Committee on Civil Liberties, Justice and Home Affairs Ordinary meeting
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
LIBE European Parliament
Follow its sittingsIvo Volman
The user of the credentials that's the issuer of the credentials, sorry the organization that gives the insurance that you're over 18, they can never know what site you visit. So no personal data is stored on the app or shared. So where do we stand with the solution, which is an important one to move forward? On April 15, the commission president announced that our age verification solution is technically complete. All the features are there.
Testing has taken place with online platforms and with users. Now it should be rapidly taken up by member states and by private providers. So it's not available in the app stores yet, but it may be soon. In the meantime, the contractor will continue to issue releases of the software, also taking into account feedback from the IT community. It's open source, so anyone can contribute to make it better, and anyone can also see what the software does and what it doesn't do.
Last week, the commission adopted a recommendation, and that does basically two things. On the one hand, it asked member states to get their act together, to take up this app and turn it into reality in app stores. And secondly, it puts in place a governance system for private sector apps. So we make sure that private sector apps are vetted under this system if they're building on the age verification blueprint. So this solution is also available in certain countries.
And I'm going a bit over time, Chair, if you allow. It's open source, so it can be taken up by them. There's a lot of interest in any meetings with partners from certain countries, they always want to know, well, what is this? We are really interested, and they want to get a demonstration of how it works. So in conclusion, we have made significant progress towards a Europe-wide solution for age verification, the most reliable system of all.
It's following the highest standards in terms of privacy friendliness. And at the same time, it will be an important tool for preventing children from seeing inappropriate content. So we're very happy to further engage on this, and thank you.
Javier Zarzalejos
Thank you. Thank you, Mr. Volman. And now we move to our next speaker, Mr. Vincent Tuiana, Head of the French Data Protection Authority's Digital Innovation Lab.
Vincent Tubiana
Mister chairman, and thank you for his invitation. I'll be
Speaking French, if that's okay. Now Kneel's been involved in age verification from 2021 onwards. That's when we started looking at this following a law that was implemented in France, implementing age verification for porn sites. So we wanted a third party, independent third party, to carry out the age verification. We didn't want it to be the providers themselves to collect information in relation to the users of their websites, and for them to correlate the age to their user history.
Speaker 7
And we very much insisted on the point of data protection, and what kind of guarantees could be put in place, and what could be done in terms of age verification. So we continued with our work in 2022 and started by looking at the state of play of the solutions that were already in existence when it came to age verification. You have the classic solutions, checking ID cards, for example, an ID document with biometrics. There's payment card method, is used as well, but there are also solutions that were emerging at the time where you look at someone's face, and you have age estimation techniques. Basically, we categorized, classified the various solutions, and looked at what their advantages and disadvantages were in terms of accessibility to the population, acceptability for citizens, and also when it came to data protection.
Speaker 6
Now at the time, of course, we came to the conclusion that there wasn't a single solution that provided all of the necessary guarantees for people to be able to prove their age on the Internet without there being any risk to their data. Either the age verification wasn't very reliable for certain categories of the population, or the payment card solution wasn't perfect either, because it wasn't set up for that purpose. And then the ID checks were there. There were risks in terms of these data being accessed, and it's not something that all of the population could use. So we came to the conclusion at the time that there was no perfect solution.
So what we decided to do or try to do is create an ecosystem and to encourage these solutions, privacy-preserving solutions being produced. What also became clear to us is that different types of solutions may need to be combined so that you cover the whole population. It wouldn't just be about making one solution available, people who have a European ID card or have a smartphone, for example. So we recommend in particular to be able to label solutions through a certification system so that these reliable age verification methods can be recognized by users. We also want to inform users about the risks involved in age verification, and want to raise awareness about the types of providers that might be using this.
We then also wanted to develop solutions which are user-friendly. We didn't want centralized solutions which might collect a lot of data. And we also wanted to combine age verification on websites with parental control that might be applied on a smartphone. Now parental control in itself is not a perfect solution either, because it puts a lot of responsibility on the parents. Now to encourage the development of these privacy-preserving solutions, then, we work together with other French administrations and researchers, and we try to set up an architecture that would allow for age transmission, which is part of the commission's proposal and solution, without age transmission allowing the provider to identify the person nor allowing the person providing the age verification to know what that's being used for.
So we had a proof of concept of the architecture. We called it double blind in the sense that neither of the parties has access to information that doesn't regard them. So they only have access to the information they strictly need. So there's the age verification part on one side, and then on the other side, there's the fact that the person has to be of a necessary age to have access to the service. So we had a proof of an open source proof of concept that allowed us to demonstrate that this was feasible.
It's not something that we could industrialize as it stood, but it at least allowed us to come up with this concept, this double-blind concept under French legislation for age verification, and that then pushed people to fine-tune their solutions. We also had exchanges and constant discussions with ARCOM, which is the digital services coordinator in France. And those discussions allowed us to analyze the various age verification solutions. Now on the protection of minors, there we carried out a study among youngsters to try and understand what kind of risk they identify to their privacy rights on social media. We had a qualitative and quantitative study among their parents too.
I'm not going to dwell on this study, but what became clear is that parents have a major role to play as a point of reference for youngsters when youngsters encounter problems online. And what became clear is that for an age verification method to be effective, it needed to have the parents on board in terms of how it's set up and designed, because otherwise, the parents would be the first way around age verification if they weren't included. So we had to raise awareness of that particular point too. Now I know that this is something which is brought up, you know, these risks of circumventing age verification systems using VPNs, for example, and the fact that that might be stigmatizing. Now VPNs are very useful for data protection purposes, but when it comes to social media, the use of VPNs wouldn't really allow you to circumvent the age verification solutions.
So to point the finger at the VPNs is counterproductive because it's not effective in trying to get around the age verification. Thank you.
Javier Zarzalejos
And now I give the floor to Francisco Perez from the Spanish DPA. Senor Perez, can you hear us? Can you see us? Okay. Then the floor is yours for five minutes for your initial presentation.
Speaker 11
Afternoon. Apologies for not being able to be with you physically. I will speak in Spanish, and I can say that from the different meetings that we've had with internet providers, we have seen that putting in technical measures seems to be excessive from a judicial point of view. From our side, we think we need to change the focus. We can verify people's identity in different ways.
Speaker 9
So we don't suggest that platforms have to identify who the user is, but that the user has a minimum required age to access certain content. So, in other words, protection is there by default. When it comes to proving people's age, it's up to the people who access the content. So this means, making sure that people have the minimum age, so being over 14, 16, or 18 years of age, to be able to access specific content. And that's comparable with current restrictions where people's locations need to be identified.
Speaker 10
For example, the idea is simple. Classifying groups of minors can increase their risk of vulnerability. However, in general terms, private companies have different methods. They have access to biometric data, people's documents, or people's search history. This profiles people, but also has a it creates risks for users.
So we don't want to compromise privacy. When it comes to verifying age, it is true that the user can use different documents, passport, etc., or even biometric data. The proposal doesn't negate any of that, but these data should not be shared with third parties, and the user should have exclusive control. The necessary verification can be done for age, for example, without handing over excessive or unnecessary information. And this system would guarantee people's safety, privacy, and not discriminate against them.
It wouldn't involve self-censorship, for example. People have sensitive information, and if a user doesn't want to be profiled, they are better off exercising their right to privacy. In December 2023, Spain set out a number of principles for access to the Internet, with three main objectives: that only those who have the necessary age can access certain content, that they can do it voluntarily when they wish, and that this does not mean that they are profiled. This technique was sent to the European Data Protection Authority, and there was an opinion adopted in 2025. The solutions set out in that opinion allow platforms to comply with the obligations for ditch the DSA as well as GDPR.
In this context, there's a clear distinction between age verification, age estimation, etcetera. Verification means that the user confirms having the necessary age. Estimation could be from their behaviors online or physical traits. However, there are significant margins for error, and that can lead to problems. However, both mechanisms are effective, and they can be incorporated.
There isn't a need then to hand over excessive information. All of this won't resolve all of the issues to do with age verification, but it would improve the current situation with an acceptable level of efficiency. So we're talking about going towards the protection of minors, as well as compatibility with privacy and people's protection of their data. We hope that the national plans that are developed will follow GDPR and respect people's rights, and only identify them when, according to the information that is needed or if they want to access adult content to make sure that they are adults and not children. I was asked about a specific case.
I didn't sign on the sanctions for that specific case that happened a few years ago, the Jote case, but we did focus on looking at the app that was involved in that case and not the providers. The main reasons why there was an issue was because there was an infraction of article nine on GDPR on biometric data. There was no processing of data with the necessary consent. And could you please speak a little bit slower for the interpreters? So, my apologies. As I was saying, there was an infraction of article seven of GDPR because the consent wasn't valid from the users, and information was used for different means.
There was, in article five, was infringed also, because there was excessive use of the data that was collected and that affected people under the age of 14 years. So there was a 900 thousand euro fine given to that platform as a sanction, and we are waiting for the court to give a decision on this case. Thank you, miss. Thank you, sir, for your intervention.
Javier Zarzalejos
The floor to each group representative for a maximum of 1 and a half minutes. Each intervention will be immediately followed by a maximum of 1.5 minutes reply by our guest speaker. As we have three guest speakers, please invite you to be as precise as possible as to whom you address your question. According to the list, we will start by the group's EPP, Mrs. Kinichi.
Thank.
Speaker 13
You, Chairman. Let me also thank our panelists for their presentations. I have a question for Mr. Volmann, on behalf of the commission. Let me start by asking you what, in the commission's view, are the deadlines for making these apps available to member states?
Speaker 12
Is the end of the year a reasonable deadline? Then when it comes to the commission's recommendation, which you yourself referred to, and in particular the reference to the recommendation to make sure that cyber security standards are upheld? Well, that's of course important to protect miners from the risks they might encounter surfing on the Internet. Now, in reference to that recommendation, then, is it the Commission's intention to promote uniform standards on security across member states? And if so, how will you achieve that?
Now looking at data protection at the national level, how should member states deal with this recommendation? There are already good practices in place, but how can they comply with the recommendation on data protection, and what independence guarantees do third parties need to ensure? The commission is recommending here that we need to protect miners from online risks, and that's of fundamental importance because I'm the chair of the subgroup on miners' rights. So it's of fundamental importance, but I'm interested in hearing more from you. Now those are the main points I'd like to make, there are, of course, more points I could make.
Ivo Volman
Yes. Let me start, and thank you for this question. So when will the app concretely be in the app stores? I mean, so we have a number of front-runner member states that are moving fast. France is one of them.
Denmark is one of them. And the apps are likely to be there in the context of the national identity wallets before summer. So things are happening. We have a number of other member states where it will definitely happen before the end of the year. But in our recommendation, we ask all member states to have it before the end of the year, and we are going to push and pull to make this happen.
Now when will there be market players taking this up, our app? We don't know. There is interest, but still there is a question around business models, how is this going to work, etc. So these issues need to be solved. But we would also like private players to take up our blueprint and bring it to the market.
Your question on cybersecurity, very pertinent, of course. Now with the recommendation, we also set in place a system to check the apps, to check them for cybersecurity and also against the specifications of the blueprint. Right? So there will be a check whether, actually, we can say at European level, this is okay as an app that's going to come that will be available to the citizen from a cybersecurity perspective, but also whether it fully respects everything I described in terms of the privacy-preserving character.
Thank.
Thank you very much, chair.
Well,
Speaker 15
I address my question to Mister Volman. It's very good that there should be an age verification based on the digital wallet, because that's the only instrument which fully guarantees good management of data. It allows us to see whether or not a user has a particular age without revealing the name, surname, and date of birth. But I'd like to add to that that age verification is only the start. And so it's not useful to try to construct a fortified door if, however, there can be dangers associated with it.
Speaker 16
We have to make sure that social media generally is a safe place. It's not a question of building walls. So my question is as follows. You explained to us that VPN is not really useful for getting around the checks because VPN actually is for geographical location or to protect privacy. But if a platform in any case wants to have proof through the age verification system, VPN on its own, as you said, is not useful.
Speaker 14
We accept that. But as you have said, we've got other sources, such as parents. So that being the case, how can we guarantee that the adoption of this instrument doesn't give a false sense of security, making the platforms disinvest in the actual active protection of young people? And so I'm coming to my conclusion, chairman. We don't want a situation in which the responsibility falls on the parents.
It's the platforms who have to provide a safe digital space in which no one can get around the system. Thank you.
Ivo Volman
Yes. Thank you for raising these important points. Well, as you rightly say, age verification is only one of the building blocks. What we also need is very vigorous enforcement of the DSA, and that's actually what we're doing. TikTok has had to change its model because of the actions of the colleagues.
