it does not preclude the possibility of applying other national legislation applicable to providers of intermediary services, in compliance with Union law, including Directive 2000/31/EC, and its Article 3 in particular, where the provisions of national law pursue other legitimate public interest objectives than those pursued by Regulation (EU) 2022/2065. As stated in the Guidelines, Members States may introduce national laws which, in compliance with Union law, prescribe a minimum age to access certain products or services offered and/or displayed in any way on an online platform. However, such national measures cannot impose additional obligations on online platforms, including age verification obligations, as it would undermine the full harmonisation effect of Regulation (EU) 2022/2065, given that the objectives of such measures would overlap with those already pursued by that Regulation.

(22)

Where Member States consider introducing national measures to restrict access by minors to online platforms, the Commission recalls Member States of the notification obligation pursuant to Directive (EU) 2015/1535 of the European Parliament and of the Council (17) concerning any draft technical regulations that may concern rules on information society services, as defined in that directive, with the aim to prevent the creation of barriers in the internal market before these measures are adopted. In accordance with that directive, the notification of a draft technical regulation has the effect to open a three-month standstill period during which the Member State concerned is restrained from adopting the notified draft technical regulation. The standstill period can be extended depending on the type of reaction issued by the Commission or other Member States.

(23)

An informal exchange between Member States and the Commission services in the early stages of the process of drafting national measures contributes to the drafting of measures which are compatible with Union law, including where questions arise regarding the interplay of the proposed national measures with Regulation (EU) 2022/2065 and Directive 2000/31/EC. Such exchange should take place through engagement between the Member State and the Commission services. Multilateral exchanges may also take place by means of the Digital Services Expert Group (18). In order to ensure a consistent and harmonised approach when enforcing Regulation (EU) 2022/2065 as regards these aspects, Digital Services Coordinators within the meaning of Regulation (EU) 2022/2065 could bring any such matter to the attention of the European Board for Digital Services, within the meaning of that regulation.

(24)

According to the established case-law of the Court of Justice of the European Union, an omission to respect the notification obligation is considered a procedural defect that renders the measure, if adopted, unenforceable against individuals in national court proceedings (19). Similarly, the Court of Justice of the European Union clarified that a notified technical regulation adopted in breach of the standstill period must be declared by national courts as inapplicable to individuals (20). Furthermore, where national measures are not compatible with Union law, including Regulation (EU) 2022/2065 and Directive 2000/31/EC, the Commission has the right to initiate infringement proceedings in accordance with Article 258 TFEU, including in relation to the notified draft measures. The absence of a reaction from the Commission to a notification does not impact or reduce the possibility for the Commission to take a decision or action under EU law.

(25)

To find solutions at Union level to better protect minors online, a Special Panel on Child Safety Online was established by the Commission with a mandate to draw up recommendations to the President of the Commission on the best approach for the Union on child safety online and potential age limits for social media and other online services in Europe. The Report of this Special Panel on Child Safety Online is expected by the summer of 2026.

(26)

In view of the urgency of this topic, this Recommendation pursues a twofold objective. First, it aims at ensuring that all EU citizens have access to a robust, reliable, interoperable, cybersecure, privacy preserving and data protection compliant age verification solution. Second, this Recommendation aims to support the proper functioning of the internal market by promoting consistent standards and preventing fragmentation across EU Member States. In this regard, the EU Age Verification solution represents the most effective technical solution currently available, combining operational reliability with full respect for the fundamental rights of EU citizens, in particular children’s rights, the right to privacy and the protection of personal data. This Recommendation therefore seeks to support its adoption at national level and ensure its practical functionality across Member States.