For most of the internet’s life, an email address was enough to become somebody online. That assumption is being dismantled, and not by a single dramatic law. It is going piece by piece: age verification here, a banking directive there, a national eID rollout somewhere else.
Some sectors are already fully through the transition. Reaching casino slots at Twinsbet in Lithuania, for example, requires confirming your legal identity against a state-recognised credential before you can see anything, and the same applies before a first deposit and a first withdrawal.
Four methods are accepted, which is a useful illustration of how a mature identity stack is layered. A user verifying with Twinsbet can use Smart-ID, the mobile signature, a bank login through Swedbank, SEB, Luminor, Artea, Citadele, Urbo or Revolut, or upload an identity document with a selfie for manual review. The first three resolve in seconds or minutes. The fourth takes about a day.
Smart-ID and mobile signature are not bank products
This is the detail most write-ups get wrong. Smart-ID is operated by SK ID Solutions. The mobile signature runs through mobile network operators together with the Centre of Registers. Neither is a bank service, even though banks accept both.
That separation matters architecturally. It means the identity layer is not owned by the financial sector, so a service can accept a verified identity without a banking relationship existing. It is the difference between an identity system and a payments system wearing an identity system’s clothes.
Why Lithuania is the reference implementation?
Lithuania ranks sixth of 37 countries in the European Commission’s eGovernment Benchmark on 86 points. Its score for key enablers is 94, second in Europe, and its e-ID score rose from 89 to 94 against an EU average of 71. Around 72 per cent of residents use digital public services.
The commercial side followed. The country hosts 248 fintech companies, 231 of them in Vilnius, employing 7,800 people and serving roughly 40 million customers across the EU. It holds more fintech licences than any other member state. Electronic money and payment institutions turned over 166 billion euros.
None of that happens without a working identity layer underneath. Onboarding cost is the binding constraint on financial services, and a country that solved it early got a sector out of it.
The regulatory push is now general
Age verification is the wedge. Australia’s under-16 social media ban took effect on 10 December 2025 and had removed or restricted 4.7 million accounts within five weeks, with fines up to 49.5 million Australian dollars.
The European Commission announced a Digital Fairness Act on 12 May 2026 that would mandate an EU-wide age verification app alongside restrictions on addictive interface design.
In July it issued preliminary findings against Meta under the Digital Services Act over infinite scroll, autoplay and hyper-personalised feeds, with a theoretical maximum penalty of 6 per cent of global revenue.
What this means if you build things?
Three practical consequences. First, assume verified identity becomes an input to your product rather than an optional extra, and design the flow around a redirect to an external provider instead of a form you own.
Second, treat age as a claim to be asserted, not a date to be stored. Modern eID systems can confirm that a user is over a threshold without disclosing a birth date, and privacy regulators will eventually expect that pattern.
Third, expect friction to become a feature. The Lithuanian rules include a deliberate asymmetry that is worth stealing: tightening a limit applies immediately, loosening one takes 48 hours. Delay used well is a design tool, not a defect.
The anonymous account is not disappearing everywhere. It is disappearing from anything involving money, age or risk, which turns out to be most of what people actually do online.