There have been letters sent to a number of porn sites, adult content sites that will have to change the way they verify that children cannot get onto the site, and not just because you say, I'm over 18. Right? So there's a whole package of activities around the protection of minors that is taking shape. And, of course, the enforcement actions under the DSA are at the core of that. Now your question about children getting around the age verification app.
If you want to avoid that, well, then you're out of a very invasive system. And that is not what we decided to do. So, by design, we have not tried to make the perfect system. We have made a system that will work well as the first line of defense. But look, take the analogy of buying tobacco or buying alcohol.
Well, children cannot have a system to prevent children from buying tobacco or alcohol in shops, right? But you cannot prevent a parent from giving a cigarette or a bottle of liquor to a child. I mean, that would go very far. And if you want to do that, it would be very invasive. So what we have found here is a system that is not at all invasive from the point of view of privacy.
It really has all the guarantees that only the site can see that the person accessing is over a certain age, right? But we haven't tried to turn this into the perfect system, that would be very invasive. And I think that's the strength of the system.
Jaroslav Bžoch
Thank you very much, and thanks for our guest being here. A few basic questions. I have been here since the very beginning. So if you mentioned it, I'm really sorry about that. If we're talking about the age verification app, where are the data stored?
Is it in the application by the phone, or is it sending data somewhere else? First question. The second question is, if, for example, I have the application, I upload my ID, is the application asking also to upload my picture that the application knows that it's really me uploading that ID? And, also, again, are the data, are the application just itself trying to find out if the data are correct and, reading the documents? Or is this data sent somewhere else to be qualified?
Thank you.
Henko, Mr. Gutsch.
Ivo Volman
Yeah. Indeed. So where is the data stored? There's actually no data stored apart from the fact that you're over a certain age. So there's no data stored on the app at all, apart from the certificate that you're over a certain age.
So that is really important. Now, your question about uploading the picture, there are different methods, actually, to get the certification that you're over a certain age. That are in the basic app. That is possible, right? One is with your digital identity.
Another is by connecting to a trusted app that you're using already, like a banking app, right, that guarantees that you're over a certain age. Then there's the method that you refer to. You can use your passports, scan the passports, and then make a comparison through a little film on your phone. It sounds difficult, but it's actually quite easy. That compares that it's you, and then gives you the certificate that you're over a certain age on your phone.
And you can also go, but that's a very old fashioned method, to a postal office, for example, to get well. I don't think that many people would do that. So all this data is immediately destroyed after you get the certificate that you're over a certain age. So there is no data stored at all, and there's no data sent anywhere. Actually, the app doesn't only guarantee that the sites cannot see who you are. It doesn't only guarantee that the issuer cannot see what you do on the sites.
But even if all the sites collude together, or if there's collusion between the issuer and the sites, then still they cannot find out who you are. And that's this new technology, zero-knowledge proof, that guarantees that. So it's actually stronger even than the double-blind that colleague described.
Javier Zarzalejos
Thank you. Now I have. You see our speaker here. The group of Renault. Is anyone taking the floor?
Speaker 20
Thank you, Chair, and thanks to all the experts for being here. I have a question for the commission. So, you mentioned now that there are multiple ways to prove your identity. So one of them will be a biometric scan after uploading the ID or passport. Would that be one of the ways?
That's one of my questions. And then, how about the platforms? Will they be required to disclose quite openly what kind of method of age verification or age assurance they use? Not just buried in some technical terms, but will the ultimate user know how they're dealing with the age verification issue? And if these systems, if the age verification app makes mistakes, right, because, obviously, it will at some point, what mechanisms will be in place to ensure that the users can challenge the incorrect age assessment quickly and effectively?
Ivo Volman
Sorry. Let me start with the last one because I don't see how the age verification app would make mistakes if it's based on your digital identity or information from your bank or your passport. So I don't think it will make mistakes. That's the strong point. In a very non-invasive way, you actually get very precise information.
And actually, with things like estimation, you don't get that type of guarantee. And there will be things that go wrong in terms of age estimation. Actually, that method is more invasive than what we have put on the table here. Now, this biometric scan, it's one of the possibilities that is offered by the app. We know that there are different practices in the different member states.
So in some member states, this will be possible. In other member states, this will not be taken up as one of the methods. Basically, you scan your passport, the chip, but also the photo. And then you have to make a little film that compares that it is really you. And on that basis, you get the certificate for your phone.
Now, again, will it be possible for a parent to give the certificate to their children and go around the system? Yes. But it's not made to be 100% proof in that sense. It's like, well, the parents giving the cigarettes, right? Now, on the platforms, whether they will be forced to disclose what they use.
Now, of course, there is a strong process in place under the Digital Services Act, under Article 28. They have obligations, and they have to report. But I don't know whether it's an explicit yes. There is. So perhaps, Julia, the DSA expert, can say a few words.
Giulia Varaschin
Good afternoon, everyone, and many thanks for this pertinent question. So actually, the DSA guidelines set out quite explicitly what platforms need to do. So for specific high-risk platforms, think here of platforms selling alcohol, but also pornographic platforms, they need to put in place age verification. Then, for medium risk platforms, such as certain social media websites, they can go for either age estimation or age verification. But in any case, what the guidelines set out is this mere click where you go through the system and you say, I'm over 18 is not enough.
Speaker 25
So platforms cannot do that under the guidelines of the DSA. So the guidelines themselves also set out specific criteria for the methods that they need to use for age assurance. So they set out that they need to be accurate, reliable, robust, non-intrusive, and non-discriminatory. And these guidelines have also been consulted with the EDPB, who also agreed to the high privacy standard that was set out in the guidelines as such. So the guidelines don't specifically set out which age estimation method needs to be used.
Giulia Varaschin
However, they do sort of hold the AV app as the golden standard to do that, and also allow for private solutions to be offered that offer that same level of security. Now we know at the moment, perhaps the level is not yet good enough on online platforms, and that is also why we have a number of open investigations on this. So just last week, we preliminarily concluded that META is not in compliance with the DSA because it still allows minors under 13 on its platform, even though it states itself in its own terms and conditions that they should not be on their platform. Furthermore, we have opened investigations against TikTok on a similar matter, as well as into Snapchat. And we also issued preliminarily that four pornographic platforms are not compliant with the DSA, either because they simply have this click-through system, whereas we require them to have age verification in place.
Speaker 23
So this is really something that is on the top of our mind and that we follow very closely, and we think that the platforms need to do more.
Javier Zarzalejos
Thank you. Now, I give the floor to proof of the screens. Missus, Gregorova, the floor is yours.
Markéta Gregorová
Thank you very much. First, some comments and questions to Mr. Volman. So first of all, you've just mentioned in reply to my colleague, Ms. Ostryonova, that you cannot imagine how facial recognition could be faulty. I was super surprised by this, but because, first of all, facial recognition is famously faulty.
It is racist. It is discriminatory. It's not working in many cases. We also, of course, know, and you just mentioned it yourself, or your colleague mentioned it, that the companies are setting it up in a way that's bypassable. And also, know from the case of Australia where seven out of 10 minors are on social media anyway, that these days, it's super easy to bypass them, for instance, through AI facial filters, which you can apply to both your ID card and your face.
So that's the answer for Miss Ostrejonova, which I'm surprised you didn't give, and you can maybe answer to me why you didn't give it, because you should be the one knowing that. Secondly, I know we are talking about new thing per se, the new for France, not but the new age verification app, but I need to go back to DSA because DSA is stating that minors protection shall not oblige providers of online platforms to process additional personal data in order to assess whether the recipient of the service is minor. But your guidelines on DSA are going against this provision of DSA. Why is that? Thirdly, why don't you prioritize investigations regarding the business models, algorithms, and everything that's still not concluded?
We have DSA. Why do we need another thing that was easily hacked on the first day of its use? I'm sorry, have to mention that, because it was. And, instead, don't focus on the actual toxic business models and algorithms and designs that we should already be able to resolve on the DSA. It just seems like we are afraid to actually use the DSA, which is like a bazooka against the digital platforms.
Why are we just using new ways of giving data to big tech? And yeah, I've already mentioned that. Heck, you can react to it or not. And to Ms. Tubiana in France, Arcom has published recommendations on how to implement age verification in relation to the law enforcing age verification on porn platforms.
And one of the principles in these guidelines is double anonymity, and the fact that this option has to be available for users. Can I ask you how have the platforms complied with this if they did? Thank you.
Ivo Volman
Yeah. So I think I didn't make myself understood on face recognition. Face recognition in itself is not a very sure method. It's an age estimation method that is often problematic and gets to the wrong result. What I did say is actually that the methods used in the app, well, something must go really wrong to get the wrong age.
And I use there the example of the most risky method in that sense. That's when you use your passport, you scan your passport, and then you do a check against that by making a little film of your face, only to get this age certification, this certificate. I think it's two completely different situations, age assurance through face recognition, or what I describe here. Just a few words on what you call the hack. A lot has been made out of that now.
What is out there? The blueprint is not in production. So this is not a service that's on the app stores. Normally, before you go into the app stores, there is a hardening process. That's the work that needs to be done by the member states also, before they put something out there for the public to use.
Having said that, I think it's actually very useful that these comments came in from the community. That's the whole point of open source, that you get these comments, that you can improve. And the consortium has worked on this. A number of things have been patched. And there will be further comments and further releases will be released by the contractor.
Now I think that what will be done further in terms of testing, even this app that's not in production, goes far beyond what you would normally do for a demo app. But then again, I think it's important that when member states do take up the software, that okay, they're already as far as you can get.
Vincent Tubiana
Thank you for the question on ARCOM and double anonymity. And so we've worked with them. And when I was mentioning double blind, it was actually double anonymity. I like both are the same thing. So we've worked with them on defining double anonymity.
And so, since it's the law, well, at first, many websites were not doing age verification at all. So the first step was to do enforcement so that they do age verification, as that has been done. And now most of them do age verification. And so now comes a phase about double anonymity. And so, Arkham has started to do an investment in that as well.
We know that industrials are providing solutions that provide double anonymity. So, it's moving. Not all websites are providing solutions with double anonymity yet, but some of them are, and the solutions to do that exist. So it's a good way, it's moving in the right direction.
Giulia Varaschin
Yes. Just very briefly, as I set out previously, we think actually the guidelines are very much in line with GDPR. We have also consulted on this with the EDPB, as well as done a broad public consultation, which also involved experts on privacy. Now on the DSA as a whole and its enforcement, and this also goes back to Mr. Rutola's earlier point, protection of minors and the enforcement of the DSA is really our utmost priority, and we have taken very concrete steps this year to follow up on that.
So I already mentioned the previous cases before on age assurance. But on top of that, we just took quite extensive steps against TikTok, where we preliminarily found that they actually have an addictive design on their services and do not provide a high level of privacy, safety, and security for minors that is necessary under the DSA. Now, of course, the company has the right to defend itself at the moment. Then on top of that, we have further ongoing investigations on the addictive design of these platforms, including into Meta, which is Facebook and Instagram, as well as Shein and TikTok. And we have numerous other ongoing investigations.
The enforcement of the DSA, especially when it comes to the protection of minors, is really one of our number one priorities. And while we, of course, need to do the most that we can to make sure that these cases that we move forward are also very legally solid, we do everything that we can to also advance them as rapidly as possible.
Javier Zarzalejos
Thank you. I have no speakers from the group of the left or the ESN. Yes, so I give now the floor to Madame Sorel.
Speaker 28
Thank you. Well, I have several questions. The first is for the European Commission, Mr. Volman. Various colleagues have mentioned this, and the question is still not very clear about open source and whether it's going to be improved.
Seems to me there's a problem of trust on the part of the users as regards putting out their personal data. You talk about the destruction of the information. Can we be sure that it will be destroyed? And a second question, the Commissioner Verkunen has said we have to neutralize VPNs. Do you confirm that statement on the part of the Commissioner?
Because your French colleague has said that this is not a big issue, the fact of VPNs. And Mr. Turbiana, a question for you on the fact that each of the parties has only part of the information. How do you check that? You spoke about a study where the people said something about threats.
I'd like to know more about this interesting study. And finally, on parents. I'm a parent. I don't understand why you are so reluctant about this, so sensitive about this. Why cannot we need their cooperation?
You're talking about it being rather cumbersome. Well, but having children means having responsibility. So we have to have the courage to say that.
Ivo Volman
I will start. You're absolutely right that trust in the app is essential. And how can you be sure that there is no data stored? Well, a specialist can go and look at the code of the app, actually, that there is no data stored. That is also a strong point of open source.
