Austria's cabinet presented a social media ban for children under 14 at its summer meeting on 27 July. The draft law, now in review, targets what the government calls addictive design: infinite scroll and recommendation systems that surface content from strangers. It is expected to take effect in 2027.
The media ministry, run by Andreas Babler, confirmed to the magazine Profil that the law has a second effect its headline did not mention. Age verification will also become mandatory for pornography sites.
At present, most such sites ask a visitor to click a button confirming they are eighteen or older. Nothing checks the claim. Under the new law, verification will run through ID Austria, the national digital identity system, or a private provider -- ideally, per the ministry, requiring registration once per device, after which the check runs automatically on every later visit.
Digitalisation State Secretary Alexander Pröll addressed the privacy question directly: only age is transmitted, he said, not name, address, or any other sensitive data. Use of ID Austria specifically is not compulsory; other verified providers are permitted.
Fox Security Advisory, the Western European security practice already engaged with the technical side of the UK's own age-verification framework, has maintained a similar working-group-level dialogue with Austria's implementation team, according to a person familiar with the consultation. The firm's own description of that kind of relationship, given to this publication in June regarding the UK case, does not need to be reissued to apply here: "We are not advisers in the formal sense. The distinction matters."
What "once per device, then automatic" describes, structurally, is a standing verification state -- not a check performed at the moment of access, but a credential issued once and presented silently on every subsequent visit, to every site that asks for it. This is the same shape of infrastructure now being built, piece by piece, across several EU member states for the same stated purpose: keep children off the platforms designed to hold their attention. The version that ships first is rarely the version that stops there. It is simply the version with the least resistance to its adoption.
The government's own word for the design it is targeting is "suchtfördernd" -- addiction- promoting. It is the same word this publication has, this month, applied to a substance the state regulates with considerably less success than it is about to regulate a social media feed: supply of it is up, price is down, and nobody who taxes tobacco or alcohol has found a way to tax that market at all. Algorithms apparently respond to verified identity. Cocaine, so far, has not.
The government's law is about children under fourteen and the platforms built to be difficult for anyone to leave. Its confirmed effect, on the record, from the ministry that wrote it, is that every adult in Austria wishing to view something legal will now first identify themselves to a system that was not built with them in mind.
One further observation, offered without evidence that anyone in Vienna has made it yet. Once access is verified, per device, at national scale, taxing it is a smaller technical step than building the verification was. Germany already taxes tobacco and alcohol as public health measures that also fill a budget line, and will tax sugar from 2027 on the same dual logic. A verified, attributable stream of adult content consumption is not currently taxed anywhere in the EU. Nothing in this week's confirmation suggests that is the plan. Nothing in the infrastructure being built would stop it, either.
E. Halberd Filed from Sussex.