I think it does not know. The app is open source and it just sends the Boolean. The government just gives out the id cards - they are not involved in the verification process

I know the whitelabel EU app is open source but are the derivatives going to be? As far as I understand it, every EU country will release its own version of the app.

I am talking about the German AusweisApp:

https://github.com/Governikus/AusweisApp

And it's actually a good thing and not bad. EU version explicitly requests Google or Apple attestation, which at least on Android is astonishing overreach, since theres Hardware Attestation API that can confirm the platform integrity better (instead of confirming old, unpatched handsets with leaked keys are secure, LOL).

Hopefully some countries will do it the correct way.

Not really (as far as the website and the government doesn't collaborate and share information with each other).

AFAIK the EU age verification app works by requesting bunch of digitally signed "proof of age" tokens (openid verifiable credentials) from a government institution and sends (uses up) one when you want to prove your age to a website. The website can check the validity of these tokens without connecting to the government institution.

They are even trying to do some form of blind signature or zero-knowledge proof to have better protections.

https://ageverification.dev/av-doc-technical-specification/d...

Age verification laws are easy to circumvent and they are bad for many other reason though.