You can see what happens with the data, and the data is not stored on the app. So you don't have to trust me, but an expert can go and look at the code of the app.
Speaker 7
Thank you very much for those questions. It's sort of the same thing in terms of how we check the information. We don't collect anything that is not strictly necessary. You have to look at the flow of data that is available, connect to a site, and see how they've collected the information and what data they have got. We can try to do that and see what the connection is there.
Speaker 6
So we do look into that to ensure. On the question of the study, it's on our site, and it's about minors. About 40 young people were studied. And, we also took into consideration the parents. So we're able to have a picture of the application with these young people, these school children.
It's an app which has been launched, and we're very happy about that. On the question now, well, I'm not saying at all that we shouldn't lean on the parents. We shouldn't trust the parents. Not at all. But the easiest solution is, I think, quite natural.
We see that parents don't always understand the risks involved, and they don't necessarily stop the children from connecting. So I can accept that. But the main risk is to make sure we have to make sure that the parents are aware of the risks because it's complicated. You're right. But smartphones as well is something very complicated for a lot of parents who don't have digital literacy.
Javier Zarzalejos
Conclude this first panel. I will take 2 interventions. I will group them together. Mr. Lopez Aguilar, and then Mr.
Juan Fernando López Aguilar
Thank you. For some time, this has been the highest priority for many of us here in the European Parliament, particularly of course in this Leader Committee, which is so keen to fundamental rights, approach to issues that have to do with the protection of minors. So we have discussed thoroughly for years all the age purification strategies and initiatives at hand. And yes, now there is a move by the European Commission, and I would like to ask the European Commission about the timeline to have it effectively implemented. And of course, taken for granted that it's going to be safe under the point of view of the architecture of safeguards to the rights, which are involved and protected.
More than that, what is the idea of enforcement that this age verification tool, age verification application is going to have us compel the platforms to be lower binding, because we have seen also for years that digital platforms do have a business model that has to do a lot with its influence on those who are willing to accept that kind of a game. And the thing is that, of course, parental guardianship is not enough. There has to be also some enforcement by the European Commission as to EU law, so that platforms are actually systematically compelled to implement age verification in a reliable way. Thank you.
Speaker 33
Thank you very much. My speech will differ much from others because, first of all, we talk a lot about the DSA today as it is a great achievement. As a matter of fact, DSA is something that is against the basic human rights of freedom of speech and should never be accepted as it is now, and should be abolished completely, with all the consequences. That's the first problem we're facing today. The second is that we talk about how to protect the children.
Speaker 32
If we want to protect our children, the children of the European nations, we should protect our borders, close them, and make their immigration. That will be the best we can do to protect them, and also to protect women and all the rest inside the European Union. And with this, what we are facing today, I don't see something that will protect the kids. Kids will protect their parents if they speak to them freely, if they make clear limitations. I did it with my three kids, and they're beautiful and have never had any problems, so I'm speaking as a father.
Speaker 34
And, we don't need a state to do this for us. As a matter of fact, I'm afraid that all we are speaking about is just about control, about the ending of the freedom of speech on the Internet as it has been and as it is now. And this is why I oppose this completely and absolutely. Thank you very much.
Javier Zarzalejos
Thank you. You start, Mr. Volmann, and that will be your final remarks.
Ivo Volman
Yes. Let me start with the last point. What we are trying to do is really find a way to protect children in the least invasive way from a privacy perspective. So that's what we're trying to do here. Now, on your question on the timeline, we have a number of front-runner member states that are working on basically having this service available soon.
France and Denmark are the first ones, most likely. Spain also, but later in the year. And there are four others that are among the front-runners. Now we have asked the member states to do it before the end of the year. Not all of them will comply, but that's in the recommendation we issued last year.
So your point about speed, we take that very seriously, and we are pushing the member states. Now last week, in Nicosia, the ministers were there together. And there was convergence that this is really an important action and also a commitment to move. Let's see how fast that goes. On the enforcement, Julia, well, has indicated what we're doing in terms of the enforcement.
Article 28 is there. And the platforms are feeling good. They also know that they have to have reliable measures in place. And if they build on the specifications of our blueprint, they know they're also relatively safe, that this is a good method that will be accepted. So that's why this blueprint and the app are so important, also in view of the enforcement for the platforms.
Javier Zarzalejos
Thank you. Mr. Vienna, would you like to add any final remark? Okay. Mr.
Would.
Speaker 10
You like to add any final remarks? Thank you very much. I think it's very important having listened to the questions from the MEPs. They explained themselves very well. It's very important for everyone to understand how the technology works on both sides, especially given what's happening in Spain through our experience.
All of this is very important, and the tool that's being presented is essential for everything, the Internet as it is, but also how the Internet will evolve in the future. It's very important to protect minors in all domains, in families, in the homes, in Europe from the European Parliament. So thank you very much for listening to our opinion.
Javier Zarzalejos
And now, we obviously thank our speakers for their contribution to this extremely important debate, for the explanations provided in a technical issue, which is not always easy to grasp. But I'm sure that your explanations have contributed to clarify this issue, in which this committee is particularly interested and working on. And now we have to give way to our second panel in the hearing. Well, now let's move then to our second panel, in which we will have the perspective of academia and civil society and industry regarding age verification. The speakers in the second panel would be Professor Kai Radenberg, Chair of Mobile Business and Multilateral Security at Geta University in Frankfurt, Mr.
Simeon De Breuer, Policy Advisor at European Digital Rights, EDRI. Julia Torchio, EU Affairs Officer at Five Rights Foundation, and Mr. Julian Corbett, Head of Open Age Global Initiative. I will first give the floor to Professor Rannenberg from the Goethe University in Frankfurt. So, professor, we have, I mean, four speakers, so we'll have to be particularly careful about the management of the time available.
I'm glad to give you the floor for five minutes for your initial presentation.
Kai Rannenberg
Thank you very much. This is what I've planned. Now this will go in 5 minutes. So I want to give a bit of an overview of the context, even though the discussion has advanced already. I've been advised to concentrate on the app because it is the most concrete thing that we have.
So you will see quite a bit of that. But I think we also need to look at ICT and its application in societal context. And I try to come up with some requirements, which is basically homework for everybody involved. So this is a picture that maybe some of you have seen before, that comes from the invention of zero knowledge protocol elements, which are a good idea. And it comes to and they come to reduce the risks that you see here for identity management, and there's a special case for age verification using third parties because you see a user in the bottom and you see a relying party like a social media.
And the user is not necessarily being trusted by the relying party, but the age verifier may be trusted. And the first solutions that existed were that basically the social relying party would talk directly to the age HBI fire. We've overcome that. That is good. And because the risk with that kind of scenario is that the relying party would know much more than they need to.
And the HBI fire would learn lots of things that they don't need to know, especially how users use social networks. So from that point of view, the wallet is a good idea because it puts power on the user. You see the user now on the top, not on the bottom. And in a way, you can maybe say the edge verification app is a small version of the wallet. And again, using your knowledge proofs, using open source is a good idea.
So much for the good ideas. Now we have statements by the European Commission on the app, and I hope the commission colleague is still around maybe. And I have quoted now statements from April 15, and you see everything is perfect. If you download the app, you prove the age, no problem working on any device, every fully open source, everything, everybody can use it. Like it's technically ready, it was set.
And then you compare that with the edge verification blueprint document that you have, and you try to bring both things together. And so I don't have only five minutes. So this is a list of things which the app actually cannot deal with. You see the two thirds of miners we've discussed that are through their VPNs. Do we now want to restrict the commission because VPNs go around this?
Tweaking biometrics. This is an example, a tax scenario can be my older brother takes gives me the app with their smartphone, and I use a social network. That is clearly possible, and I can manipulate my picture to look like my older brother or vice versa. I'm living in a family with many children. Don't tell me how this does not work.
And borrowed or fake certificates or devices, similar story, and half legal services. So anyway, the question is, what is actually the requirement specification for the app? It's solving a problem that has not been defined. So it's a difficult job to solve a problem that has not been defined. I don't envy the commission, but we need to be careful with statements about it.
So I try to analyze two elements now, quickly. What will the app tell the relying party? And how is that privacy perfect, or does it have an issue? So this is why you find now here an actual verification and relying party. So you find a statement.
The statement says, without revealing any other personal information, completely anonymously. Users cannot be tracked. That is what Ms. Van der Leyen has said. And you look into the specification and you read domain-specific identifiers or pseudonyms are used to enable users to avoid, very nice, but it says pseudonyms.
And now, what is a pseudonym? Are pseudonyms used once or several times, and by whom? If you look into the specification, you find text, you just say something like this, 30 attestations, which are probably these pseudonyms, and they can be given out and can be used by the user. And now the question is, will it happen? Well, how will it work?
And you see that under how far would 30 attestations get users. So if every web page that I call on needs to have its own attestation, many attestations are needed. I'd like to see a robustness test about that. Is it really working out or not? If relying parties are reusing attestations for user journeys on the website, then they can build links between these kinds of things. If relying parties are connecting this to user accounts, then linkage happens like it always did, just with an additional certificate.
So the question is not so much what does the app do, but what does the relying party do with the app? And then, of course, the question is, is a single use of attestation guaranteed? Who guarantees that? Who is the authoritative developer of the app? Well, there is not a European Commission app.
There are several apps because it's a blueprint, which is a nice idea for technical dialogue. And I don't think it's a bad idea to start a dialogue with software, but don't claim it's already incomplete and perfect when you're in the middle of a dialogue. That is an issue. Now the other thing is, what will the app take in? That is the other side.
You see the app on the smartphone, which is an example. These pictures are from the commission, by the way. Only the red thing is on me. And you see the provider EAS notes. Okay.
So they will be coming in like from the EAS notes. And my addition is this little green lady, because it is for the biometric aspect of it that I wanted to add. So the little green lady, you didn't have before. So what is the app taking in? Presentation of a proof of age attestation, an ID card, passport.
So far, so good, that may work. Info to authenticate the app user against anyone else. And here, again, it's a family, sorry. So it says authenticate users in a reliable manner, password, PIN code, biometric verification. Password, PIN code, classical security thing, we can have that.
By the way, it says additional factors. So password, PIN code, okay, we know that. And biometric verification, that is sensitive personal data, special protection is needed. Who decides which variant is used? The biometric storage is already being attacked by somebody.
There are more stores than is needed, and Simon Moore has lined this out in his presentation. And part of it may even rely on the App N platform. So we're coming back to the question: what is the requirement specification? The App status is too unclear to give any assurances at this moment in time, not only because of the App itself but because of the environmental contact of it. So, what is the main issue then?
And if the app is ignoring its context, which it maybe cannot do in the way how it's being developed because it is used, then it can be a problem. If it's promising everything to everybody at the same time, it may become a problem in itself. And the issue that I see from a privacy perspective is that you can have an app which is doing some things, then it doesn't work. Then people will say, we want more data, we want better assurances. Then they collect more data.
Then it will be upgraded. Then people try to find other ways around it. In the end, we're collecting more and more data because data collection is easy and affordable. And the consequences, they are expensive because they have all these side effects that we didn't want to have. And that is a problem when you say we have a solution.
So basically, and this especially holds for, and this is my success example, all my success homework in a way. When you have a controversy in the cybersecurity context, you need to agree on what you want to achieve, then you can develop software. Then you want to test requirements against requirements, but also against unwanted side effects. So the loops that we are seeing, we need more of that, and we need to have them defined in a project plan. And then you need to be prepared for several cycles of this.
And if you consider European digital sovereignty, which I think is also important, okay, digital sovereignty, then you need to check who are the sources for your solution and who has the know-how to do something and to implement changes, for example. And remember the COVID app that we had. In the end, we were depending on Google and Apple to make the design decisions on the COVID app. This time, we have an available platform, which is Android. We have security, which is partly dependent on the Android platform.
We haven't seen it on other platforms. We need to integrate it. So this is homework.
Kai Rannenberg
This is the last slide. This is the last slide. So this was on the software development process, I think, which is important. It's good that one starts software development, but we're not completely there. We have many flaws in it, partly because of software development itself, partly because of the application context.
And then, of course, a political context. There is an offline world. Safe spaces offline is something that we should not forget about. And content providers have a responsibility. DSA was mentioned.
You are the legal people. You know that. And if you put everything to the family, don't wonder if they question it. And the last point of view, don't rely on winning access control fights against your children. Children want something, and when children want something, they get it somehow.
So you need to find ways how you protect children by making them understand, not by restricting them too much.
