Yesterday I saw a very interesting critique from Pavel Durov about that age verification app that the European Union is pushing. Basically, the founder of Telegram pointed out that the tool was hacked just minutes after it was launched. Like, it didn’t even have time to breathe and was already compromised.

What caught my attention the most is that Pavel Durov raised a very legitimate question: this app is marketed as "privacy-respecting," but he’s right to question whether it’s actually the opposite. We know how these things work in practice — when you centralize identity and age verification data, you create a huge target for surveillance. And if they can’t even keep it secure in the first few minutes, imagine when it’s in real production.

Pavel Durov isn’t just anyone saying this. As someone who built a platform focused on privacy, he understands the risks involved very well. His kind of critique touches on a point many people have been ignoring: the difference between what governments say a verification system does and what it can actually do with your data.

It’s a good reminder that privacy and security aren’t just buzzwords — they need to be built from the ground up, not tacked on at the end. And when Pavel Durov points out flaws like this, it’s worth paying attention.