Also available in:

German politics has a new favourite project: the state digital wallet “D-You”. It is scheduled to launch in January 2027 and is supposed to revolutionise age verification online, among other things. For providers of legal adult content, this initially sounds like a welcome relief – finally a standardised, data-minimising solution instead of the previous patchwork of video identification, bank identification and half-baked selfie checks. But anyone familiar with the recent history of European age-verification projects will be sceptical. Exactly these kinds of “technically ready” systems have already failed spectacularly or at least come under massive criticism several times.

The Big Announcement and the Old Story

The federal government wants to enable reliable age verification with D-You (the German implementation of the EUDI Wallet) from 2027 onwards. Ideally, the app will only confirm that someone is over 18 – without revealing name, address or exact date of birth. For the adult industry, which has been suffering for years in Germany under the Interstate Treaty on the Protection of Minors in the Media and ever stricter enforcement attempts (including payment blocks), this sounds tempting. Finally a state-approved method that is KJM-compliant and ends the endless discussions about “effective” systems?

But reality looks different. Already in April 2026, the EU Commission under Ursula von der Leyen pompously presented an age-verification app as “technically ready”. Open source, anonymous, privacy-friendly – those were the promises. A few hours later, according to security experts and Telegram founder Pavel Durov, the system had been hacked in under two minutes. Durov put it pointedly: First present a “privacy-respecting” solution that is nevertheless attackable, then wait for the hack and afterwards sacrifice privacy in order to “fix” it. The result: a surveillance tool dressed up as child protection. We already reported on this in April – and the concerns were justified.

What Became of the EU Age-Verification App?

Six months later, little remains of the big breakthrough. The “app” is not a finished, EU-wide product but a blueprint – an open-source reference implementation that member states are supposed to adapt and integrate into national systems or wallets. Some countries (Denmark, France, Spain and others) are piloting variants. There is no comprehensive, uniform solution. The Commission continues to speak of “technical readiness” while at the same time relativising that it is a demo that is being continuously improved. Zero-knowledge proofs (the actual data-minimising technology) are planned but are far from reliably implemented everywhere. The widely announced EU-wide solution currently has the status of an ambitious but bumpy project – typical of Brussels digital initiatives.

D-You: Same Promises, Same Risks?

This is exactly where the German D-You wallet comes in. It is intended to offer age proofs as one of the first use cases and to launch in 2027. For adult providers this means: Anyone who wants to operate cleanly in Germany in future will have to connect to the wallet – or at least to comparable systems. This could make compliance easier and reduce the pressure from blocking attempts and payment blocks. At the same time, new costs for technical integration, interfaces and ongoing audits loom.

From the industry’s perspective, the disadvantages and risks clearly outweigh the benefits:

• Security gaps and attackability: Experts are already warning ahead of the launch. Key protective functions such as genuine zero-knowledge proofs and pseudonyms are missing at launch. The architecture is considered centralised and potentially a single point of failure. Compromised smartphones could allow identity misuse. Just as with the EU demo in April, there is a risk that the system is “hackable by design” – and that later “improvements” further erode privacy.
• Privacy risks for users and providers: Even if selective disclosure is promised, data protectionists and consumer advocates fear a “cookie banner 2.0”: services request more data than necessary, profiles are created. For adult platforms that already operate under general suspicion, this is poison. Users might avoid the wallet or resort to VPNs and workarounds – while providers remain liable anyway.
• Implementation uncertainty: The timetable is ambitious, the criticism massive (hearings in the Bundestag show this). Whether D-You will actually function in a data-minimising and secure way at launch remains open. The industry risks investing again in a transitional solution that later becomes obsolete or unusable.
• Further harassment instead of relief: The wallet is likely to become the de-facto standard not only for social media but also for 18+ content. This increases the administrative burden without solving the fundamental problems (international providers without AVS, workarounds). German providers who comply with the rules are once again put at a disadvantage.

Conclusion: Politics on the Subject of Age Verification – a Permanent Issue with Moderate Success

German and European politics have been working on the topic of age verification for years. From the JMStV via KJM proceedings and DNS blocks to the current wallet plans: time and again major solutions are announced that end up half-baked, attackable or bureaucratically overloaded. Success remains moderate – minors still find ways around the rules, while legal providers bear the burden of compliance and image problems.

For the adult industry in Germany this means: D-You will come and increase the pressure for verification. Whether it will actually be data-minimising, secure and practical still has to be seen. The experiences with the EU app from April 2026 counsel caution. As long as politics prefers to build new systems instead of creating practical, technology-neutral and genuinely enforceable rules, adult providers remain the ones who suffer from an ideologically charged, technically often immature youth protection regime. The industry should closely monitor developments, examine its own integration paths – and not be blinded by the next big promises.