Javier Zarzalejos
Thank you, Professor Ranenberg. Now I give the floor to Mr. Siméon de Rubier. Please stick to the five minutes allocated. There will be the opportunity for further discussion in the Q and A session following your presentations.
The floor is yours.
Siméon de Rubier
Thank you. From a perspective of fundamental rights, age verification is deeply problematic. It's driving attention away from the real cause of the problem, which is the fact that platforms want to keep users stuck to their phone, stuck to their app all the time, even if it comes at the cost of polarizing, shocking, or addictive content. The real problem is not how early they have access to the app, but how bad these apps are for them. Great.
This is exactly what the DSA is supposed to do, mitigate this kind of risk. Force platforms to adapt their design, their business model, even if it comes to that, as we see in the TikTok preliminary findings. If risks are duly mitigated, there is no need to exclude young people from online platforms or other services. If we take the reverse of that, if we removed young people, we also removed the incentives that platforms have to ensure safety for young people and other users on their platform. Especially in a context where lawmakers are trying to avoid the regulatory border burden, avoiding the unnecessary red tape, I'm not sure why we're adding more rather than trying to enforce and protect the DSA and the GDPR, which are being watered down through other legislative procedures, the omnibus.
Unless the DSA enforcement proves impossible, which we need to give time to, it is disproportionate to ban or exclude young people from the start. Young people, as was pointed out by Kai, do want to access online spaces and other spaces. Why? Not because it's mere entertainment, but because for many of them, it's really important for the life, for the community they built, for the people they find. It can be a lifeline, and we want to cut them off of that rather than make it safe for them difficult.
They will want to bypass whatever measures we put because it's not about smoking tobacco, as we heard the commission compared to. It's about exercising your fundamental rights. And young people, believe it or not, they do have fundamental rights. And they need to be ensured and protected, not restricted. Speaking of them, young people don't want top-down oppressive and restrictive measures.
They want to be empowered. They want to be growing autonomous into adulthood. They want to grow resilient. And I know because I was involved in the collaboration of a piece with young people which was signed by 16 national youth councils and 11 youth organizations representing marginalized groups such as LGBT youth, disabled youth, racialized youth. To quote them, allow me to quote them, when we understand the reasoning behind safety measures and are given meaningful choices, we are far less likely to resist or bypass them.
In any case, we do not want a future where our rights are overridden for our own good, or where online participation depends on one's ability or willingness to provide identification documents or biometrics. As you see in China, Korea, Australia, more than two-thirds of youth bypass age restrictions. It's not because the age restrictions are badly designed. They will always be badly designed. It's because we're cutting them off from something important to them.
It will happen even with the best, most privacy preserving app if it comes to that, if the commission delivers what it's pitched. Because as we heard, yes, the commission itself acknowledges that a parent can give access to age content, app content, sorry, educated content or applications to their child. But it's not only the parent who can. It's an uncle, an older sibling, a cousin, a random person in the street. I could go to the school of my young brother and do the age verification for many of their friends.
No one would know because the commission wants the app to be trusted. Otherwise, we run into mass surveillance. Well, this is what we get. We either get mass surveillance or an app which allows its own circumvention by design. We need to be aware of what we are educating young people from social media, interpersonal communications apps like WhatsApp, and AI.
It the list grows fast when it comes to WhatsApp and other interpersonal communications apps. That's already in scope of a proposal, which is called the child sexual abuse regulation, which is currently in Sri Lanka. And the risk there is that we're not just edge-gating social media. We edge gate app stores. We edge gate WhatsApp, Signal, and other tools like that.
That's why in the parliament position on that file, as you probably know, the parliament's position is to make a verification optional rather than mandatory and to put in place safeguards, strong safeguards. But safeguards, technical safeguards, they don't ensure proportionality. Everybody is still suspect until proven innocent, until proven adults with age verification, and young people will still be excluded. But not only them, also every person who doesn't have ID documents, every person who doesn't have a smartphone with an NFC chip, people who don't have the digital literacy, lots of people beyond children will be incapable of bypassing or jumping through the hoops of the hrefification. Lastly, to conclude, this is about an app, but there will be 27 apps, which may or may not follow what the commission wants them to do.
They may know they may not be as privacy-preserving as they want, as we all want them to do. That's very problematic. And we might think, oh, but the EID wallet will solve that. It is regulated in a way that is privacy preserving. However, if you look at the implementing acts of the EID Wallet.
You should be concluding.
Siméon de Rubier
Yes. I'm concluding. Thank you. The implementing acts show that the commission is adding the processing of biometric data, which was not foreseen in the regulation, which was actually taken out of the text in the trial logs. And the commission is also weakening the principles of linkability, which instead of being prevented, now needs to be hindered.
There are other grounds. I'll stop here. I'll welcome your questions. Thank you.
Javier Zarzalejos
Thank you. And I give the floor now to Mrs. Giulia Torquio, again for five minutes. The floor is yours, Mrs. Tokyo.
Thank you.
Giulia Torquio
It's an honor to be here. For those of you who don't know Five Rights Foundation, we are a children's foundation. So we focus specifically on preserving the rights of children, which essentially is not only the right to protection, but also the right of enjoyment of age-appropriate experiences and of access to information under international law, and specifically the UN CRC and the following general comment number 25. So again, we work on ensuring that kids can access the digital world knowledgeably, creatively, and fearlessly. We have a network of over 300 youths, which we can consult.
And I'm here today to present our position, which is essentially partially built on the consultations that we've had with these kids, and also some findings from our most recent report on age assurance. And I want to speak about age assurance specifically because we've spoken about age verification, and I feel like we have maybe forgotten that there's also a larger umbrella term for that. So I'll start with the definition of age assurance, which is an umbrella term to refer to systems or features that purport to verify or estimate the age or age range, emphasis on the range, of a user. Age verification is one method of conducting age assurance, but there's more than that, and they can be ranked based on the level of implementation, whether it's a browser, whether it's device level, whether it's the service level, but also based on the actual reliability of the service. At Five Rights, we speak about age assurance and not age verification.
In speaking about age assurance, I want to make clear that we don't support a blanket adoption of age-assurance methods. We recognize the fact that they can be useful tools, but they're gateway tools. The main point is what they are gateways to, a safer internet environment for everyone, not only for children. If the Internet environment is safe for everyone, then it's also going to be safe for the children. When that is not achievable, either through the enforcement of our current regulation, whether it's the DSA, the GDPR, the AI Act, or the Audio Visual Media Services Directive, then we need to implement age assurance methods.
Speaker 39
And that's what we're supporting at Five Rights. We have consulted, as I said, our network of kids, and we have produced a report. So I will go over some of the main findings. Essentially, the state of the art is that there are two main issues. There's an issue of implementation at the European level, but there's also an issue of scope.
When it comes to the issue of implementation, we have seen that, and this is based on a recent report that was published through a DSA Coordination Network in October 2025. We have seen that platforms that are mandated under the guidelines and DSA Article 28 and 34 to produce risk assessment reports are still not using the appropriate age assurance methods to essentially perform aid checks for users. And they are then in breach of EU law. And we welcome the commission's preliminary findings against Meta's Instagram and Facebook. When it comes to the scope, however, because the guidelines refer to Article 28 of the DSA, there's a clear gap in the scope of protection.
It only applies to platforms or services that fall under the scope of the DSA, which means that, for example, gaming platforms or other services like AI chatbots and companion do not fall under the scope and therefore are not mandated to essentially apply age estimation, age assurance, sorry, as mandated by the guidelines. So we are here because, again, we believe that age assurance could be a useful tool to protect children online. And we want to see implementation of lawful, effective, and rights-respecting age assurance methods. But also, we want to make that connection. And I guess maybe that goes back to the previous conversations, and also to the questions that were raised in the other session.
We want to make that connection because age assurance is not the end destination. A safer internet environment is a destination, and age assurance is the gateway. Age assurance should also be connected to other conversations about age-appropriate design and implementation of legislation. We believe that there's a real possibility at this moment in time to perform age assurance that is lawful and rights respecting. We have established five criteria for it. So age assurance should be risk-based and proportionate.
Essentially, want to see a better implementation of Article 25 of the GDPR on safety and privacy by design. But we also want age assurance to be proportionate and based on risk assessment reports. And when it comes to kids, that should be child rights impact assessments. Then it should be privacy-preserving and secure, effective as I've already mentioned, accessible and inclusive. And that, I guess, goes to the other points.
We have to realize that not everyone has access to a hard proof of identity, and that will then require essentially layering of different age-assurance methods in order for the online environment to be accessible to everyone. And also, we want it to be transparent and accountable. And when I say we, again, that goes back to kids. This is what kids want. Kids do have an opinion about age assurance, and this is what they want.
At the same time, we want kids and parents both to be included in the conversation because if they are not, they will not trust the AI check methods, and they will find ways to bypass them because kids are smart. So again, I highly encourage you to check out our report. It's very long, but it's very detailed, and also it includes the perspective of some of our work we've done on Australia and other countries. Yes, thank you very much.
Javier Zarzalejos
Thank you. Thank you, Mrs. Tokyo. And now, I give the floor to Mr. Julian Corbett from OPNH Global Initiative.
Speaker 41
you. It's great to be with you. My presentation will be in English to make things easier, but I'm very happy to be here today.
Julian Corbett
Julian Corbett. I head the OpenAge initiative. What is the OpenAge initiative? It's a public interest initiative that was announced just six months ago as an interoperable layer that solves many of the problems we have been discussing today. And we'll touch upon why these intractable problems that we have seen around age assurance are actually not as complex, and we are far closer to real-world solutions than are often discussed.
Speaker 44
There are some important tensions that exist around age assurance in general, and many of them have come up today. We have heard from many of the people asking the questions, as well as people on the panel, the concerns that users rightly have when it comes to privacy, the issues that exist around friction, and the issues around cost. Now there are some principles that are repeated over and over again, and there were some really good ones that were just mentioned before me around what is required for a trusted age signal. Now a lot of these terms were relatively fringe just like a year ago and are now commonplace. Everybody on the previous panel pretty much mentioned the need for interoperability.
Speaker 43
Everybody mentioned the need for privacy preserving, whether it be zero knowledge proof or double blind anonymity. OpenAge as a preview, was actually so the operating headquarters of OpenAge are in Paris, France, and it was actually built by a French company called Opel that literally took what was described by mister Tubiana and made a product out of it, and enabled how to scale up the double blind and an entity approach. But there is a zero knowledge proof approach. Anyhow, the point is that this is becoming a standard agreed minimum standard that should be abided by. Only France has put it into law.
We hope to see other jurisdictions require that standard of privacy. Some of the ones that are less often talked about are the ideas of cross-platform and multi-threshold. It needs to be frictionless. Otherwise, it's going to break the Internet. One of the ones that we believe are really the building block, and so much of the tension exists around this is the, I, the ID, the idea, sorry, of ensuring that it is fundamentally separating digital identity and age.
Julian Corbett
These are two different issues. We come from a world where digital identity is in our passport, and that is what we were presenting. And so the whole notion of age has been caught up in the notion of identity. The online world is very different. For age assurance purposes, not KYC purposes, all we have to do is provide an age credential.
Speaker 43
And this is a fundamental difference. And how do we solve this is the one issue that I want to focus on today, which is portability. Portability is not the one that is really talked about most, but portability is what makes interoperability real. And portability is important because this is what addresses the problem of repeated verifications over again. There is no lack of age signals that exist today.
Julian Corbett
There are plenty of age signals. People have been verified. Everybody in this room has been verified a gazillion times. You are verified at your school. You are verified by the bank.
Speaker 43
You are verified by your telco. These signals exist. The issue is how do we make sure that it is portable. And the idea of portability is that it isn't a technical mechanism. It's a structural shift, transfer of power.
And if you put the user at the center and give them access and use and the right to be able to present their age in a way that they see fit, you completely change the dynamic of trust. I think Madam Sohail was talking about trust. This is such a fundamental issue. This is why everything is broken in the system today, is that we are seeing the lack of trust between where these age signals are coming from. And we are seeing people retain age signals.
And fundamentally, age should not be monetized. This is where we are seeing a problem between tensions on the private sector in the verification industry, wallet solutions that are emerging, where everybody is looking at who owns this age signal, and everybody trying to aggregate in their own silos this age signal. And the reality is that age signals do not belong to the users, to the verifiers who issued them. It doesn't belong to the platforms that require it. It doesn't belong to the operating systems that host it, and it doesn't even belong to the governments that observe it.
A user is the subject of their own age, and they are the ones who should have the control of it. I need one more minute. The fact is all of these age signals exist. How do you make them interoperable? How do you make them reusable for users?
