Thirteen and the Boolean

The EU Kids Act bans infinite scrolling, artificial notifications and engagement-driven rewards for minors, and leaves them in place for everyone older. Ursula von der Leyen fixed the thresholds in her State of the Union address on 16 September 2026: no social media under 13, no personal account under 15, with fines reaching 6 per cent of annual sales. That list of banned features is the Union's own account of what these products do to a person. An age limit is an admission of harm, and this one expires on the reader's birthday.

The threshold was contested until the final week, and the shape of the argument is the tell. The Commission's expert panel recommended 13, a number that sits close to the age most platforms already claim to enforce; France pushed for 15, Spain had asked for 16, Norway is legislating under-16, and Estonia and Belgium refuse age gates and want the product regulated instead. Five numbers for one harm means the number measures how much market a government is willing to close. Meta once agreed to protect minors as far as its competitors agreed to protect theirs, so a public figure is progress; an age limit is still an admission of harm, and the whole debate is about where to draw the line under it.

The age of majority has always been set by whoever wanted something at that age. Twenty-one was the number Europe inherited from the Code Napoléon, and it held for a century and a half until three laws in six years brought it to eighteen: the Family Law Reform Act 1969 in the United Kingdom, the loi du 5 juillet 1974 in France, the legge 8 marzo 1975 in Italy. No discovery about the adolescent brain arrived in those six years. Voting, conscription and consumption changed, which is to say the three things an institution wanted from a young person changed. The Kids Act sets a digital age of majority, and the thing wanted at that age is attention.

Keeping minors out requires knowing the age of everyone who comes in. The Commission's answer is an age-verification app built on zero-knowledge proofs: a government-issued ID establishes the age, the platform receives only the confirmation that a user is above the line, checks are not linkable across services, and deployment is expected across the Union by the end of 2026. It is honest engineering, and it solves a real problem, which is handing the birth dates of six million teenagers to a social network. It solves that problem alone. The privacy it protects is privacy from the platform.

Europe has identity documents already, of course, and nobody here is discovering the civil register. What changes is the errand. The register has until now been the thing you reach for when you deal with the state; from the end of 2026 it becomes the checkpoint for what you do with your evening, continent-wide, at the request of private companies. An identity layer is built once and then it exists. What else it can certify is a question for a future regulation, and a regulation is a great deal easier to write than an app.

The app does not hold. Paul Moore, a security consultant, bypassed the official EU age-verification app in under two minutes in April 2026: deleting values from a configuration file let him set a fresh PIN, the attempt counter sat in an editable file, and the biometric check was a single true/false setting he switched to false. The biometric check was a boolean. Two minutes is roughly the patience of a bored fifteen-year-old, which is precisely the person the architecture was built to stop.

Anyone shipping a product in Europe will implement that check, because there will be no choice, and will implement it properly. It is worth seeing clearly what gets built while building it. The harm stays on the shelf for everyone past the line, and the thing constructed to enforce the line is a register of leisure that no single body owns and every future rule can reach for. The gate falls in two minutes. The register does not.

--

A boolean is a value that can hold two states and no others, true or false. It carries the name of George Boole, who in 1854 set out to reduce reasoning itself to that pair, and it is what programmers reach for when a question has no middle: is this user signed in, is this file open, does this person still have to pass the biometric check. The power of a boolean sits entirely with whoever is allowed to write it. In the EU app that setting lived in a file on the phone itself, and switching it to false told the app the check was no longer needed.