The European Union announced updates to an age-verification app designed to protect children online after independent researchers revealed vulnerabilities in the initial version.

Pressure from France and other member states is pushing the EU toward stricter age controls, including possible bans on social media for younger users.

EU Commission President Ursula von der Leyen said a revised app would be ready soon, while the debate over its effectiveness and security continues.

Security experts demonstrated that the app’s safeguards could be bypassed in under two minutes, raising concerns that data could remain unprotected on devices and that PINs, biometrics, and rate-limiting could be compromised or disabled.

Critics highlight biometric privacy concerns, noting inconsistent messaging between a marketing depiction of biometric matching and public statements against biometrics in platform ecosystems.

Privacy concerns focus on whether anonymity can be preserved given pseudonymous data and whether operators could still link user activity over time.

MLex positions itself as a regulatory risk information provider, offering alerts and analysis to help organizations anticipate changes in data privacy and security rules.

Experts warn about potential vulnerabilities and the handling of personal data within the app, underscoring security and privacy issues.

European experts corroborated vulnerabilities, including bypassing PIN or Touch ID and the risk that an adult could enable a minor to impersonate an adult, triggering privacy concerns.

EU officials emphasized openness by publishing the code as open source to invite testing and improvements from third parties.

The open-source nature helped expose flaws quickly, but critics argue security standards are insufficient and rushed deployment could undermine trust in future digital identity initiatives like the EU Digital Identity (EUDI).