Well, one of the ways that we accelerate that is by making portability mandated. The European Union has an incredible track record of doing exactly this. And every single time, users have benefited from being entrusted with their own data, whether it be from number portability, the GDPR Article 20, all the way through the Data Act. We have seen this over and over again. And this is not theoretical. This is deployed today.
We have over 40 platforms that are using HKeys across multiple territories. We have dozens of millions of usage of HKeys. It reduces friction time by around 30 years for every 10,000,000 usage versus traditional verification methods. It is interoperable with all wallet systems. So like with Google Wallet, we want to work with the EU AV app type solutions.
Anybody that has trusted authentic age signals, allowing that to be portable, placing it within an age key, and enabling users to have control of their age is a solution that is working, that is deployed, that users embrace, that provides age adaptive Internet, and the platforms are adopting already at scale today. I thank you, and I welcome your questions.
Javier Zarzalejos
Thank you. Thank you very much, Mr. Corbett. And now we open the round of political groups. Again, one point five minutes, and then there will be a reply by the guest speaker to whom you addressed your question, also for a maximum of one point five minutes.
So we start with the EPP. Mrs. Kenichi, the floor is yours.
Speaker 12
Thank you, chairman. Again, I'd like to thank all of the panelists for the very in-depth and interesting presentations they've given. I could have many questions, but given the time, I have one question for Professor Randenberg. I must say he was very precise in setting out the details of a complicated system, which is how you can develop software, and what the age verification requirements for apps can be. And you didn't shy away from saying how complex the technology is.
But could I just ask you, in your view, from a legal and technical point of view, could there be mechanisms which, at an upstream level, would prevent people from downloading apps, because they're not old enough to do so and to have an account? So could you have age verification mechanisms at the App Store level already? And in more general terms, how can we make the platforms more responsible so that the mechanisms that they adopt for age verification actually guarantee that the rules will be respected and won't be all too easy to circumvent, or at the very least, very vulnerable to misuse by the user? Thank you.
Kai Rannenberg
Okay. Walter Karnes here. The app stores can be, of course, protected by age verification as good and as bad as any other platform. Let's face it. And that's actually one of the restrictions, of course, of app stores that are relying on certificates because so far certificates exist maybe only for 18 or 16-year-old people. And what do you take as in your 13-year-old?
Do you need to introduce certificates all over the world? That is a problem. My point would be, indeed, age verification has certain uses. We have seen examples on what you can do for age assurance. We should say assurance, not verification, in this case because the technology for verification works but only in a closed world.
So I think your other question is more important. What can we make service providers, platform providers more reliable? I understand the DSA is a good idea. I heard some concerns that DSA is maybe not enforced as much as it could be, and that the application or age assurance or whatever would be an excuse to not do that. I think that would be the wrong way.
And content providers are responsible for the content. Social network providers are responsible for social moderation. And all of that is needed, and that cannot be taken away. And maybe there are some specific scenarios where age assurance can help, but it should not take away the responsibility from those who are responsible for the content. And that means, of course, I need to moderate things.
And that means also, of course, if you want to check how an age verifier is and how an age verification is being used, how it is being used in the context of a certain social platform, which means that social platforms need to collaborate on the way they are going to use age assurance maybe, what successes and nonsuccesses that they have, and what they are aiming for. So they need to be much more explicit in talking to us about it. The commission is putting something out with the limits as I described. They cannot solve the problem on their own, but they can push hopefully and provide us support.
Speaker 46
Yes. Thank you. I'd also like to thank the speakers in this panel, but also in the first panel. When I listen to the discussions, there are two sides. Those who believe in age verification, assurances, estimation, whatever word you use, and the others who say that it's contrary to fundamental rights.
Speaker 47
And at all these discussions, they are sitting on different panels. And at all these discussions, I do see that there is some kind of convergence or coming closer to each other. I belong to the school of professor and. I do not believe that age verification, assurance estimations, will change the picture. We need safe online for everybody.
Unfortunately, we are losing the battle with public opinion. So my question is to professor and to mister Brewer, what should we do to convince parents that instead of shutting everything down, politicians, parents, public opinion, instead of shutting verification, introducing new rules, let's start implementing what we have, and let's do it responsibly. And I also listened to what the other speaker said. On paper, everything's right. Lawful age verification, all the principles that have been listed, enormous studies, but it doesn't work in practice.
Speaker 46
In practice, we have the app that was described by the commission and severely criticized by your panel. So can we really do a product that is safe, secure, lawful, and respects privacy?
Thank you, Missus Kaludan.
Speaker 46
And I know I'm putting you in a bad position. You had just have thirty seconds. I'm sorry.
Professor Rallenberg.
Kai Rannenberg
Okay. So first, I don't think I'm not sure whether we're losing the battle. Actually, I got feedback on my slides from parent organizations, and they'd say, hey. They don't really want to restrict us to the children. That is one point.
The other point is my father always had some experience people cannot be told about. They need to make them. And it is frustrating because it would mean that we would have whatever kind of age and restriction coming in, and then we learn that it doesn't work. Maybe we can learn from the examples of other countries like Australia, UK, where you see the things now. Otherwise, I think it's just patient explanation of the side effects.
We have that all of the time in IT and IT security. I mean, there are scenarios, and that is the other thing. We can see whether we can do some more small-scale trials in some areas where maybe then one can learn better in detail what is happening, to get people together. So it is more of a consensus-oriented Scandinavian solution, make a trial together, see what you can develop if you're open-hearted to learn. Against propaganda, I think you can only report the facts.
That's everything that I have. That was on your question on losing the battle and bringing there was one other question that was okay.
Siméon de Rubier
Thank you. Difficult to answer because I don't have the keys, but I think that if you want to convince parents and politicians that this is not the right direction to take, it suffices to show that this app, if it's the perfect app that we're being sold, is also the perfect app for circumvention. Therefore, not only is it gonna be very ineffective at blocking young people from accessing what they shouldn't access according to our standards, it's also going to be dangerous for what we impose on everyone, what everyone will have to do to prove their identity multiple times. So I think this is the dilemma we face. Either we have mass privacy-preserving age verification, which is circumventable, or we have mass age verification or assessment, which enables mass surveillance.
The choice is easy to make in the EU, I believe. We have to realize that the app will not be as perfect as it's pitched to be, because even the best privacy-preserving, anonymity-preserving censorship tool remains a censorship tool.
Sorry. If I may jump in.
Very briefly,
Julian Corbett
yes. So age verification and age assurance, it does not mean banning. Like in order to create an age-adaptive Internet, one that is empowering for younger generations, you need an age signal. And the issue around how we get that age signal in a way that is privacy-preserving is, I think, what we're discussing. But we have plenty of examples of actually more empowering, more age adaptive Internet that are coming once an age signal is there.
Speaker 43
The issue of banning is, I think, a separate one from the one of how to get an age signal. And the concerns that users have around the failure of age verification is when age and identity are mixed together. But it is incorrect to say that you cannot have age assurance without mass surveillance. It is simply not the case. And hence, why we have solutions such as double-blind anonymity.
And those are proven today to be able to work at scale. And so it's actually happening today. And one, just to illustrate, Open Age Initiative was endorsed by the Free Speech Coalition, which has literally gone to the Supreme Court to fight age verification because when they saw Open Age Initiative, they'd like, okay, well, this is actually a path that actually makes sense in terms of how to do this in a way that is respectful not only of the protection of youth, but the freedom of adults. So let's hope.
Javier Zarzalejos
Thank you. And, yes. Now I don't see any PFE speaker or ECR. Renew group. I take in the floor.
Yep. Madam Chair.
Speaker 20
Thanks to all, the one technical question to Mr. Corbe about the Open Age initiative. So is it, you mentioned you wanted to work with the commission's EID. Have you talked about the working together already? How do you see this cooperation?
Because I don't understand if it is more of a separate technological solution that will be added onto the commission's age verification app, or how would that collaboration work? Have you been in touch with any member states that would adopt your initiative, maybe into their own digital IDs inside their own nation states? Thank you. And then I have a question for Five Rights. Because in Slovakia, we had a survey recently where they were asking young people, mostly teenagers from 12 to 17, whether they would be willing to verify their age in order to get on social media.
And they said the majority, I think over 60%, said yes, at the same time that they will try and some of them will try to circumvent these age verification mechanisms in any way they can. Yet they still agreed in principle with being asked what your age is before going on a certain platform. It ties back to what Mr. Corbet was saying, I think. Do you have any specific statistics like this, or does this come up with your youth consultations?
Some sort of this thinking that, yes, we will try to circumvent, but we are not against it because we are talking about young people, and I think they need to be involved in this conversation. Thank you.
Speaker 43
Thank you so much for the question. So to clarify, OpenAge's product, which is an HKEY, and you could go and create your own at hkey.org and find out about OpenAge Initiative on openinitiative.org, where the APIs are available for everybody to look at. It's something that the platforms implement. And so wherever they are doing age assurance, they offer the option for users at the end of a first time verification to save that as a reusable age key, which is exactly like a passkey saved on your device as a user, and you can represent that elsewhere. And passkeys are already native within every OS and every browser, so there's no app to download, no account to create.
And it is the same secure enclave as you use for accessing your Gmail account or your bank using a passkey. So it sits there on the user's device. And as such, we have around 40 platforms right now that have adopted this and testing not widely in Europe, a little bit in France and Italy, some in the UK, but primarily in territories like Brazil, and there's some big rollouts that are happening in Australia around that. So in terms of the interoperability, we talk with all of the wallet holders, wherever they are. Anybody that has an authentic source of age signal is something that we engage with.
One of the big entities that we work with is schools because parents are desperate to have a solution to be able to provide an age signal for their child to be able to provide an age appropriate experience for them. And in order to do that, they need to provide a reliable age signal and not a facial age estimation that is plus or minus 1,000,000,000 people on the planet Earth, but something that is actually an authentic source that schools have and that parents could optionally use to create an age signal in order to be able to ensure that their children can navigate a safer Internet online. So we talk with everybody to answer your question.
Thank you.
Giulia Torquio
Yes, I can comment on the surveys. As I mentioned, we've done two surveys as a baseline information-gathering process for the report. The first one was specifically on the digital age of majority, and the second one was on age checks. However, the way that the consultations were designed does not allow us for quantitative findings. We only have qualitative findings.
Speaker 39
So I can just maybe go through some of the points. Essentially, children are very concerned about the implementation of age-assurance methods. They report needing to trust the process.
Please speak more slowly.
Speaker 39
Sorry about it. They fear that if age assurance is done directly through the platform, then that will result in a privacy right infringement. They then would prefer to place their trust in third party token mechanisms, and they have reported that they will only respect age assurance if they do perceive it as legitimate. So we do have some sort of findings that are aligned with the ones in Slovakia. So that's why we're saying that we need to, like, keep them involved in the conversation, because then it kind of increases the trust both at the level of kids but also parents, because parents are also fundamental in then circumventing the bans, because they're the ones providing the IDs or setting up the accounts.
Javier Zarzalejos
Thank you. Any other member wishing to take the floor? Yes, Ms. Sippel.
Birgit Sippel
Just a short addition to everything we heard today. To some extent, when my colleague asked, they asked young people if they are ready to verify their age. I think to some extent, that's a wrong question because we all now have to verify with such a system, and we all have always to tell what age we are. So it's not a question only for young people if they are ready to accept. It's a question for all of us.
I also am a little bit concerned regarding the question we talked about age verification, but for what purpose? For what kind of services, platforms, whatever. In the real world, you might say there is a shop only selling alcohol, and you have to prove you are above the age of 18. But do we find such a shop on the Internet? Or is it that providers are offering different services?
And what does it mean once the service is asking for your age? Are they then sending that message to all their services, or how is that working? And I also would like to come back to another question, and I know I should have asked the commission earlier. But I would also like to come back to the question: why the hell do we need to talk about that? We have so much legislation on the table to protect people.
We have the GDPR. We have a privacy. We have DSA. We have the AI Act and a number of other legislations. But, obviously, we are totally weak.
We are not in the position to enforce all these rules, which in itself already would not create a perfect situation, but we heard perfect situations are never there. But it would solve a lot of questions. And I really wonder if we are doing the wrong thing. Instead of enforcing what is on the table, we are thinking about every new legislation, which then again might also not fulfill the task, and it's not only age verification. I wonder why the hell do we need it, it's more a question to the commission.
I'm sorry to put it. Why the hell do we need a Digital Fairness Act? Is the digital world not fair? So maybe because we did not ensure all the other legislation. So I think I remember in the end of last mandate, we said we should not concentrate on having ever more legislation.
We should concentrate on enforcing.
Thank you.
