You sit down at your Linux machine, fire up Firefox, and want to read a news article. Suddenly, a pop-up demands you scan a QR code with your phone—an iPhone or Android, naturally. Your laptop? Not good enough. Your privacy? Irrelevant. This is the future the EU is building, and they’re calling it ‘child protection.’
Let’s be clear: the EU’s proposed age verification system doesn’t just happen to favor Apple and Google. It’s architecturally designed to exclude everything else. Hardware-bound attestation—a technical requirement that your device must prove its identity using a cryptographic key stored in dedicated hardware—sounds reasonable. But here’s the catch: only Apple and Google have the infrastructure to provide that attestation at scale. The EU is effectively mandating that you must own a device from one of these two companies to access large parts of the internet.
The EU is turning your phone into a government-issued ID badge—and only Apple and Google get to be the ID issuers.
This isn’t a niche Linux problem. It’s a blueprint for surveillance infrastructure disguised as safety. The same system could be extended to verify your age for social media, then your identity for banking, then your ‘trustworthiness’ for accessing news. Once the hardware attestation layer exists, the gatekeepers decide who gets in. And the gatekeepers are two American corporations with a history of anti-competitive behavior.
Let’s talk about the irony. The EU’s antitrust regulators have spent years fining Apple and Google billions for abusing their market power. Now the same regulators are writing rules that require you to use those very companies’ ecosystems. As one commenter on the Linuxiac article put it: ‘Governments enforcing that you have a Google or Apple account to participate in society is transparently absurd.’ The hypocrisy is so stark it’s almost impressive.
But the deeper problem goes beyond anti-competition. Hardware-bound attestation, as currently designed, does not use zero-knowledge proofs or blind signatures. That means your device’s unique hardware ID is exposed to the attestation server. With enough collusion—say, between Apple, Google, and the EU—every website you visit could be linked to a single, immutable device identity. This isn’t age verification. This is the foundation of a permanent digital identity that you can’t escape.
You might think, ‘I have nothing to hide.’ That’s not the point. The point is that the EU is sacrificing digital sovereignty—a principle it claims to champion—on the altar of a quick fix for a problem that could be solved with far less intrusive methods. Age verification doesn’t need hardware attestation. It could work with privacy-preserving tokens, zero-knowledge proofs, or even simple identity federation. But those approaches don’t give Apple and Google a chokehold on the internet.
So what’s really happening? The EU is picking winners. It’s choosing the convenience of a two-company duopoly over the messy, open, competitive internet that made Europe’s digital economy possible. And it’s doing it under the banner of protecting children, which makes any criticism look like you’re against child safety. Never let a good crisis go to waste—especially when you can use it to force everyone into a walled garden.
This isn’t a prediction. It’s a warning. The EU’s age verification mandate is a test case. If it passes, expect the same logic to be applied to everything: voting, banking, social media, even reading the news. Your device will need a ‘trusted’ identity to function. And that identity will be controlled by the same companies that already know too much about you.
What can you do? Raise hell. Write to your MEP. Support organizations fighting for digital rights. And don’t let anyone tell you that this is simply about keeping kids safe. It’s about keeping you in a cage—and making sure only Apple and Google hold the keys.
FAQ
Q: Isn't age verification necessary to protect children online?
A: Yes, but not at the cost of privacy and competition. There are privacy-preserving methods like zero-knowledge proofs that don't require hardware attestation. The EU chose the most invasive, duopoly-friendly option.
Q: Will this actually affect me if I use an iPhone or Android?
A: Yes. Even if you use Apple or Google, you're still being funneled into their ecosystems. The mandate entrenches their control, making it harder to switch to alternatives. And the surveillance infrastructure—linking your device ID to your activity—applies to everyone.
Q: Isn't this just a conspiracy theory? The EU is pro-privacy.
A: The EU's rhetoric is pro-privacy, but its actions increasingly favor surveillance. The Digital Services Act, the eIDAS regulation, and now this age verification—all create centralized identity systems. The road to hell is paved with good intentions.