Durov Flags EU Age-Verification App as Privacy Trojan Horse for Mass Surveillance

Telegram CEO Pavel Durov is sounding the alarm on the European Union's new age-verification system, calling it a potential gateway to continent-wide digital identity tracking. His warning cuts to the heart of a growing tension in crypto and tech: regulatory frameworks designed for one purpose often get repurposed for broader control.

The Security Flaw That Changes Everything

Durov cited analysis from security consultant Paul Moore, who demonstrated the EU's age-check app is hackable "under two minutes" after reverse-engineering its technical architecture. Moore's X post was blunt: "This product will be the catalyst for an enormous breach at some point." The vulnerability isn't just about weak encryption—it's fundamental design. The system can be manipulated so age verification isn't properly tied to the actual user or their device, defeating its core function before day one.

This isn't theoretical. Moore's findings suggest the app is "hackable by design," meaning the vulnerability wasn't an oversight but baked into the framework itself.

The Real Play: Mission Creep Into Total Surveillance

Here's what Durov and privacy advocates are actually worried about: the EU isn't building this just for age checks. According to Durov's analysis, once this framework is normalized and deployed across millions of users, authorities will use its existing security flaws as justification to upgrade it into a full-blown identity verification system for all online services.

"The EU bureaucrats needed an excuse to silently start turning their 'privacy-respecting' age verification app into a surveillance mechanism over all Europeans using social media," Durov said in his Telegram post.

The irony? The European Commission launched this in July 2025 explicitly to preserve privacy. President Ursula von der Leyen called it "technically ready" and "completely anonymous," claiming users can prove age without revealing personal data or being tracked. Yet security researchers are already proving those claims don't hold water.

Why This Matters for Crypto and Digital Assets

For crypto investors and traders, this is a warning sign about the broader regulatory landscape. When governments push "privacy-preserving" tech that's demonstrably broken, the real endgame becomes obvious: data harvesting infrastructure disguised as consumer protection. We've seen similar patterns with Know Your Customer (KYC) frameworks and Digital Asset Reporting Requirements (DARR) regulations globally.

The EU's Digital Identity Wallet integration—designed to work with this age-verification system—creates a centralized chokepoint. Authorities could eventually use it to track financial flows, especially crypto transactions, under the guise of anti-fraud measures.

Context: Durov's Ongoing Battle

Durov remains under judicial investigation in France over allegations that Telegram facilitated illegal activity, including organized crime and fraud. His criticism of EU surveillance frameworks isn't just philosophy—it's personal. But his track record as a vocal advocate for free speech and digital privacy gives his warnings weight, especially when they align with independent security research.

Related reporting from Cointelegraph has flagged similar vulnerabilities in other privacy tools, including Signal's push notification infrastructure.