EU age verification in 2026: what the Commission's recommendation and the EU age verification app mean for online shops

There is no new EU-wide age verification law for online shops in 2026. The Commission's recommendation of 29 April 2026 asks Member States to offer the EU age verification app by the end of 2026, a privacy-preserving way to prove "over 18" to online platforms under the Digital Services Act; the age-check duties of shops selling alcohol, tobacco, vapes or knives remain national.

What the Commission decided on 29 April 2026

On 29 April 2026 the Commission adopted a recommendation urging Member States to roll out the EU age verification app quickly. The Commission's news page sets the target: the app should be "available to citizens by the end of 2026".

The recommendation asks Member States to:

1. Build their national app from the Commission's blueprint, standalone or integrated into the European Digital Identity Wallet.
2. Draw up implementation plans and coordinate with their Digital Services Coordinators, other Member States and the Commission.
3. Have the app's cybersecurity checked by independent third parties.

The Commission will also set up an EU age verification scheme with criteria for proof-of-age providers and publish a list of providers that meet its privacy and security standards.

Two points matter for businesses. First, this is a recommendation addressed to Member States, not a regulation or directive; neither page announces a new obligation for companies. Second, the legal anchor is the Digital Services Act (DSA): Article 28(1) of Regulation (EU) 2022/2065 obliges providers of online platforms accessible to minors to take appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors. The app gives those platforms an EU-wide tool.

How the EU age verification app works

The app answers one question: is this user above a given age threshold? According to the Commission, it "enables users to prove they meet a required age threshold without revealing their exact age, identity or any other personal details". The joint press release of 14 July 2025 adds that no one can track, see or reconstruct which content a user consults.

The flow has three steps:

1. The user installs the national app (or uses the EUDI Wallet) and loads a proof of age once, from an official identity source.
2. When a service asks for an age check, the app presents an anonymous proof: "over 18, yes".
3. The service receives the yes/no answer, not the name, birth date or document.

The blueprint uses the same technical specifications as the European Digital Identity Wallets under Regulation (EU) 2024/1183 (eIDAS 2.0), so the proof of age can later live inside the wallet. Denmark, France, Greece, Italy and Spain were named in July 2025 as the first countries to build national apps. The Commission's guidelines on the protection of minors call the wallets and, until they exist, the blueprint "a compliance example and a reference standard for a device-based method of age verification".

Timeline

What it means for online shops selling restricted goods

No new EU duty. The recommendation addresses Member States and online platforms under the DSA. It does not tell shops selling alcohol, tobacco, vapes, knives or 18+ media how to check age; those rules remain national. In Germany, for example, § 10 (3) and (4) JuSchG bans mail-order sales of tobacco, nicotine products and e-cigarettes (including nicotine-free ones and their containers) to minors, and the Federal Court of Justice ruled on 11 March 2026 (I ZR 106/25) that even empty replacement tanks may only be sold online with an age check. Other Member States have their own youth-protection laws, and the UK follows its own path (see FAQ). German readers will find the full picture on our page Altersverifikation für Online-Shops.

A possible extra method later. Once national apps and wallets are live, an interoperable proof of age could become one more way for a shop to check age, if national law and the enforcing authorities accept it for the product in question. Open points: whether the proof covers shipping restricted goods and not only viewing content, whether a check at delivery is still required, and how a shop documents the check.

Today: verified ID is the practical route. Right now the reliable method is an ID document check with face match and liveness detection. The OneGuard platform runs a full automatic check in usually under 20 seconds; the Shopify app and the WooCommerce plugin hold the order until the check succeeds, and unclear results go to a human reviewer. With Face ID a selfie-based age estimate takes under 5 seconds; only customers who are not clearly above the threshold go on to the ID check. Your shop never receives raw images; ID images, selfies and biometric raw data are deleted after 30 days at the latest.

What it means for platforms and marketplaces

The picture is different if you are an "online platform" in the DSA sense. Article 3(i) DSA defines it as a hosting service that, at the request of users, stores and disseminates information to the public. A marketplace hosting third-party sellers or a service with user-generated content qualifies; a shop that only sells its own products does not. The July 2025 guidelines apply to all online platforms accessible to minors, except micro and small enterprises.

If Article 28 applies to you, the guidelines expect "effective age assurance methods" that are "accurate, reliable, robust, non-intrusive, and non-discriminatory". They recommend age verification where adult content such as pornography or gambling is restricted or where national rules set a minimum age for a service, and age estimation where your own terms set a minimum age below 18.

Marketplaces therefore face two layers: age assurance for the platform under the DSA, and product-level age checks for restricted goods under national law. An API-based check such as the OneGuard platform covers both, with webhooks that release an order or unlock a feature only after a successful result.

FAQ

Is age verification mandatory in the EU in 2026? Not across the board. The DSA requires online platforms accessible to minors to protect them (Article 28), and the July 2025 guidelines name age verification or estimation as expected measures in defined cases. For online shops selling restricted goods, age checks are required by national laws such as § 10 JuSchG in Germany, not by a new EU rule.

What is the EU age verification app? An app built by each Member State from a Commission blueprint that lets a user prove they are above an age threshold without revealing identity or exact age. It runs standalone or inside the EU Digital Identity Wallet; the target is availability by the end of 2026.

Will the EU app replace ID checks in online shops? Not in 2026. The app is designed for platforms under the DSA. It could become an additional method for shops once national apps exist and national law accepts the proof for selling restricted goods. Until then, ID verification with face match and liveness remains the practical standard.

Does the DSA apply to my online shop? Only if your shop is an online platform: a service that stores and disseminates user-provided content, such as a marketplace with third-party sellers. A shop that sells only its own goods is not an online platform under Article 3(i) DSA, so Article 28 does not apply; its age-check duties come from national product laws.

What about the UK? The UK is not bound by the DSA or the Commission recommendation. Age checks for online sales there come from product laws, for example the Tobacco and Vapes Act 2026 for vapes. See our guide on age verification for online vape shops in the UK.

This article is not legal advice.

Want to see a verified ID check in action? Try the free demo at platform.oneguard.app/free-id-check or contact us to talk about your shop or marketplace.