Birgit Sippel
Miss, now we are doing quite the opposite. So maybe you have a solution to come back to the real challenges.
Javier Zarzalejos
Thank you. Thank you, Mrs. Sibel. Well, I give you the floor, yes. Okay.
Kai Rannenberg
bit more time also to think about the question of Ms. Karl Johan now. And I think one element that one can do to try to drive this into some constructive moving forward, of course, is to try to, and there are solution approaches that are proposed on the table, the colleague has just about, and it's a signal thing. Why don't we have a trial to see how this works in one of the more complex social network scenarios? Missipple has just said, hey, there are mixed platforms.
So put a solution to a strong test and see in which scenarios it works, how it works, and what it does. And ideally, do it in a way, of course, that we learn also later for the wallet discussion that we have anyway on the table, and see how that interferes with the wallet implementation, because there were remarks that maybe the wallet implementation is not as privacy friendly as it should be or as nice as it should be from the legislation itself, because the implementing acts may have an issue there. So maybe we can learn something here. Of course, the wallet is much more complex and much should be in something voluntary and not something restrictive, but we can maybe learn something on trying to apply some of these HELOFICATION things on specific areas. And well, why is this coming up?
I can only speculate. I wonder whether somebody has a feeling it's easier for them to get away from the other requirements.
Giulia Torquio
Just on the last intervention, we absolutely agree. We think that the implementation of the current legislation is fundamental. We would like to see GDPR better enforced, as well as the DSA, the AI Act, and the AVMST. And I just want to explain better that, and maybe this has not come across as part of my other remarks, that we believe in banning platforms' access to children and not children's access to platforms. Age assurance should be a fail-safe or some sort of backup plan in the case that, for whatever reason, we're not able to enforce the legislative framework that we currently have.
Speaker 39
But we do believe in that, and we do stand behind it. It's just more thinking about what to do because otherwise, children are not safe online.
Siméon de Rubier
Thank you. It has been mentioned a gratification to prevent buying alcohol or to buy tobacco. I heard the commission as well say. Thank you for bringing that metaphor. I think what we've got talking about here, mostly social media and interpersonal communication services, is really different from tobacco.
Tobacco and alcohol don't allow you or enable you to exercise your fundamental rights, unlike digital platforms. However bad these platforms are, we can make them better instead of banning people or forcibly tailoring some features. I prefer the metaphor of cycling. Cycling is dangerous. Cycling on the road is dangerous.
We don't ban children and young people from cycling on the public road. What we do, we adapt the code, the road code. We adapt the environment. We build cycling lanes so that they and adults can cycle safely. And we also take, besides these collective political measures, we also take measures aimed at individuals.
We teach them. We educate them to not speak to transfers, we give them the right tools, lights, helmets, jackets. In the end, we enable them to exercise their freedom of movement to the scale of the town.
Javier Zarzalejos
But we don't, thank you. Thank you, mister. This is not, again, a new presentation. Please, Mr. Corvette, your final remarks.
Online.
Julian Corbett
Hands are very real. Like, there's a lot of bad stuff that happens out there. And we all, a lot of us here, are parents. This is a conversation that families have at dinner tables all the time now: how to navigate the online world. This is a very real, very pressing issue.
And there's a way of doing this the right way, and there's a way of doing it the wrong way. Banning is not a great way of going in general, and history has shown that. Age-adaptive experience is a much more empowering way of going. Now it doesn't mean that everything should be age-adapted. There is no reason for a child to be able to access porn content.
But yet 70% of children are going to see porn by accident for the first time. Today, the Internet has widely relied on tick boxes of I am over the ages of 13, 15, 18, and that has not worked. And so we need age signals that we can trust. And we need to ensure that these age signals can be presented in a way that is empowering for users, a user-centric solution that they control, that they have trust in, and that separates age from identity. So you know that the only thing that you are passing is an age signal in a manner that is completely unlinkable, untraceable, and that actually respects the fundamental privacy that users should be entitled to expect when they are navigating in the online world.
Javier Zarzalejos
Thank you. Well, he concludes the second panel and this item on the agenda. We thank our speakers for all the information and the contribution they've made to this important discussion. And we now move to our next item on the agenda. Thank you.
Speaker 53
Thank you very much. Well, dear colleagues, let's move on to our next item on the agenda concerning the DRFMG mission to Madrid, to Spain on the fifteenth to the eighteenth of February. A mission that I had the opportunity to chair along with our colleague, Raquel Garcia Hermida Vanderbale. The presentation of the outcome of the report is governed by Article 13, Paragraph one of the COP decision on the implementing provisions governing missions outside the three places of work of the European Parliament of 03/13/2026. And this is the text submitted by the co-chairs.
Javier Zarzalejos
Throughout the visit, discussions with various interlocutors revealed a society deeply engaged in the public debate on justice, corruption, media freedom, and the checks and balances mechanisms. And while interlocutors have not pointed out systemic rule of law backsliding, concerns over a wide range of issues do persist. As Co-Chair of the Mission, I must begin by formally noting that the delegation was unable to meet with the President of the Government, the Minister of Justice, the management of the Public Broadcasting Corporation, and the management of the public enterprises that were invited to meet us. This materially limited our ability to obtain direct explanations, matters of substance, and it is expressly reflected in the conclusions that the Co Chair have drafted. On the main concerns and the main issues that we could detect in the course of our discussions, first, on judicial independence, we must note that Spain has not yet implemented the reform of the General Counsel of the judicial system of appointment of judges, members of the Council of the Judiciary according to the European standards, despite this being a political commitment that was taken up in the course of the negotiations for the latest renewal of the Council.
Also, we received input from the large majority of judges and prosecutors' associations raising concerns about the planned reform of the judicial career and the ongoing reform in the functioning of the courts. On anti-corruption, on the fight against corruption, we could note that public confidence has declined over the last years according to the indexes of Transparency International, an indicator that was mentioned in the course of our discussions, while some recommendations from European instances on lobbying and conflict of interests remain unimplemented. On legislative practice, there is a quite important issue, which is the volume of law decrees that have been approved since 2018: more than 120. And certainly, this kind of source of legislation has a negative impact on democratic and parliamentary deliberation. On the media independence, we met with the news council of the public broadcaster.
We were not able to meet the management of the public broadcasting corporation. And this and we could know the report by this Consejo Informativos, the news council, on the lack of stable funding, politicization of the appointments of the management, and increasingly outsourcing of the production of programs with political content. And also, their remarks and their findings on the ideological bias in this program. So, I would say as a conclusion is that the central challenge identified during the discussions lies not in the absence of formal safeguards, but in the need for broadly supported and stable arrangements capable of strengthening trust, and ensuring that the operation of key institutions remains consistent with European rule of law standards. Apart from that, I do believe that the mission has met its objective of obtaining first-hand information on the recent legal, institutional, and policy developments, in particular in relation to the independence of the judiciary and the effectiveness of the fight against corruption.
And now I would like to give the floor to the co-chair of this mission and our colleague, Raquel Garcia Armida Vanderbally.
Thank.
Raquel García Hermida-Van Der Walle
Chair, I would like to start with a word of thanks to the services of the European Parliament, starting with the secretariat as well as our European Parliament office in Madrid, for the good care and for having arranged this mission in a very successful way. As the chair said, I would also like to start before going on to the conclusions, and I read from the co-chair's report that we regret that key institutional actors, including the president of the government, the minister of justice, state-owned enterprises, and the public broadcaster, were not able to meet and to engage with this mission. And I say this because I truly believe that such exchanges would have contributed to a more complete, again, I'm still reading from the co-chair's report and balanced assessment of the situation. I think that the mission noted a variety of views expressed throughout different stakeholders. And I think that we also have to remark that we can conclude that there is a very lively debate in the Spanish society on topics related to the judiciary, to the fight against corruption, media freedom, and nondiscrimination.
I agree with my co-chair that the discussions pointed out to a rule of law system that remains structurally sound and embedded in a mature constitutional framework, but marked by recurrent institutional tensions and political polarization. While Spain continues to perform comparatively well in successive European Commission rule of law reports, and none of the interlocutors suggested the existence of systemic backsliding across all of the explored areas, we did observe a context of increasing political polarization, which is reflected in the institutional dynamics and legislative practices. We did see formal safeguards in place, but we also noticed and want to note that these developments risk affecting the balance between institutions and consequently, the effective functioning and perceived impartiality of the rule of law framework. In particular, as my Co-Chair said, ongoing debates surrounding judicial governance and institutional relations point to a growing tension that may undermine confidence in the neutrality and stability of the system. And then to end on a very personal note, I have really read very many times the more than 28 pages of tightly written hand notes that I took during the mission.
And I really think that one of the main takeaways is that in order for many of the reforms that have been started in Spain, but not completed, it will be necessary that different stakeholders keep voicing their views in the same way, in openness, in confidence, and trusting the institutions and other stakeholders as we heard in Madrid. So I also think that for me, one of the main takeaways of this mission is that the livelihood of the debate, while not having to turn into complete polarization, will be one of the key elements of maintaining a strong rule of law system in Spain with an open societal dialogue. Thank you very much. And again, thank you to my co-chair for the pleasant collaboration.
Javier Zarzalejos
Thank you, Mrs. Garcia Hermida Vandervalen. Now I will give the floor to the representatives of the groups attending this mission, starting with S and D. Señor Lopez Harilar.
Juan Fernando López Aguilar
Thank you, Chair. According to Rule 56, paragraph four of the rules of procedure, I proceed to the reading of a statement on behalf of my S and D group, which is the second largest group in this European Parliament. The mission report does not fully or accurately reflect what was observed and discussed during the monitoring group mission to Spain held on 16-17 February 2026. Several sections raise serious concerns, as they present a partial and at times misleading account of the information gathered during meetings with the Spanish authorities, representatives, civil society, and academia. Available evidence, including the European Commission's 2025 report on the rule of law and the discussions held with the monitoring group in September 2025, clearly indicates that despite ongoing political polarization and institutional tension, just like in any other open society, just like any other democratic society, Spain's rule of law framework remains robust, structurally sound, firmly anchored in a mature constitutional system with no indication whatsoever of systemic risks.
We firmly reiterate that the European Parliament missions in Member States must be conducted according to strict principles of impartiality, grounded in neutrality and based firmly on verifiable evidence. So we, S and D, members of parliament, therefore withdraw entirely from this mission report.
I'll just add a comment. I've a lot of experience in this field, and I know about consensus and the drawing up of institutional reports. And it's not the first time that I've seen the points that have been added because of the representative of the second largest group in this parliament have not been incorporated.
Juan Fernando López Aguilar
Of the members who went, three were Spanish. So it doesn't surprise me that this mission was instrumentalized, and it's not the first to, which has minimized certain aspects from the meetings with organizations and representatives of the government, for example. We had mention of sexual, reproductive rights, constitutional affairs, also right-wing members dominated this mission. So I just want to highlight that this report does not represent microphone for the speaker, please.
Thank.
Javier Zarzalejos
Thank you very much, mister Fernandez Aguilar. The co-chair wanted to take the floor. Can I also react at the end? Okay then. So I will give the floor to the representative, Bouk Sade from PFE who also went on the mission.
Bouk Sade
Thank you very much, chair. I don't have as much experience as, mister Aguilar, but, regarding this, what was said by the S and D not being incorporated into the report and the instrumentalization of all of this, for example, as is presented, well, we don't agree with all of that. We don't agree with the conclusions of the document. There's a serious risk to the rule of law in Spain. Institutions worry about rule of law when they're not the ones governing them.
Speaker 58
But there is a risk for the rule of law when the president is called and doesn't appear. And members of the judiciary who hide evidence, for example, do not come when they are called. There's a lot of corruption, and it's so obvious because when they're asked for explanations, they don't come. When it comes to the public broadcaster also, and there's an awful lot of propaganda from our government, we started off the mission with the general attorney, which was sanctioned against because of corruption and their political position. And today, we're here talking about this, and Mister Avalos from Sanchez's government was accused of corruption.
Bouk Sade
My question is if this happens in any other place where the socialist government doesn't have power, well, then where are we going to go with this rule of law as is talked about by mister Aguilar? All of this shows that, yes, the report is not completely balanced, by the two co-chairs, and we can't reach a consensus for that reason. And if we don't have consensus, well, then the report isn't very effective. It's very important to highlight all of that emission that starts off with the general attorney being accused of corruption. And then along the way, we have ministers from the government, transport ministers, etc., and from Pedro Sanchez's government.
Speaker 59
We have a corruption case against his wife, and other people around him. And that's the most obvious part that there's a huge risk to the rule of law. Thank you. Thank you. Miss Garcia.
