the EU is working on a system for age verification that won't identify you to the platform. The details are of course complicated, but you can imagine an openid like system run by the government that only exposes if you're old enough for Y.
The platforms asks your government if you're old enough. You identify yourself to your government. Your government responds to the question with a single Boolean.
You don't need to, that's the thing. The site requests "are you over 18" and you use your ID to prove it without them getting any other information from it. Requires a phone with NFC, but the app is open source
I think that ends up being a more difficult problem than just open source. There will have to be some cryptography at play to make sure the age verification information is actually attested by your government.
It would be possible for them to provide an open-source app, but design the cryptography in such a way that you couldn't deploy it anyway. That would make it rather pointless.
I too hope they design that into the system, which the danish authorities unfortunately don't have a good track record of doing.
And the reference implementation requires google play integrity attestation so you are forced to use a google approved device with google approved firmware and a google account to download the application in order to participate. Once this becomes implemented, you are no longer a citizen of the EU but a citizen of Google or Apple and a customer of the EU:
How does the site verify that the ID being used for verification is the ID of the person that is actually using the account? How does the site verify that a valid ID was used at all?
If the app is open source, what stops someone from modifying it to always claim the user is over 18 without an ID?
*Only for Google Android and Apple iOS users. Everyone else who don't want to be a customer of these two, including GrapheneOS and LineageOS users, will have to upload scans of identity papers to each service, like the UK clusterfuck.
Source: I wrote Digitaliseringsstyrelsen in Denmark where this solution will be implemented next year as a pilot, and they confirm that the truly anonymous solution will not be offered on other platforms.
Digitaliseringsstyrelsen and EU is truly, utterly fucking us all over by locking us in to the trusted competing platforms offered by the current American duopoly on the smartphone market.
Why? It's not because a hardware token based solution that will work on desktops is technically impossible, but they literally wrote me that they have no plans to investigate the possibility of offering that. This is officially the plan for the permanent solution.
The platforms asks your government if you're old enough. You identify yourself to your government. Your government responds to the question with a single Boolean.