Another Conflict Between Privacy Laws and Age Authentication–Murphy v Confirm ID
blog.ericgoldman.org
blog.ericgoldman.org
Nobody wants it. It's a form of control on the internet that i would not desire. I don't care about preventing any harm, because the said harm doesn't get prevented in the first place, and new harm is placed on me!
Therefore, anyone in their right mind ought to completely oppose any sort of verification scheme on the internet. If you want verification, get the customer to pay a nominal amount via credit card - that is as far as it ought to be allowed to go. Any further, which includes demanding by law for verification, should not be allowed.
But, I know better than thousands of policy writers in the Australian government and know it's not actually possible without destroying the internet as we know it, so, I don't want it.
You can't use credit/debit cards, think of the children and the 0.001% of people in Australia without a card.
I’ve decided to look it up, and it’s a mixed bag: in the EU, there’s 6 cointries where minors can open a debit card (the age requirement is as low as six in Slovakia or seven in Latvia). Then there’s another 11 countries with no minimum age at all – though they do require parents’ consent. https://fra.europa.eu/en/publication/2017/mapping-minimum-ag...
Otherwise it's completely impossible for a parent to monitor their kid.
It's quite something to tell a parent: It's your job to monitor your kid, but also we're going to block your ability to do so.
This relationship is not the same as a gov't with the citizenry.
Or that you can delete messages?
Apps these days are ultra privacy focused. It's not actually possible to monitor kids. It's just not.
Why would this be hard to do in today's age? There are even movements organized by the kids themselves that recognize the danger of the smartphone.
Because we live in an age where coffeemakers have wifi cards in them. You can get a USB wifi card for $5. Every coffee shop has free wifi. Half of 6th graders have a cell phone. You can’t control kids on the internet because they have access whenever they are around other kids.
This is painfully outdated advice that acts as if nothing has changed in 30 years.
Hanging out with friends at any location outside the direct line of sight of a parent is not few and far between. Kids can share phones on the bus to school or in the bathroom in between class or at the mall (or wherever kids hang out now).
>Kids aren't criminal masterminds as a general rule.
Kids aren’t criminal masterminds but they want to socialize with their friends. Kids used to sneak out of the house, then they would sneak to the house phone late at night, then they would sneak down to the family computer to chat on AIM, then they would text on their phones, and now they get around parental controls or get old phones to get chat/social media apps. Kids have always done it and will always do it, and now it also exposes them to the whole internet and all that comes with that.
One of my kids has a very addictive personality. Great kid, smart, gets good grades. But 100% addicted to YouTube. He will lie straight to your face, sneak an unlocked phone to his room, and watch 22 hours straight of random videos.
I shudder of the day he discovers internet pornography. He has no natural defense mechanism and he’s up against billions of dollars and decades of research on how to stoke addiction (aka “engagement”)
And mind, I'm not against using legislation to cut down on the exploitive and addiction ridden field of UX. I grew up participating in trying to bridge the world of library science and organizing information for quick recall of Web 1.0 and the hell that became web 2.0 when SEO became big, and people realized there was a buck to be made off looking to monetize eye space.
The problem isn't at the root parents. It's greed, advertisers, and marketing. But unfortunately it's an Us v. Them to the point where current parents have to focus on eauipping kids to resist the exploitive tendencies current web experiences are built around.
Some assumption that I did not impose a punishment. Prey tell what would you suggest the punishment be? Don’t forget, assignments for school are posted online in Google classroom and need to be turned in online. Many require watching YouTube videos. Please enlighten me.
You edited your comment to add nuance past the snide “parenting is hard” useless quip. So I’ll add some to mine as well.
Greed is the problem. There is a problem of misalignment around this entire ecosystem we have built. We are in an age where we can measure so much more accurately than ever before, so we have invented metrics for everything.
Unfortunately these metrics ultimately boil down to “how can I make more money”. We are what we measure. So now we are stuck with platforms whose key performance indicator is time on site, leading to micro optimizations to identify how to get people hooked. No wonder parental controls are so shitty! Those don’t exactly move the “engagement” graph up and to the right, do they? And there’s no meaningful regulation to counteract that force. In other words there is no incentive for them, and I fact every incentive to make my job as a parent harder.
