Age Verification Laws: A Backdoor to Surveillance
eff.org
eff.org
Have a website and want the chance for kids to see it? Advertise in the headers that it's moderated and intended to be a given rating. Various indexers can pick that up. Complaints can be forward to relevant government agencies (E.G. for a US based website the FTC, false advertising), or as usual other agencies for harder crimes.
Parents can mark computer accounts as Child accounts and Browsers configured to follow a set of list filtering rules selected by the parent or current guardian (E.G. schools).
So again. Internet == Unrated Free Zone -- Child Mode == Allow List filtered content.
This is exactly the opposite of the way public spaces actually work, and the way that public spaces actually work is the very justification for laws like this in the first place! You've just taken their exact rationale and imagined a world that would lead that metaphor to the opposite conclusion.
In most of the real-life US, you can't put porn on a billboard, you can't sell it in a supermarket, and you can't wear it on a shirt. You can't go out naked in public, and you can't engage in public sexual activity.
If you do want to buy porn or go into a strip club, you have to show ID and go into a distinctly-not-public space behind closed doors, often without street-facing windows lest people in the public space be able to see inside.
The fact that this is how public spaces work is why these laws are written the way that they are—by analogy to real public spaces vs real adults-only spaces.
In most of Europe (spoiler: overgeneralization incoming) nobody would have an issue with a child walking alone through a city, going into a bar and ordering a coke. Nobody is going to stop them from taking public transit to a book store, and nothing is legally or physically preventing them from looking at a couple pages in the latest playboy issue in the magazine rack. Though the clerk might interfere out of his own judgement, and depending on the country they might check your age before selling it. You will however be asked for ID before being allowed in a strip club, brothel or casino, or before being sold a DVD of some action movie.
In Europe, my ex and our two teen daughters could go out in the late evening and feel comfortable socializing in places that would be unthinkable in the US.
In general, US culture seems to stratify people by ages in all sorts of ways, official and just cultural. It doesn't feel as socially healthy to me. We are all better for having a wide variety of friends and family around us.
Internet came out of military and academia and had a flat namespace. No consideraton whatsoever was given to the idea of a 'social model' for it. This was discussed way back in late '90s in a yahoo group that has since disappeared: social models for communication networks.
The widespread proliferation of attire bearing so-called "ahegao" faces demonstrates otherwise.
This is the attitude that led us to this problem in the first place.
>Would you allow an 8 year old to wander New York City unattended?
They're at much higher risk of being arrested/abducted by the police than they are anything else. This is a uniquely North American neurosis; this happens every day in every other nation. They take the subway to work/school or walk, like everyone else.
Also, what could possibly lead to that happening? Someone upset they were noisy? Or just that they dared show up at all?
No. Eg Australia is also full of helicopter parents.
And even Germany has moved a lot in that direction in recent decades, even if they ain't nearly as bad as the US.
Now imagine there was no parent at all...
On the other hand, child kidnapping by strangers isn't really a common thing. The vast majority of kids going "missing" just did something like going over to play with the neighbour's kids without telling their parents, and the remainder is taken by their own family. Of the roughly 800.000 kids going missing each year, only 100 or so are genuinely abducted by a stranger.
So no, a child being more likely to be abducted by a cop than by a stranger isn't as strange of a claim as it may initially seem.
I'd often see train conductors asking why I was alone and then going "ok, fine" though they would keep an eye on me usually.
As much as I kind of agree, I want to fight so much for open access to the internet because it was so useful to me as a child, thirsty for information and starving for nourishment.
I will say I think these laws are bonkers. Restrict what companies can do with child data, make it clear an account is a minors, that should be more than sufficient.
As a child of the 80s who benefited greatly from the Internet as a kid (repressive religious parents, and the Internet was a lifeline), I feel extremely conflicted.
On the one hand, I absolutely want to preserve the kind of benefit we received growing up. On the other, the Internet looks nothing like it did when I was a kid.
This is how I feel, too. Nothing like TikTok or YouTube Shorts existed while I was growing up. I know how dangerous those are to me, I can't imagine how dangerous they could be to children. Mostly because anything I come up would probably be a wild overestimation, but I won't know by how much.
