The EU's age verification app—which von der Leyen publicly claimed was privacy-preserving, unhackable, and ready for deployment—was broken in minutes by researchers who bypassed its PIN protection, reset lockout mechanisms, and disabled biometric verification without specialized tools. The app also stored facial images insecurely on users' devices with inadequate deletion safeguards, defeating privacy claims. The gap between what EU officials promised and what the system actually delivered raises concerns about moving sensitive identity tools to public use on the basis of political framing rather than completed security work.