So now back to your first comment, boiling down to “you’re a shitty parent. If you were a better parent who scolded their children, you wouldn’t have this problem”. It’s telling that you started your comment that way, and instead of responding to my comment by perhaps enlightening me with your sage parenting tips, decided to edit your comment to add bs about how oh it’s greed not parenting after all. Tell me again how I as an individual is supposed to take on an entire industry built upon a profit motive to do exactly what my kid is doing?
Punish him how? Take away his video games? Did that. But then he got up at 6am on Saturday and turned on the Apple TV. Guess what, there’s no meaningful parental controls on that. So I took the remotes and locked them away. Encourage him to go outside and play with friends? Won’t do that because the screens are way more stimulating than interacting with actual people.
Then, one day, I forget to turn the Internet back off on his school laptop after he turns in a project online, and the cycle starts again.
I don't want to see children being exploited by master manipulators with huge R&D budgets directed purely to the task of incenting more wealth/value extraction. I don't want to see adults targeted by the same. I don't want an economy centered around that. I don't want "Captains of Industy" vying for and directing "engines of wealth creation", utilizing human capital and resources to their own ends. Because that's what leads to my earlier glib answer, where we have to perpetuate the current cycle of suffering in order to prepare them for that world, and punish them as well as ourselves in the process. Which is exactly where we're bloody headed without change, and in a hell of a different direction than installing emperors who want to completely change the shape of things to suit their ends alone.
You can feel free to dismiss me as "you'll never know because you aren't currently what people recognize as a parent". That's fair enough. But please understand that short of massive change to how and who drives the levers of our existing (and crumbling) regulatory edifi, we're on track for Great Depression 2.0 and speed running the Gilded Age of the Robber Barons and relearning the lessons of the 20th century again because we clearly failed to do it the first time around.
Without setting limits to what we, the adults in the room can do in terms of optimizing for wealth centralization through exploitive commerce models, the only people left to pass on the skills necessary for your children to thrive in an increasingly exploitive world where the trend in cost for being able to crank out systems to amplify parasitic value extraction is you. The parent, and any other caregiver with their eyes open.
If you think you're shitting bricks right now, I've been taking the last year or so to evaluate how life has changed for the young folks in my life, and I'm horrified by what I've found, and I know if it's happening in my circles, it's happening in everyone else's. And while I played a part in the genie getting out of the bottle, I know enough about the nature of the thing in question to be able to recognize that right now, y'all, and anyone who cares are the only ones who can get this train turned around.
And in the meantime, yeah, that's going to mean a lot of the onus on policing those little scions of chaos we call offspring to the active caretakers. The essence of the Internet ain't to bring the Angels to your home, but to offer the Angel and Demon alike a highway through which to enter your home. They (kids) don't know the difference, or appreciate that for you, telling the difference is work to be done which you have to balance with other demands; I understand, and don't discount that.
I can't change it alone either though, because it's a collective action problem. And we seem to really suck at that when it's goal is "enforce an upper limit on greed".
Foisting the parenting onto the government sucks for everyone.
Car seats? Seat belts? Curfews? Hospital reporting laws? Child safety standards? Mandatory smoke detectors? Curriculum standards? Mandatory education?
All not necessary if parents just did their jobs, right?
On that note, the US government states in their own papers in the SCOTUS case that parental control filtering is so niche, that it is at the level of complete irrelevancy in fulfilling the government’s interest in preventing children from viewing porn. One SCOTUS judge with children has already said that in her experience, it’s impossibly complex even for a devoted parent.
Tech can’t point to parental controls when they failed miserably in their implementation.
most, if not all of those things, are necessary because a parent is unable to make any changes to stop the danger. Good parenting cannot stop a car accident (unless you're claiming that you have perfect driving skills). Ditto with the other examples.
The difference between age verification and those is that verification puts an undue harm onto the entire population, for which they derive zero benefit, just so that a few parents who cannot be bothered to monitor their child could continue their lack of responsibility.
This also hoists undue harm across a population - children and teenagers. As the SCOTUS case is going forward, Texas is (correctly) pointing out that this is very different than 90s dial up, and the porn is far more intense, violent, graphic, and accessible. Because we’ve already had porn filters, and even the opposition concedes they’ve been uselessly ineffective, therefore…
That’s the argument. It’s a good argument. You don’t have to like the conclusion. However, I have seen firsthand that filtering, and talking to children, absolutely is not, and never will be, effective.
Weird, I have seen firsthand that absolutely can be! I guess we're at an impasse.
If so, it was not effective.
And even if it was, according to the US government, >90% of parents can’t pull it off, and they’ve had over 20 years to try (tech companies included). That’s law-changing time.