Rather than rotting my brain away with shorts as a child I spent my time trying to find every possible way to game every possible system. That was my idea of fun. Still is, though it's gotten harder and harder for me to find systems that are easy to game, because the types of systems you encounter as an adult tend to have already been gamed to death by everyone else.
Only the quality was worse but that was purely due to technical constraints (no streaming video)
Now admittedly many of these things are unevenly enforced, but society absolutely does a lot in the physical world to make it appropriate for children.
> Long term, smoking rates have fallen 73% among adults, from 42.6% in 1965 to 11.6% in 2022.
> Long term, smoking rates have fallen 86% among youth, from 36.4% in 1997 to 3.8% in 2021.
I'd say that's better off, not just in childhood but with long term effects.
You're taking the metaphor a bit too literally.
Or maybe the metaphor is flawed?
GP says that public spaces are adult-only by default, the parent rightly points out this is nonsense: public spaces are Safe for Work (and for kids) by default, and you have to prove you're an adult to access the adult-only spaces. Which is exactly what laws like this are trying to do by analogy to the physical world.
It's not OP that's interpreting the metaphor too literally, the public-spaces metaphor is literally the main justification for these laws and GP doesn't understand how public spaces work.
Most adults would be put off by that as well, I’m not sure if this is indicative of public spaces.
That said, I agree that public spaces cannot possibly be adult only by default, as children have to traverse them.
I grew up in a household where no effort was made to hide adult materials. Oh, the horrors--that don't actually exist. There is exactly zero overlap between my father's kinks (I was the one that had to go through his stuff when he died, I know what they are) and my own.
As for the billboard--there's sometimes been a prostitute ad on a billboard here. "Full" nudity with strategically placed text. Of course it pretends they are dancers but few people are actually mislead. (Despite a fair amount of misunderstanding prostitution is *not* legal in Las Vegas. It's banned by state law in the two most populous counties, local choice otherwise. However, there's pretty much a truce between the outcall escorts and the police--they don't do other wrongs, the cops don't try to catch them.)
Many people do, in fact, do this:
https://reason.com/2021/06/11/free-range-kids-second-edition...
No, but that just means NYC is a crappy place. I regularly see 8yr olds wandering Tokyo alone.
I would hope that the answer is yes.
This kind of reasoning (not to pick on the commenter above) is troubling. People blame cellphones and social media. But what are they going to do once they put down their cellphones, if not go out? Should they stare at the walls?
Interacting with strangers is a valuable experience. If we do not encourage children to interact with strangers, should we be surprised when they do not want to participate in civic activities as an adult?
You might be surprised, but back in the day before overprotective parents, “free range kids” were a thing. I was riding my bike all over the city (albeit not New York) with friends and just told to be home by 8:00 with no cell phones. I was 10-11 years old.
Even in Atlanta where my wife grew up she was riding the public bus at 12 with her younger brother going to the mall.
At age 8 I was wandering in Munich unattended.
But okay, gotta admit, this is Germany we're talking about, so not many issues with hordes of mentally ill and/or homeless people doing anything from drugs to defecating on the sidewalk right next to big tech's offices [1].
[1] https://www.theguardian.com/commentisfree/2018/aug/18/san-fr...
I’m sure someone came along later to clean up but this was early morning. My point is let’s not pretend like Germany doesn’t have homelessness and people sleeping rough.
They generally are quite harmless though and not generally any threat to wandering children.
And this harms people how?
Sure, why shouldn't 8 year olds wander a city unattended, and eg use public transport?
I cycled to school way younger than that. And so did many people in the past.
- Kids should be in bed by 8.
- They shouldn't light fires in the back yard.
- They shouldn't run with knives.
If someone tried to use my support for those things as a basis for 24/7 surveillance of bedrooms, back yards and knife drawers, they'd be insane.
The anglosphere is so full of authoritarian people wanting to get into people's lives and even when arguing against surveillance you think there's an agreeable common goal we should all strive to. No. We don't.
Ironically enough I’ve found Americans to be by far the most resistant to authority, both societal and governmental. Maybe what’s shining through from your comment isn’t how you live in a less authoritarian environment, but that its mores just happen to align with yours so you’re blind to them.
