Hi all, April was the month age verification went from political debate to political theatre. We had high-level calls, a half-baked app and legislative procedures that are far from the finish line. There is enormous political momentum, genuine technical difficulty, and a timeline being driven by summits rather than by readiness.
=== Age Verification === The month's centrepiece was a live-streamed heads of state call hosted by French President Macron, attended by Commission President von der Leyen and leaders from 13 other EU countries including Meloni, Sánchez and Merz. Macron framed the moment boldly: "We've already tried parental consent and it didn't work. We chose the ban." Von der Leyen used the occasion to declare that the EU's own age verification app was "technically ready" — a claim that lasted roughly 24 hours before white-hat hackers were posting about holes in the source code. The Commission said the flaws related to a "previous demo version"; researchers said they were testing the latest one. The Commission also set out a new recommendation <https://digital-strategy.ec.europa.eu/en/library/commission-sets-out-common-approach-eu-wide-age-verification-technologies>, reiterating its approach. — The French Senate approved the social media ban for under-15s, becoming the first EU chamber to do so. At the heart of the Senate debate was a familiar tension: the DSA gives the Commission primary responsibility for regulating Very Large Online Platforms and for child protection, but France is legislating bans anyway. France notified the text <https://technical-regulation-information-system.ec.europa.eu/en/notification/27828> to the Commission under the TRIS procedure. A mechanism to notify the European Commission of draft national technical regulations. This will halt the proceedings for a few months. — The French law is relevant to Wikimedia: the text explicitly excludes from its scope online encyclopedias or platforms for developing and sharing free software. This is an important precedent. We will work towards national laws and any eventual EU-level framework following suit. — In Italy, an administrative court annulled an Agcom (the country’s regulator) decision that had required porn platforms — including those based in Cyprus — to implement age verification. The court found that Italy had not followed the procedure required by the e-Commerce Directive: before imposing obligations on platforms established in another member state, it must first contact that state's authorities. The ruling <https://mdp.giustizia-amministrativa.it/visualizza/?nodeRef=&schema=tar_rm&nrg=202600148&nomeFile=202606283_01.html&subDir=Provvedimenti> is a useful reminder that the country-of-origin principle still applies and constrains unilateral national enforcement against cross-border platforms. — Greece has announced plans to end anonymity <https://www.euractiv.com/news/greece-to-ban-anonymity-on-social-media/> on social media, requiring platforms to link all accounts to verified real identities. The initiative is being handled at the highest level, inside Prime Minister Mitsotakis's office. The plan would not eliminate pseudonyms — users could still appear under a chosen name — but platforms would need to know who is behind every account. Critics from digital rights groups have raised serious concerns about freedom of expression and the practical and legal difficulties of implementation. Digital minister Dimitris Papastergiou acknowledged these, and noted he would prefer an EU-wide approach. We currently have no details on the intended scope and which platforms would be encompassed. — Most Wikimedia editors contribute pseudonymously or anonymously. Any mandatory real-identity verification regime, whether national or EU-wide, would be incompatible with how volunteer communities like ours function. We will monitor this future Greek proposal closely. === Meta Found in Breach of DSA on Child Protection === The European Commission issued its preliminary findings <https://ec.europa.eu/commission/presscorner/detail/en/ip_26_920> that Meta's Instagram and Facebook are in breach of the DSA for failing to prevent under-13s from accessing their services. The investigation, launched in May 2024, found multiple specific failures: children can enter a false birth date with no verification; the reporting tool for underage users requires up to seven clicks and frequently results in no follow-up; and Meta's internal risk assessment methodology contradicts EU-wide evidence showing that 10–12% of children under 13 are on these platforms. The Commission benchmarked its findings against the 2025 DSA Guidelines on the protection of minors. Meta’s own terms of use prohibit under-13s from using their services and under the DSA platforms are responsible for enforcing their rules. — The Cyprus Presidency noted that the DSA Guidelines on the protection of minors, adopted under Article 28 DSA in July 2025, will be updated before the end of 2026. They currently state that if a platform hosts pornographic content it should make sure minors don’t access it. === CSAM === The Cypriot Presidency has circulated an interesting document on the interplay between the permanent CSA Regulation currently in the works and the DSA. The Presidency's suggestion is that the CSA risk assessment and mitigation measures would supplement — rather than replace — DSA obligations for Very Large Online Platforms, and that the Commission would be the sole supervisory authority for those obligations. — The Council of Europe adopted a Recommendation on online safety and empowerment of users and content creators <https://search.coe.int/cm?i=09125948802b41e8> this month. It draws heavily on the DSA's framework and approach, stating that systemic risk assessment models as more proportionate than blanket scanning. === German Data Retention Law === Germany's cabinet endorsed a government draft law on IP address retention, which has now been formally published <https://www.bmjv.de/SharedDocs/Gesetzgebungsverfahren/DE/2025_IP_Speicherung.html> by the Federal Ministry of Justice. The draft targets serious crimes including deepfakes, doxing and stalking — digital violence in the broad sense — and obligates ISPs and platforms to record IP addresses for approximately three months. — The key elements are: - Individuals may ask ISPs for the IP address, name (if available) and address (if available) of anonymous accounts. - Individuals will be able to apply to the Regional Courts for such information. To do so, they must demonstrate that an unknown person has committed an infringement and that they wish to bring civil claims against that person. ISPs and platforms will need to hand it over if a judge consents. - IP addresses will have to be stored for a period of three months. There is no obligation to store other types of data in this proposal. === Digital Networks Act === The Digital Networks Act (DNA), proposed by the Commission on 21 January 2026, is making its way through the Parliament. The EP lead committee is ITRE, with MEP Kobosko (Renew, PL) as rapporteur. — As flagged last month, the DNA contains provisions relevant to data retention: it lists retention among the conditions of the general authorisation regime for telecoms (Recitals 44 & 56, Article 9), allows data retention obligations to be set as conditions for EU satellite authorisation (Article 38). Amendments from MEPs and Council could sneak it additional obligations on platforms, so we are watching closely. — The DNA is otherwise primarily a telecoms infrastructure regulation — merging four existing acts (the EECC, the BEREC Regulation, the Radio Spectrum Policy Programme, and core parts of the Open Internet Regulation) into a single directly applicable instrument. Net neutrality rules are carried over largely unchanged. === AVMSD === The Commission will update the Audiovisual Media Services Directive (AVMSD), which contains the editorial rules applying to the broadcasters and, to a certain extent, video-sharing platforms. According to its annual plan, a legislative proposal should be published by the end of the year. In light of this, the Commission launched a public consultation to gather the feedback of the various stakeholders. — The current rules exclude Wikipedia and Wikimedia Commons from the definition of video-sharing platforms and therefore both projects are not subject to the AVMSD specific rules, such as on child protection and on European content. We have responded to the public consultation <https://drive.google.com/file/d/1VuG6o3eLWRjvVIPfr_Ednr2aO11R6KDO/view?usp=sharing> with the specific goal to maintain this exclusion and avoid that Wikimedia project can be encompassed in the definition. ===END=== -- Wikimedia Europe ivzw
_______________________________________________ Publicpolicy mailing list -- [email protected] To unsubscribe send an email to [email protected]