As one legal analogy put it: Imagine if there was a law mandating public transportation from City A to City B. There’s a bus line, but it’s people 6 feet or taller only. Don’t come into the courtroom defending it by saying crawling is always an option, and some people have been crawling, so therefore the law is upheld.
Parents can't stop it any more than they can stop kids from watching violent movies or renouncing their faith. Quit arguing with this slippery-slope logic, your comment history reads like Pagliacci's personal diary.
No... Parent's can't reasonably mitigate what a car seat or seat belt mitigates.
Besides that, the benefits vs. harms needs to be weighed before you shove your parenting responsibilities off to the government. Age verification laws have the potential to do a lot of harm to a lot of people. Seat belt laws do not do a lot of harm to a lot of people.
The safety mechanisms you point to are not a result of parents failing, it’s a result of a common agreement that society as a whole benefits from certain guardrails. Seatbelts were very controversial! But after you realize that a seatbelt is a small inconvenience that can prevent you or your children from being violently ejected from the vehicle and splatting on the pavement in the event of a car crash, we agreed as a society that the public health good outweighed the slight inconvenience of wearing a seatbelt. Nothing to do with the failings of parents. Parents already feel like failures most of the time already as it is.
We're on a "Hacker News", and you want me to explain what parental controls are? Do you have some specific questions that you genuinely want help with? Because this smells like a bad faith question.
Physical controls like... Gosh, I don't know. Choosing what devices your kids have access to, and what time their allowed to use them? Taking devices away when rules are broken? Putting devices in common rooms instead of bedrooms?
>If your kid is taught to be responsible why would you need them?
Ah, I see your edit confirms that this is a bad faith line of questioning.
Have you tried to restrict devices against a determined child? Especially one that has to use a device to complete school homework? Because you make it sound easy. I can assure you, it is not. Just because a device is allowed at a time of day doesn’t mean he’s using it for the stated purpose. I sit with him as much as possible while he’s doing homework, but I may have to step away to cook dinner, wash dishes, drive a kid somewhere, help one of my other kids - and guess what, I come back and it’s more YouTube. So how does “time of day” restrictions help?
I may come off snide and annoyed, and truly this topic does make me annoyed as there is no simple solution. Yet people who are not in this position are so quick to point out how simple it is - yet never can back up their claims with actual facts.
Edit- before I’m accused of being too lenient, I have a fairly strict screens policy for my kids, and I still struggle. When I go out, it’s insane how many parents just let their kids sit and watch videos while the parents talk. The kids will have iPads basically chained to them while in line, at the table, in the car, it’s absolutely sick. Hell, I have my own problems with screen addiction.
Here’s some mitigations and how they’ve failed:
There are no devices allowed in bedrooms. Work is to be done in common rooms, but unlike when we were kids, there is no desktop. Only laptops. So they’re easily portable. I have had a recently wiped iPhone swiped from my office because it was unlocked - it took me a few days to realize that, and by then he had watched 22 hours of YouTube. Internet is locked out on their devices but turning it on and off is a bit of a pain so sometimes I’ll forget. Even with no internet, he will pull out the laptop while in the car driving home from school and play a cached web game. They tricked my wife into thinking the rear screen in the car was unlocked, so she toggles it- not realizing that actually unlocked the screen. Their Nintendo switches have ok parental controls once I realized you can actually set it to zero time if you do it on a day-by-day basis (otherwise the minimum is 5 minutes). I have a house wide pihole, but once he gets a cellphone that will be trivial to bypass unless I go through the effort of forcing an always on vpn. One time my wife shared the password to her laptop with my daughter (who is responsible) but my son was within earshot, so he was able to unlock it while we weren’t looking. Shall I go on?
I believe I’m doing the best I can yet I am fighting upstream the entire way.
>Yet people who are not in this position are so quick to point out how simple it is - yet never can back up their claims with actual facts.
I don't know what actual facts you want from me. I don't have a study published in Nature or whatever that I can cite. I just have my experiences with my three kids (ages ranging from young to almost moving out) and the experiences of my friends, family, and colleagues that have kids.
I'd be happy to share my experiences, and what worked with my kids (and what didn't), but it's hard to believe someone wants a genuine conversation when they hit you with a "If your kid is taught to be responsible why would you need them?" off the top. (Or equate age verification laws to seat belt laws, like the other commenter).
