Digital Services Act (DSA)
In effect
Feb 17, 2024
The DSA is the EU's baseline platform-regulation instrument. The Commission has used it to press very large platforms on minors' protection, opening proceedings and issuing guidelines that push services toward age assurance without a single bloc-wide age-verification mandate. Enforcement runs through the Commission rather than the member states. Milestones: by Apr 30, 2026 major platforms had to demonstrate how they enforce age restrictions, and the Commission signalled a possible dedicated legislative initiative on age verification as early as summer 2026. Non-compliance exposure runs to 6 percent of global turnover. The UK's experience is the caution attached to all of it: mandatory age verification there produced a 1,400 percent surge in VPN sign-ups within days.
Source ↗
EU age-verification app (white-label)
Pending
Announced Apr 2026
In April 2026 the European Commission announced a privacy-focused age-verification application that confirms a user is over an age threshold without handing identity data to the platform. It is designed as a white-label app member states can adapt, and is expected to fold into the EU Digital Identity Wallet. It is the bloc's answer to the criticism that national age checks force ID uploads to private companies.
Source ↗
EU Digital Identity Wallet (eIDAS 2)
Pending
Expected before end of 2026
The EU Digital Identity Wallet is expected to launch before the end of 2026, offering user-controlled, privacy-first credentials interoperable across member states -- and the intended carrier for age attestations. Analysts note the model only becomes a genuine global standard if a credential issued in one country works in another, and that cross-border coordination does not yet exist.
Source ↗
EU data-retention framework
Proposed
Proposal expected H2 2026
Two tracks, neither an adopted restriction yet. First, the data-retention framework proposal still expected in H2 2026 -- the question that decides whether no-log VPNs can legally operate in the single market. Second, the age-verification track: the Commission's May 2026 recommendation asks member states to ensure robust age-verification services by December 31, 2026, built on the EU blueprint and the Digital Identity Wallet, and Commissioner Henna Virkkunen -- asked directly whether VPNs undermine the system -- said preventing circumvention is 'an important part of the next steps.' A European Parliament research briefing has floated limiting VPN access to users above a digital age threshold, and warns of a drastic rise in VPN use to dodge age checks. Virkkunen's office and the Commission insist there is 'absolutely no crackdown on VPNs' and the briefing is analysis, not policy -- accurate as far as it goes, but the direction of travel is that Brussels now discusses VPNs primarily as circumvention software rather than as privacy infrastructure.
Source ↗
AI Act Article 5 -- biometric surveillance ban
In effect
Feb 2, 2025
The AI Act bans real-time remote biometric identification (live facial recognition) by law enforcement in publicly accessible spaces, with narrow exceptions; the prohibited-practices rules took effect February 2, 2025. Enforcement is contested -- rights groups argue Hungary's 2025 law using facial recognition to identify Pride participants breaches it, and the Commission has been slow to act.
Source ↗
