The editorial argues that the EU spent a decade with GDPR, DMA, DSA, and the AI Act building a regulatory identity as a counterweight to US Big Tech, yet the reference wallet implementation makes Play Integrity and App Attest load-bearing. This appears to be an implementation accident rather than a deliberate policy debate, and it puts the gating function for adult content under Silicon Valley control.
The submitter frames the issue directly in the title — the 'age verification app' forces everyone onto Android or iOS. Their surfacing of the GitHub discussion argues the spec effectively conscripts European citizens into the two dominant mobile duopolies to exercise basic online rights.
Contributors in the discussion point to concrete places in the technical specification where Play Integrity and App Attest are structurally required to prove the client isn't a bot or modified app. Their argument is that this isn't a fixable bug — removing attestation would require rethinking the anti-abuse model, so GrapheneOS, LineageOS, /e/OS, and CalyxOS users are excluded by design.
Team members responding in the thread acknowledge the concerns and say alternatives are being explored, but decline to commit to any specific path. Meanwhile the pilot is already rolling out in France, Italy, Spain, Denmark, and Greece, implying the current attestation-dependent design is acceptable for launch.
A GitHub discussion on the `eu-digital-identity-wallet/av-doc-technical-specification` repo has surfaced a design choice that a lot of European developers apparently missed until now: the reference implementation of the EU's age verification app depends on hardware-backed remote attestation from Google (Play Integrity API) and Apple (App Attest / DeviceCheck). That's not a suggestion in an appendix. It's how the spec proves the client isn't a bot or a modified app.
The practical consequence is blunt. If you run GrapheneOS, LineageOS, /e/OS, CalyxOS, or any Android build without Google Play Services signed by Google's keys, Play Integrity returns a failing verdict and the wallet refuses to attest your age. iOS users on jailbroken devices are out for the same reason. Desktop Linux, Windows, and macOS don't enter the conversation because the spec assumes a mobile device with a Secure Element and a vendor-signed OS image. There is no web fallback in the current draft.
The discussion thread — 237 points on Hacker News, hundreds of comments on the GitHub issue — is not the usual privacy-libertarian noise. It includes contributors pointing at concrete places in the spec where hardware attestation is load-bearing, and EU wallet team members responding that alternatives are 'under consideration' without committing to any. The pilot is already rolling in France, Italy, Spain, Denmark, and Greece.
The EU spent the last decade building a regulatory identity as the counterweight to US Big Tech. GDPR, the DMA, the DSA, the AI Act — the through line is that critical digital infrastructure should not be a chokepoint controlled by two Silicon Valley companies. Handing the gating function for adult-content access to Google's and Apple's remote attestation servers is the exact opposite of that posture, and it appears to have happened by accident of implementation rather than by policy debate.
Remote attestation is a specific, load-bearing thing. Play Integrity doesn't just check that your app hasn't been tampered with; it phones home to Google, which decides — based on rules Google writes and can change — whether your device is 'genuine.' A GrapheneOS device is objectively more secure than most stock Android phones (verified boot with user keys, hardened memory allocator, sandboxed Play Services), and Google's own attestation calls it untrusted. That is not a bug in the attestation system. It is the attestation system working as designed: it measures Google-signed-ness, not security.
The civil society response has been sharp. EDRi, La Quadrature du Net, and several German Pirate Party MEPs have pointed out that mandating a wallet on iOS or stock Android turns a policy question — 'should minors see adult content?' — into a platform question — 'do you use hardware Google and Apple approve of?' The Chaos Computer Club framing is that this is not age verification, it's device verification, and the two are being conflated because device verification is the part that has an off-the-shelf API.
The developer angle sharpens further when you look at what alternatives exist. Zero-knowledge proof schemes for age attestation have been demonstrated for years — Idemix, BBS+ signatures, the exact primitives the EUDI Wallet is otherwise built on — and they don't require Google to be in the loop. A government-issued cryptographic credential, presented via a selectively-disclosed proof, is technically strictly better than 'your phone told Google's servers you're old enough.' The reference spec picks the worse option because it's already shipping in mobile SDKs.
If you build anything that has to comply with an incoming age-gating rule in an EU market — adult platforms, gambling, alcohol delivery, some social features — the current path of least resistance will be to integrate a wallet SDK that inherits this attestation dependency. You'll be silently telling your Linux, GrapheneOS, and older-Android users they can't use your product. That'll show up as a support-ticket problem before it shows up as a compliance one, and the people filing those tickets are disproportionately the technically literate power users you want retaining.
If you ship an Android app, this is also a warning shot about Play Integrity's expanding surface area. It started as an anti-fraud signal for banking apps. It is now on track to become a gating check for civic function in a jurisdiction of 450 million people. Any dependency you take on Play Integrity today is a dependency on Google's future definition of 'genuine device,' which historically has trended toward excluding more, not fewer, custom builds. That's a supply-chain risk in the same way an unpinned dependency is a supply-chain risk.
The correct engineering response, if you have any input into a wallet integration RFP, is to push for a spec path that accepts a government-issued credential without device attestation as the trust root. That's the design the EUDI Wallet was originally sold as. The current draft is a regression toward the mobile duopoly, and it's regressible precisely because most of the review to date has come from identity people rather than platform-diversity people.
The GitHub thread has moved from indignation to concrete pull requests: alternative attestation flows, a web-app path with credential-based verification, explicit language forbidding Play Integrity as the sole trust source. Whether any of that lands in the next spec revision is the thing to watch. If the EU ships this as-is and the pilot countries mandate it in law, the practical outcome is that using a de-Googled phone in Europe becomes a second-class citizenship for a growing list of everyday online activities — and the bloc that wrote GDPR will have quietly built the most locked-down consumer identity system in the democratic world.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.