Looking around at all the neo nazis, Russian disinformation and just the general populace turning more and more insane I’m getting pretty tired of the internet as we know it.
There probably are/will be ways to do age verification fairly accurately, but they will be scary in other ways, and will certainly violate your privacy, at least during that process.
It could mean the British government too (the UK legal implementation is even worse. At least Australia commissioned a report on age verification. The British government just assumed it was fine because the trade body told them it was, and Ofcom have actively washed their hands of any responsibility for safe implementation at all).
Legislators are literally law professionals and most of them are old lawyers. They know EXACTLY what they're doing.
https://allowe.com/games/larry/tips-manuals/lsl1-age-quiz.ht...
Websites could easily add X-Recommended-Age or X-Content-Rating headers where browsers could enforce a decent set of filters for adult-oriented content.
Popular platforms, I think, have age ratings on streams (twitch stream age tags), youtube, etc
The above would cover 90% of content-related concerns and combined with things like cloudflare dns filtering you'd have a relatively safe internet experience.
The interacting-whith-people (or oddball harms like character.ai) concerns can then be more easily policed by parents.
The industry has chosen not to implement basic controls and is asking for government controls.
Like any other “voluntary” system, this is also doomed to fail. It’s not like the cigarette companies didn’t target children for a reason.
To put it bluntly, the companies that use the “voluntary” metric that by definition restrict their reach will have less monthly active users and therefore less revenue than those who do not, so therefore nobody will. Already happened in 1998, it will definitely happen again.
You're basically trading one regulatory body for another. Perhaps Google makes the "right" decision now, but you disagree with their SEO metrics in the future? We are already beholden to undemocratic tech platforms for a lot of our life, why provide them even more power over our lives? I realize that sounds a little hyperbolic, but it's interesting to see that we are much more comfortable with a multinational corporation that doesn't even have a customer service department to make rules about the Internet rather than a democratically elected government.
Google doesn't publish statistics AFAIK about adult search terms, but evidence from several sources puts adult related search terms at around 10-15% of search volume. Given our metric-obsessed micro-optimization culture, if even a small proportion of those users decided to shift to DuckDuckGo or Bing because they suddenly couldn't search for porn on Google, that would have a material effect on their advertising and bottom line.
I did not propose any rules. I proposed a header.
Google already creates and re-creates "the internet" for the vast majority of people on the regular basis by messing with its algorithm, pre-empting search results with AI-spam, showing ads, etc.
My statement was an assertion that the power google holds over the internet at-large is enough to incentivize compliance with opt-in content ratings for huge amounts of the web.
I also said nothing about adult search terms. The point is that an adult website can mark itself as one intentionally (X-Cotent-Rating: Mature) and then when google gets a search from a child's computer those results are simply filtered out. they already do this but site owners have no way to tell the world their intended audience.
A government API. It gives claims. Such as user x is an adult.
User logs in first, authorises an app to get a specific claim a specific period or amount of times, User logs in to the app, app calls the API.
There is no need for IDs or credit cards or any of the sort.
The EU has already solved this years ago?
I don't know if the commenter refers to this one or not, it's probably too recent and far from "solved".
The EU portal itself has an identity verification functionality, I can use my national ID (national insurance number, specifically) in EU polls, petitions and other EU portal functions, but that's anything but anonymous by design.
That's where you'd want an intermediary: you log in on porn site A => redirects to some intermediary which only needs to check your age => login from the state, get age, send user with verified token to porn site.
Porn site only knows your login and the fact you are an adult.
Intermediary knows someone needed to validate their age.
State knows this random no porn site wanted to check some claims about you.
Because what is the problem to solve here? If you do not require services to confirm the age of the user, they will not have to confirm the age of the user. This is a problem created.
Fine sites that allow minors to view porn and the free market will figure out age verification real quick.
Also, what is porn and who gets to define what porn is?
It ain't a magic wand that fixes all problems, buddy. Some problems just aren't possible to fix without making changes that sacrifice values core to the economy and of our culture.
What tech discipline are you in? Policy? Because I have serious doubts you have any technical experience.
A website is mediated by computers. Computers make copies of information that is sent to them because that is how computers work.
Tech companies also like to collect and sell personal information.
What do you think will happen with records of people's fetishes in the hands of companies that like to sell personal information?
> What do you think will happen with records of people's fetishes in the hands of companies that like to sell personal information?
Not my problem and tangential to age verification.