Speaker 60
I just wanted to remind, mister Lopez Aguilar, that I am a Dutch MEP, and there were Spanish MEPs in the delegation. So, what was said here doesn't seem to be appropriate. Thank you. And now, thank you for reacting to that statement from Mister Lopez Aguilar. Article 56, 4 doesn't apply to this type of report.
Javier Zarzalejos
And when it comes to the mission itself, well, the socialist group did participate. And, just like what the co-chair said, when it comes to the conclusions of the report, they are well reflected.
William, now we move to the next item on our agenda. It's point 15 on the institutional aspects of artificial intelligence in the context of European integration. We should be having the presentation of the draft opinion by our reporter, who is not yet in the room. Yeah. Then we can make a break for five minutes, taking into account that this point was scheduled for 5:30, and it is 5:24.
So at 05:30.
Speaker 61
Resume the session. So, dear colleagues, we can resume our session and move on to item number 15, institutional aspects of artificial intelligence in the context of European integration. This is an opinion for the AFCO committee. And rapporteur being Mr. Mandel will be replaced in this session by our colleague, Mrs.
Javier Zarzalejos
Berena Mertens. So, Ms. Mertens, you have the floor to present. Thank you, Chair.
Verena Mertens
You, Chair, and the colleagues. I'm pleased to speak on behalf of MEP Mandel, rapporteur for the LIBE opinion on institutional aspects of artificial intelligence in the context of European integration. MEP Mandel's intention is to provide AFCO with helpful clarifications in the AI Act and other IA-related proposals coming from one of the committees competent for AI in this house. The amendments focus on three priorities. First, competitiveness.
Europe must lead in AI innovation, not just be regulated. The opinion emphasizes the need for proportionate, innovation-friendly rules that avoid unnecessary administrative burdens and that enable European businesses to compete globally. The digital omnibus on AI is a step in the right direction, simplifying implementation and clarifying the data use for AI training. Second, democratic oversight. The parliament must have the capacity to scrutinize AI's institutional impact.
The rapporteur provides additional context and ideas for the consideration of the AI Observatory, building on the existing governance framework such as the IMCoLIBER AI Act working group, and called for AI literacy training for staff and MEPs. Effective oversight requires expertise, and governance requires capacity. Finally, global leadership. The rapporteur welcomes the Council of Europe's AI Convention as a valuable global baseline for rights-based AI governance. At the same time, the opinion emphasizes that EU law already sets a higher standard with the EI Act leading the way.
The rapporteur invites countries worldwide to join the convention, as it aligns with our values and strengthens the global framework. Regular reflection should take place on preventing systematic risks and ensuring democratic accountability at a global level. These amendments emphasize the balance between innovation and accountability, competitiveness and oversight, and European values vis-à-vis global ambition. MEP Mandel looks forward to any feedback and to working together to shape a future where AI serves our citizens and strengthens democracy. Thank you.
Javier Zarzalejos
Thank you, Mrs. Mertens. Now I'll give the floor to present the views to the shareholder operators or those members replacing them, starting with S and D. Is anyone taking the floor? Missus Insir, are you taking the floor? No.
At this.
Jaroslav Bžoch
Thank you, Chair, dear colleagues. There is no doubt that AI and all the relevant aspects of its deployment need to be discussed. This rapidly evolving technology impacts our day-to-day lives as well as institutional processes. Therefore, we need to address the challenges that AI brings in this regard, but we have to be very careful not to overregulate as this would limit further innovation and competitiveness of European AI developers. The current example of good intention but disappointing outcome is the AI Act, which is currently being revised under the digital nexus on AI.
But back to the AFCOINI report and the opinion of Liberapote. To be honest, I find this report way too ambitious in terms of what the EP can legally do under the treaties, setting up a completely new parliamentary body called AI Observatory and expecting it to represent the EP in multilateral forums on AI and within the structures AI board is not something the EP's competence. Given the fact that it is very unclear how this new parliamentary body would be organized and to whom it will be accountable, I cannot support this proposal. On the other hand, if it should be just an advisory service, why create a completely new structure if we already have the EPRS, which is doing a very good job? To conclude, we should stay within the remit of what the treaties allow and tackle the institutional and democratic challenges posed by AI through more elastic and flexible channels.
Thank you.
Javier Zarzalejos
Thank you, Mr. Biot. And any speaker from ECR on this file? Okay. Then renew. The shareholder report, there was Missus Vasco Othello, who is not present.
And I think the same for the Greens, whose shareholder report there is Mrs. Riva, and the left, whose shareholder report there is Mr. Barena. So Mrs. Mertens, would you like to add any closing remark after these?
No, thank you. Okay.
Javier Zarzalejos
Yes. Yes. Thank you for reminding me. In this Libya opinion, the deadline for tabling amendments will be May 18 at seventeen, not seventeen, 05/18/2017 deadline for tabling amendments. And now on item number 16 is presentation to Libya by the European Commission of the Blue Proposal for a Directive on Combating Firearms Related Offenses.
This is the first proposal enacted under the Protect EU strategy for internal security. This proposal seeks to harmonize the penalties associated with the trafficking of illicit firearms across the member states in order to better tackle this organized crime, which acts as a common enabler for other criminal activities. Welcome, Mrs. Floriana Cipala, again, to this committee. And I am pleased to give you the floor as director for internal security at the Home, for a maximum of five minutes to present this file.
Floriana Sipala
Thank you very much, Mr. Chair. And I'm aware that I come at the end of a very long day, so I will make an effort to be concise. And in presenting this very important proposal that is part of a larger landscape on how to improve the security of everyone living in Europe. Illicit firearms pose a serious threat to European security because illicit firearms are enable of violence, are enable of gang violence, and of many serious crimes such as drug trafficking, robbery, or extortion. Moreover, we are also in able to terrorist attacks.
And here, I would like to recall indeed the terrorist attack in 2024 in Brussels targeting Swedish football supporters. Indeed, the role played, unfortunately, by trafficked weapons was important on that occasion. The risk of illicit trafficking of firearms is further amplified by two phenomena. On the one side, the technological developments and particularly the 3D printing, and on the other side, the evolving threats outside the EU border that call for increased EU preparedness. As you all know, the EU has already adopted a number of acts in the area of firearms, but they refer to the legal market of firearms.
What we are doing here, as you recall, chair, is to come for the very first time with a legal proposal, a proposal for a directive, which is based on article 83 of the Treaty on the Functioning of the EU. And it's the first time that the EU will adopt autonomous rules on the criminalization of the trafficking of firearms. Three purposes in this proposal, which I will summarize. First, common definition of firearm offenses and minimum maximum penalties with aggravating circumstances. This is important in order to have a common playing level in all the member states, and to ensure also that some crimes are punished with higher penalties.
Second, improve cooperation and internal coordination within the member states and between member states. For that reason, the proposal established national focal points. Here, we are not inventing something dramatically new because a very large number of member states has already national focal points, but we are not properly equipped or not tasked with the necessary task, we are not mandatory. And here, the step will be indeed quite important, and this will help in having better coordination among authorities in the member states, but also better coordination among the member states. And the third point that is extremely important in this proposal is the fact that, for the time being, we don't have enough data on seized firearms in Europe.
And by improving and having the situation, and by having a common data set on seized firearms, we can really be extremely useful in providing leads that will allow law enforcement to open investigations and then the justice to open prosecutions. This is important. It doesn't exist for the time being, and it will also require that member states have the capacity to measure the number of seized firearms and to share them with Europol. So I will be happy to conclude at this stage by saying that we very much hope that the parliament will receive in a positive way the proposal. We stand ready, of course, to cooperate with Veraportere and with Libbe in your discussion about this text, which again will definitely contribute to improving the security and better protect our communities.
Thank you very much.
Javier Zarzalejos
Thanks to you, Missus Ippala. The rapporteur for this file is Missus Ivaninsir, and I give her the floor for five minutes.
Evin Incir
Thank you very much, Chair. And well, I must say that I agree, of course, on the importance of this proposal, and it is indeed the fact that the illicit use of firearms is a threat to European security. And I think I speak for everyone when I say that it is an important proposal, as it is the first under the internal security strategy, Protect EU, which was presented last year. It is a part of both preventing the growth of organized crime and combating also organized crime and their dangerous activities that have increased in many member states. I come myself from a country where organized crime, unfortunately, has been on the rise for many years, both offline and online.
So we have a big work to do, as in both preventing and combating. The criteria set out in this framework as of the UN protocol of 2001, including now in the regulation, are sound, as I believe firearms should never be considered like goods like any other under the single market. So it's important that we are acting from the side of the European Union and differentiate what is good and what is actually and should not be seen as any other. Considering the development in recent years, including the increasing use of firearms by criminal networks and the growing reliance of organized crime on illicit firearm flows, including also, unfortunately, terrorists accessing. It is indeed timely to define the euro crime and harmonize penalties across the Union in order to address it collectively and avoid foreign shopping.
I have carefully, together with my team, of course, reviewed the impact assessment. It shows that in line with the UN protocol, as well as the regulation and the directive, all member states have criminalized such conduct. But there are significant differences in penalties and prison sentences, ranging from a few months to up to 15 years. So there is quite a lot of need for harmonization also. So it doesn't look too different in the different member states.
And therefore, also to ensure that the proposal becomes a bit clearer before we start our work. I have three questions to start with. The first question, my concern is the main innovation of the proposal, namely the criminalization of the illicit dissemination of blueprints. Is there a way to detect such dissemination online and stop it at the request of a judicial authority as is done in other areas of crimes? My second question relates to the most common offenses reported by the member states, and the level of associated penalties.
In the proposal, the manufacturing, possession and trafficking of firearms, essential components and ammunition appears to be treated equally without differentiating or differentiation in severity. Can you please elaborate on that? How come there is no differentiation? And then finally, I note that not all member states have established a national firearms focal point. What is the current state of play, and what challenges are preventing their effective establishment?
And just to conclude, once again, I think it's a very important proposal. And then I also look forward, of course, to work with the shadows on this proposal as soon as possible because organized crime, unfortunately, is always one step ahead of us, and we need to ensure that we are also rolling up our sleeves on different levels, on local level, regional level, national level and European level. And on European level, we can do what we can, and this is one of the important steps. Thank you.
Thank you, Mrs. Insir. Mrs. Sipala.
Floriana Sipala
Thank you. I will start with the last one. 23 member states have established a national focal point so far in the European Union. And what are the difficulties? First of all, not all of them, and I will say even the large majority of them, are formally established, but we don't have in their mandate all the tasks that are considered necessary to properly deal with this important role of coordination.
There have been plenty of discussions, of course, also with the member states on that. And I think with this proposal, we can really help the member states also in increasing the awareness about the important national focal points. We were already canceled conclusion in 2021, as you know, but they in only by increasing the awareness of their importance and by also ensuring appropriate staffing and up that the appropriate task are allocated, we think that this can help in making the difference. Second question, why is there not a large differentiation between the ammunitions, the firearms, and the other aspects? Because indeed, we have also to consider that it is all this that participates in the construction, in the creation of weapons.
The fact also that the different parts can be trafficked and sold is an incentive for some dealers, because it's easier to transport parts of weapons than the entire weapon. It's, let's say, subject to detection. So we prefer to have an approach that is serious and, I would say, severe, because all this in the end indeed will lead to the availability of illicit firearms for people that are ready to commit crimes, and this is what we wish to avoid. And then I must confess I forgot your first question.
Evin Incir
So the first question was, oh, I did experience about the criminalization of the illicit dissemination of blueprints. Is there a way to detect such dissemination online and stop it at the request of a judicial authority as is just switches off. Is it possible to request the judicial authority stop it at the request of the judicial authority as it's done on some other areas?
Floriana Sipala
Yes. It is possible, and it should be done. We don't have any automatic detection, just to avoid any misunderstanding on this issue, which is very sensitive. But it should be possible at the request of the judicial authorities. And plus, it's also an issue that we can address in our cooperative strand of the work with the industry, with the companies, to make them also more sensible, more sensitive, more attentive to this issue as much as we are doing, for instance, on drug trafficking.
Thank you.
Javier Zarzalejos
Thank you, Mr. Cipalla. And now the round of shadow rapporteurs. We start with EPP, Mrs. Mertens.
Thank.
Verena Mertens
You, Chairman. I'll be speaking German. Dear commission representative, dear colleagues, thank you very much for this proposal. Illegal firearms are a real threat to internal security in the EU on the part of terrorists, violence, and organized crime. Now the fact that we need to cooperate more here in the EU is right, and is necessary.
