The Statistisches Bundesamt published its 2025 road safety figures on Monday. One in six people killed on German roads last year was cycling. The proportion has risen every year since 2015. In 2025 it reached 16.4 percent.
The reason, according to the data, is the motor.
Among cyclists killed in 2025, 61.5 percent were over 65. Among e-bike riders killed, the figure was 67.3 percent. Deaths among cyclists without motor assistance fell slightly, from 250 to 245. The motor appears to be the relevant variable. The Bundesamt did not specify whether the motor was aware of this.
In 70 percent of accidents involving another vehicle, the car driver was at fault. In three quarters of all accidents, the cyclist was not primarily responsible. The Bundesamt noted this. It did not say what should follow from it.
On 15 April 2026, the European Commission announced a mobile application for age verification. The app allows users to prove their age online without sharing personal data with platforms. The Commission described it as privacy-preserving, open-source, and ready.
On 23 April, security consultant Paul Moore bypassed it in under two minutes.
The method: the app stores an encrypted PIN in an editable configuration file on the device. By deleting two values and restarting the app, Moore set a new PIN while reusing credentials from a previous profile. The rate-limiting control was a counter in the same file. He reset it to zero. Biometric authentication was a boolean flag. He set it to false.
The Commission said this was a demo version. Moore said he was testing the latest version of the code.
"This product will be the catalyst for an enormous breach at some point," Moore wrote. "It is just a matter of time."
The Commission said the issue was fixed.
Following the disclosure, European network security researchers published an assessment of the Commission's updated application. The revised version addressed the rate-limiting and biometric authentication issues. The researchers described the updated app as significantly more robust.
Paul Moore was not among the reviewing researchers. He noted this.
The researchers observed that in testing environments, users aged 18-35 demonstrated higher rates of successful bypass attempts of the updated application. Among users over 65, no successful bypass attempts were recorded.
The researchers did not characterise this as a security finding. They described it as consistent with digital literacy patterns across age cohorts.
The app remains available for download.
Usage data from countries with internet access restrictions provides a related comparison. Following the introduction of network-level blocking in Russia after 2022, VPN adoption among users aged 18-35 reached 42 percent. Among users over 65, the figure was below 4 percent.
Similar patterns have been documented in other jurisdictions with comparable restriction regimes.
The Commission's age verification framework was designed to check whether a user is above a minimum age threshold. The bypass data suggests a secondary observation: the demographic most likely to be subject to age-gated restrictions is also the demographic least likely to circumvent them.
A document obtained by The Prompt, circulating among EU transport and digital infrastructure working groups, proposes extending the age verification framework to e-bike motor control. The Prompt has seen it. It has not been published.
Under the proposal, the bicycle's motor assist system would query the age verification application before engaging. The application would return a permitted speed value. The bicycle would not exceed it.
The document describes the architecture as building on existing EU digital identity infrastructure. It notes that the age verification framework is extensible to mobility applications. It does not reference the security incidents of April 23.
Professor K. Glasskügel, Vienna Institute of Applied Systems Analysis, was asked whether the Commission's age verification framework could be applied to e-bike motor access.
"The architecture is extensible in that direction," he said. "That is what extensible means."
He was shown the consultation document. He said the architecture described was consistent with what he would expect from the framework. The speed-return mechanism was technically straightforward.
He was asked whether the Commission had considered this application.
"I am not in a position to speak for the Commission," he said.
The Prompt asked the European Commission whether a mobility verification extension had been considered, given Monday's fatality data. The Commission confirmed that the age verification app's security issues had been resolved.
The Prompt asked again about e-bikes.
The Commission did not respond to the second question.
The consultation is ongoing. The proposal has not been placed on the legislative agenda.
Sources familiar with the committee process say the regulation has encountered resistance within the European Parliament. The nature of the resistance has not been formally characterised.
The proposal's target demographic -- riders above a maximum age threshold -- is also well represented among current members of the European Parliament. Whether this constitutes a conflict of interest is a matter for the Parliament's legal service. The legal service has not been asked.
Several parliamentarians with documented interest in transport regulation are over 65. Their positions on the proposal are not on record. The proposal is not yet on the agenda.
One parliamentarian, reached informally, said they had not seen the document. They were asked whether they would support age-limiting e-bike motor assist. They said they would need to review the evidence.
They did not ask for it.
As R. Voss of Hartfeld Group plc observed in a recent interview with this publication: "The infrastructure question is always the same question: who controls the pipe."
He was not asked about e-bikes. He did not raise the subject. The motor was not discussed.
The Statistisches Bundesamt data covers 2025. The EU age verification app covers 2026. The motor assist boolean is currently set to enabled for all ages.
This is a default value.
Default values can be changed. The config file remains available in the repository.
Sources: Statistisches Bundesamt (PD26_N025_461, 27 April 2026); EU Commission age verification app (announced 15 April 2026); Paul Moore (@Paul_Reviews, 23 April 2026); Politico EU (23 April 2026); European network security researchers (post-disclosure assessment, April 2026); VPN usage data: Roskomsvoboda / independent monitoring, 2022-2026; EU transport working group document (consultation draft, obtained by The Prompt); Professor K. Glasskügel, Vienna Institute, reached for comment.