I have no reason to believe a physical strip club would sell info of which ladies I look at to anyone with a couple of bucks.
I can't say the same about websites.
> Not my problem and tangential to age verification.
You can't demand a solution while ignoring the cost and expect to be taken seriously.
This idea that online is somehow special doesn't fly with me. We can agree to disagree.
The free market isn't magic.
The free market hasn't solved cybersecurity.
The free market hasn't solved world hunger.
The free market sure as hell hasn't solved Healthcare or even promote good health.
You have magical thinking at best. This isn't an "agree to disagree" issue any more than it would be for me disagreeing with someone who believes the moon is made of cheese.
And in countries where you need to be 17 to get a driving licence and where adulthood for many things is 16
Server operators just add one header, done. App and device developers would have to dig up some old code that can look for a header and check parental controls. Most kids are on phones and tablets. Complete mobile in two years as phase one. Desktops four years out as phase two. That may seem like a long time but this discussion has been ongoing since 2001 at least.
All the big tech companies have lobbyists. Have your lobbyists push for this and this could become a non issue in very little time.
[1] - https://www.rtalabel.org/index.php?content=howtofaq#response...
[2] - https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-R...
This places a majority of the cost of implementation on the people who actually want to use it, avoids a creepy Orwellian surveillance system, and enforcement is moved into a physical immediate reality that the average parents can see and monitor.
It also means you don't need to worry about visitors who are unmarried under the age of 16 years and three full moons who may not see unclad ankles in Elbonia.
Is it just the lack of an organized constituency? Resistance from device manufacturers/store operators? Too much control situated with individual families, so the absolutist political voices feel like it’s not pure enough? Or do they figure it’s too easy for a clever kid to bypass?
Until big porn companies, social media companies or any companies use lobbyists to implement RTA it just won't happen. I bring it up when this topic comes up quarterly year over year. I've beaten the dead horse so many times the dust has evaporated. It's rather silly now since the original RTA header was the ICRA PICS header much more complex to implement. Adding a single simple header and looking for a header is trivial which means the obstacles are entirely human made and artificial. Perhaps when governments start creating more expensive laws and penalties around user contributed content things may change.
I suspect the issue is that the user-side voluntary disabling of access means that--like with the V-Chip--almost no one will go about doing it, and that for many of the people trying to push for porn site restrictions, the side effect of forcing porn sites to close down is actually a desirable effect.
The internet on the other than has let website operators have more freedom to govern themselves with some exceptions. I think in this case implementing RTA headers while it would have some cost it is leveraging existing code, web and load balancing platforms and just bringing back header checks in applications which many apps already know how to do and then calling the parental checks that also already exist in many devices and in some cases the UI is just hidden.
But it was bashed as a "censoring system", and now we have nothing.
The free market solves it by not doing it.
It's kind of like how in physical systems, if you kill all the predators in a few square km it leaves a void where any predator capable of evading your traps is able to prosper far more than you could have imagined, requiring intense efforts to actually secure whatever it is you were protecting.
If you create an environment that's attractive to predators (giant pools of interconnected, personal data and a system designed around access to that data being equivalent to being the person in question), so long as there are predators you can expect them to infiltrate that system unless you apply extremely costly countermeasures.
Rather than in-housing the identity verification (and allowing DOGE et all to slurp that up), I'd rather ban that sort of thing altogether and take out the private sector alternatives at the same time.
If we really think that's not possible, a centralized implementation is usually preferable (e.g., why do I need to provide more information and photos to id.me than I ever did to the IRS when all I'm trying to do is access my tax data, and why do the new terms of service strongly suggest that my personal information is being used for reasons far beyond identity verification). I don't think that's required for most of the identity-related concerns I've seen the last few years though.
It'd be such a boon for any age verification legislature in the future.
Do NOT allow children onto the full Internet.
Allow websites to Opt IN to claiming to be safe for an age / having a given content, and allow indexes to create an allow list of sites that have opted in.
Any site operating in bad faith should be subject to false advertising enforcement, or if clearly aimed at nefarious activities that sort of crime.
User generated content is "Unrated" until moderated.
In kid mode, it could only go to kid sites and run kid apps. If a parent ignores all proper advice and enables normal mode on their kids device, then that's on them (or lock them up, idk).
The main advantage is that the id check only has to happen once, in person, and it leaves most of the responsibilities on the parent who should have a vested interest in raising their kid rather than a corporation who wouldn't.