We in the EPP are clear about this. We need a targeted approach to regulation, and we really need to tackle the problem. And there are four or five points, therefore, of paramount importance as I see it. First of all, the approach to banning blueprints is something we understand, but the current definition, as I see it, is too broad and not every digital data set of components can lead to a fire a weapon that can be fired and therefore shouldn't automatically be covered by the ban. And unless you demarcate that clearly, there will be legal uncertainty, and then legal operators will be harmed rather than criminal structures.
Then certain offenses now come under criminal law, where in the past that wasn't the case. And, again, you need to demarcate clearly. Otherwise, what we support is disproportionate and won't have acceptance. So criminal law needs to be precise. You need to be able to apply it in practice.
Then traceability of weapons, the marking of components of firearms is important and needs to occur on the basis of the existing systems. If we were to set up an additional system, then instead of having increased interoperability, we risk having duplicate structures and simply having more bureaucracy. My fourth point then is to say that the Schengen area basically only works if you have a uniform application. So the provisions need to be so clear that you can't have a different interpretation in every member state, because that will then create loopholes. So that is something we need to avoid.
And in practice, controls are used to tackle crimes with firearms. So you need sufficient resources that are available, and you need specialist investigative teams and increased cooperation within member states and between member states. And we support the objective being pursued with the report, but we need clear legislative definitions which can be applied in practice. And you also need exceptions for authorized stakeholders, and, of course, clear sanctions and penalties that concentrate matters on organized crime. And I have one question at the very end, just very briefly.
How is the commission going to ensure that in relation to Blu Rinse, the criminal provisions are defined in such a way that legal actors do not get caught in the crosshairs?
Mathieu Valet
Thank you, Chair, dear colleagues, representative of the Commission. I'm very happy to see this in France. There's no day that goes by without the use of Kalashnikov, whether that's in Paris or another big city. There is collateral damage from drug trafficking. I've looked into the situation in Europe.
Speaker 71
I was a member of the police before being an MEP. Firstly, when it comes to the worsening of circumstances that things seem to be going in the right direction, I was involved in investigations on organized crime, and that certain weapons can be considered aggravating circumstances. I've seen that in Italy, Germany, and Belgium, etcetera, there are strict rules when it comes to obtaining weapons. But, when it comes to cooperation, there's between member states, there is work to be done. We have Interpol also.
Slowly.
Mathieu Valet
Also, when it comes to Kalashnikovs, which are used a lot in different countries, Belgium, Italy, Germany, etcetera. Over 80% of weapons come from the black market in France, and a lot of them come from Eastern Europe. So it's important to specify that also. Weapons being used in Ukraine can end up coming back to us. And this is something that's very relevant at the moment.
The last point would be differentiating between the use of weapons for leisure, sports, hunting, for example. Of course, we can't mix all of this up, and we can't put them in the same basket as criminals. And we all, I would imagine here, want to tackle crime because it's a huge public concern for Europe.
Beata Szydło
Bartel, Pranjip Shavodny Thompson.
Well, thank you very much, Chair. The proposal is worth noting, and it fits our European security strategy. I fully support actions aimed at fighting illicit trade in firearms and organized crime. And our group ECR has a very clear position on this. Now let me draw your attention to the fact that we must keep the principle of proportionality.
We should avoid overregulating, which would translate into bureaucratic overburdening of our states. Here, we should be more reserved. We believe our priority should be effective implementation and enforcement of existing rules, better cross-border cooperation, and operational support offered to member states. Now I have the following question, please. How does commission intend to ensure that these new regulations will be proportional and will not lead to additional bureaucratic burdens?
I'm talking about reporting obligations and data exchange obligations, article seventeen and eighteen. My next question is what safeguards will you devise and implement so that the new regulations, in particular broad definitions of offenses in articles five and six, have no negative impact on legal uses of firearms. I'm talking about hunters and sports shooters. We want this regulation to be targeting crime and criminals, and not legal regular citizens. Another question: In which member states and their legal systems do you see too much leniency to private and legal entities for trade or trafficking in arms or sales of arms?
Javier Zarzalejos
Thank you, Missus Pesniewski. Mister Asmani? Mister Asmani for renewal. Thank you, chair. I will speak in the Dutch language.
Thank.
Malik Azmani
Thank you very much indeed, Mrs. Sipala, for explaining the proposal to us. We look forward to working together closely with the rapporteur and shadow rapporteurs on this very important directive. It won't have escaped anyone that the use of firearms is on the rise in all our member states. This is true for my own member state, the Netherlands.
The AFD, our security services, has sounded the alarm. Air pistols are increasingly used by criminals who see the authority as a threat. Now a number of member states already have restrictions for these weapons, but we don't have stricter legislation in the Netherlands. So I very much welcome this proposal. And we do need European harmonization so that we can protect our citizens better, because the trade in arms does not stop at the border.
On the contrary, with modern technology, it becomes easier to obtain illegal weapons. So it is our common responsibility to make sure that these weapons don't end up in wrong hands. And as a shadow rapporteur, therefore, I will be in favor of very high standards, strict conditions, and a close exchange of information so that criminals can never benefit from the differences that might exist between our member states. And the question that I have for you today, Mr. Cipolar is about how coordination with Eurojust and Europol and other agencies will operate.
I see in your proposal that you call for closer cooperation between those agencies. And therefore, the question is, how is the commission going to make sure that Europol and Eurojust have the right powers to carry out cross-border investigations into arms and how they can coordinate that? Thank you.
Javier Zarzalejos
Thank you, Mr. Lasmani. And Mrs. Gregorova? I'll take the floor. Missus Gregorova. Yeah.
Markéta Gregorová
Yes. Thank you very much, sir. I will make comments on behalf of the Greens' Ifa Shadow, MEP Hannah Neumann. So illegal firearms are a real threat to people's safety in Europe. They are used in serious crimes like drug dealing and gang violence, and have also been used in terrorist attacks.
What's worrying is that they are getting easier access to these weapons, leading to more violence. At the same time, wars and conflicts close to Europe make the situation worse, as weapons can end up on the black market and find their way into our communities. New technologies are another risk with tools like 3D printing, it is becoming easier to produce firearms and harder to control who has them. That's why as Greens IFA, we supported the goal of this directive, setting minimum rules on criminal offenses and penalties for illegal firearms, improving cross-border cooperation, and strengthening data collection on seized weapons. We do, however, have one key question on the legal basis.
The directive relies on Article 83 and 12 of the Treaty Founding European Union covering illicit arms trafficking, but it also includes possession of firearms and blueprints, and we would like to clarify whether this is fully covered. We will also closely look at whether the proposed penalties are proportionate. Overall, Hana is looking forward to working constructively on this file. Thank you.
Javier Zarzalejos
Thank you. Thank you, Mrs. Gregorova. I think that we have exhausted the list of shadows already appointed, and I give the floor. Yes, Ms.
Garcia Armida.
Raquel García Hermida-Van Der Walle
Thank you, chair. I'm not a shadow. I was just listening very carefully, mister Osmans, our shadow for renew. But I was just wondering one very specific question on data collection on seized firearms in Europe. That's going to be improved.
That's a proposal. But I was wondering if there are any arrangements planned for those countries outside Europe, as we know. And a colleague from the Greens has already said that conflict, and you've mentioned it also in your presentation, that conflict is one of the main sources of illegally trafficked weapons at the moment. We have the experience from the Balkans. I know that Frontex has a lot of attention for this situation already in Ukraine, but I don't know if there's anything foreseen in this directive to address that.
Javier Zarzalejos
Now back to you, Mrs. Ippala. Sorry? You couldn't hear the English translation of Mr. Radev intervention?
Javier Zarzalejos
You would catch what Mr. Radeff has said, if it is not in English. Okay. Thank you. Now back to you then, Ms.
Palla, to reply to interventions of Shaulo, rapporteurs and the members.
Floriana Sipala
Thank you very much for your interest in this proposal. And indeed, I will start by saying that there is no intention with this proposal to touch upon the rules that concern a legal acquisition, possession and trade of firearms in the European Union. But it's a very clear demarcation between this proposal for a directive and the key which exists and that concerns legal trade in the directive 2021 555. So that is extremely clear, and I can reassure you that this is not changing the rules and therefore not affecting the rights of hunters or other citizens that have a possibility under specific authorization, because this is the European Union, not the United States, to possess a weapon. We are very attached to this difference, and everything is done in the proposal to avoid any confusion or interference.
Second, important issue of blueprints, indeed, because this is new and because while we fix definitions of criminal offenses, we don't have to, in an indiscriminate way, touch upon the right of creation and therefore also the economic interest. And what we have done is to introduce these new offenses, indeed related to illicit possession, creation, and dissemination of blueprints. But this will still be possible to possess and share blueprints within the boundaries of an authorization. Member states can decide according to the rules that we have proposed, and that you will examine, if they use the existing dealer authorization or if they create a new authorization specifically for blueprints. So from our point of view, this provision is balanced, but of course, happy to further discuss this with you and with the council in case you think that this is not balanced enough.
Third, Ukraine indeed. We are, as you are well aware of the risk that the situation that was created by the illegal intervention of Russia in Ukraine could create. But let's start from a very clear point. To date, there is no evidence of large scale trafficking of firearms from the bald field of Ukraine. Nevertheless, this doesn't mean that we don't have to be prepared, aware, and active and avoid problems that may arise in the future.
And you have many of you indeed recalled what was created by the situation in the Western Balkans. First, we are already cooperating very closely with Ukraine on this issue. Ukraine has established a new action plan exactly on the traceability and on the prevention of any diversion of weapons that have been and will be provided to the country to defend itself against the illegal aggression perpetrated by Russia. They have already created a national focal point, and they are cooperating with Europol. This, therefore, needs to be continued, intensified, also to be prepared for a possible solution, which is far for the time being.
But indeed, I want to be clear on the fact that this risk is very present also in our mind and also in the mind of Ukraine and of the member states, and that cooperation is already taking place. Fourth point I would like to make concerns the fact that this proposal is a proposal about criminalization and penalties and offenses, but that, of course, as you said, there must also be an intense cooperation at the operational level. Let me recall that within the framework of the so-called impact, the hub where member states, agencies, and third countries alike, like Western Balkans in this case, cooperate, firearms is one of the priorities in the European Union. And this is, therefore, already offering a possibility for common investigations, the creation of joint investigation teams and cooperation among law enforcement in the member states, but also with third countries. But as was rightly also mentioned, Europol and Eurojust must be able to intervene in that.
And it's clear that the incoming proposals that will come in June on the revision of the mandate of the two agencies will allow all of you to see how we propose for these two agencies to intensify their cooperation. I think in a previous occasion, in a hearing moment, I referred to this concept of a continuum between the action of a law enforcement, which is coordinated by Europol, and the coordination of efforts by the justice side that is and should be even more coordinated by Eurojust. So we see indeed the future proposal as a powerful trigger for increase of the cooperation at European level with the support of the two agencies, Europol and Eurojust. Then there was a series of comments that you made about the proportionality and the need to avoid an additional burden. We consider that we paid attention to that also, as you see in the impact assessment, by measuring the impact of the various options.
And we have gone for options that will not dramatically or in a disproportionate way increase the burden for the member states. But let's be clear, for instance, on data collection. And you will see in the impact assessment, because it was one of the problems that we had to face. To date, we don't have a clear picture of the number of trafficked arms in the European Union, and this is not sustainable. And it's not sustainable, not because we need the wonderful reports.
Reports are useful, but it's also not sustainable because without a proper intelligence picture, we cannot have an intelligence-led policy. We cannot have operational activities that are driven by a good knowledge and a good understanding of the situation on the grounds. This is also the reason why we don't intend to create a new system for traceability, but we intend to create a better way for Europol and the member states to be aware of seized firearms and also improve the intelligence pictures. Last point, again, this proposal has been prepared with the usual attention to having a clear definition, clear penalties, the minimum maximum system for fixing the penalties and for aggravating circumstances. Once again, we will be happy in discussing all this with veraportere and with the shadows.
But just to reassure you that we paid attention, as we always do, it is absolutely right what was said. This is criminal law matters. Definition must be clear cut, and confusion must be, by definition, avoided. We hope that you will find our text sufficiently precise on that point as well.
Javier Zarzalejos
Thank you, missus Ipala, for the presentation of this file, an important criminal law file, as you have just mentioned, the first one under the protect your strategy. And thanks to our rapporteur and the shadow rapporteur of this, our parliament, ready to work hard on this important file. We conclude today's session. Tomorrow, we will resume our committee meeting at 9:30. So have a good evening, and thank you all.
Ask anything about this video — I analyse its transcript to answer.