Durov's Warning: Cracks in the 'Anonymous' Promise

Telegram CEO Pavel Durov warned that the European Union's new age-verification app could become a gateway to large-scale online identity tracking, just days after the European Commission (EC) declared the system technically ready for rollout.

On his Telegram channel, Durov cited analysis from security consultant Paul Moore, who examined the app's technical design and concluded it can be hacked in "under two minutes." Moore added that the system could be bypassed in ways that prevent the age check from being properly tied to the actual user or their device.

Why It Matters: Control Hidden Behind Convenience

The EC unveiled version 1.0 of its age-verification framework in July 2025, billing it as a "completely anonymous" system that lets users prove they are over 18 without exposing personal data. Commission President Ursula von der Leyen insisted users could verify their age "without revealing personal data or being tracked."

Durov directly challenged this claim. He argued that the security vulnerabilities go beyond a technical flaw, warning the app could later be used to justify sweeping identity verification across online services throughout Europe. "EU bureaucrats needed an excuse to silently start turning their 'privacy-respecting' age verification app into a surveillance mechanism over all Europeans using social media," he said.

The stakes are amplified by the app's design: built as an open-source project intended to eventually interoperate with European Digital Identity Wallets, the age-verification tool could serve as a foundational entry point for a far broader digital identity infrastructure.

The Historical Thread: Accelerating Digital Identity Regulation

Europe's push for online identity authentication has been years in the making. The EU launched its Digital Identity Framework in 2021, aiming to build a mutually recognized digital ID system across member states. The Digital Services Act (DSA), passed in 2022, further tightened platform obligations on content moderation and user protection.

Age-verification requirements gained serious momentum from 2023 onward. The UK's Online Safety Act imposed verification duties on platforms; France ordered immediate age checks on pornographic sites; Germany pursued similar measures. The EU sought to synthesize these national experiments into a single technical standard — the result being the app now under fire.

Durov's prominent role in this debate is not without context. He currently faces a judicial investigation in France over allegations of organized crime, fraud, and failure to cooperate with authorities in connection with activity on Telegram. His outspoken defense of platform freedom is thus both a principled stance and one entwined with his own legal circumstances.

What Comes Next [Expert Analysis]

Analysts see three likely trajectories for this dispute.

First, the EC will likely be compelled to redesign the app's technical architecture in response to security criticism. The open-source nature of the framework enables external auditing — but also exposes attack vectors publicly.

Second, age-verification requirements are likely to expand incrementally. While currently focused on confirming users are 18 or older, regulators may push for broader identity confirmation, which is precisely the slippery slope Durov is warning against.

Third, as interoperable digital identity systems proliferate across borders, a single vulnerability could threaten identity data across the entire EU — a systemic risk that grows more acute as the infrastructure scales.

The tension between protecting minors and minimizing digital surveillance is not merely a technical problem. It is a political choice that will define the architecture of European digital democracy for years to come.