Yes as long as they know to observe traffic and know how to use the subway.
Almost all child adductions are parental kidnappings. This "will nobody think of the children..." neurosis is just that, a neurosis.
I do agree with the basic concept, though--kids being snatched by strangers is very rare.
I know you meant this as a rhetorical question but honestly, the answer should be yes.
And if the city is too dangerous for kids to live in it now, then fix that.
Likewise for the internet. Kids are going to use it, we should make sure it’s designed around that.
That doesn’t mean we need surveillance like this though.
Web != internet.
I grew up on the uncensored internet, and it was fine, but I would not conflate the internet with a public space. From my experience the actions and content of the internet are very different from the real world.
This is common in Japan.
This is a disgusting worldview. The fact that an 8-year-old can NOT walk NYC unattended is a disgrace. This is what civilized countries actually look like: https://youtu.be/IkVvXVDs5aI That American children cannot reasonably do the same any longer is a FAILURE of the public trust.
We don't randomly go around asking Papers Please! to everyone on the street.
I also recall walking a few miles to e.g. the mall, target, walmart, etc. without any adults when I was around 10. I'm not sure I'd characterize public spaces as adult oriented by default.
Live sex shows are illegal in most places in the US regardless of whether the audience is exclusively adults, so the motivation for these laws is apparently something other than preventing children from seeing them.
Wrt. privacy, the real issue is that the small step helps the big step not just symbolically. ID-based age-verification, even when used for good reasons, gives the state and government access to its people’s history of age-restricted content. If this government decides to, say, prosecute anyone who viewed/bought/consumed (inane) X, it’s far easier vs. a government that doesn’t have age-verification. Both governments face major opposition, but the latter government’s opposition is more effective, because the former’s has already shared their history.
One thing the article doesn’t state but implies, that I don’t agree with, is: the slippery slope is still a fallacy, when a government first decides to age-gate reasonable X (e.g. porn) then unreasonable Y (e.g. history books). Because said government will receive almost as much opposition and people doing work-arounds for Y, as if they went straight to age-gating Y; although not exactly as much, I generally assume (and hope) the difference doesn't outweigh the benefits of "stepping towards the middle". In the article, X is porn, and Y is facial cream, dating apps, and diet pills. But these things arguably should be age-gated; and even the article’s talking points are not that these are OK for children, but that gating them gives the government data on more people (which is a real slippery-slope, not a fallacy, as explained in the above paragraph), specifically people who don’t watch porn (perhaps some of the readers don’t mind porn viewers being monitored because they aren’t one of them). If states were to actually start age-gating history books, I guarantee there would be serious opposition, including from people who are completely fine with age-gating porn.
It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation.
Nobody is actually interested in promoting that though, the anti-big-tech crowd just wants verification no matter what, and the pro-privacy crowd just wants something to get angry about. Nobody is looking for a reasonable compromise here.
There are ways to do this which are less bad, but there is no way to do it "in a fully privacy-preserving way" without also making it fully ineffective, because if there is no way to prove who someone is then there is no way to catch anyone providing false age verification as a service to minors. But if there a way to prove that, you've demonstrated the existence of a privacy failure because you could then use the same mechanism to determine what someone is looking at.
However, you could come close. Sell a simple USB device that generates codes. It can only be purchased in person by showing ID--but the ID is not recorded. Down the road it can only be traced to the device, not to the purchaser. But you would no doubt see them for sale by unscrupulous individuals reselling them.
Minors don't seem to have much of a problem, though?
Yeah, it seems like it would not be as much of a problem if you were able to have assurances that your data isn't being held onto. If I give my ID to a bouncer at a strip club, he isn't able to scan it and put it into a digital file. He just looks at it*, goes "yep this guy is of age", and gives it back. If we ensured a similar data flow for the Internet, then it wouldn't be nearly as much of a privacy issue.
*These days I doubt I would even get carded as well. Getting older and all that. IDK how you could implement a similar check for the Internet though.
What are some implementation(s)?
Different implementations vary in effectiveness. Anyone can give a minor access to their device, or a minor can steal their device. So in order to prevent access then, you'd need something like constant face monitoring (via a local model, possible to do anonymously, but expensive and fallible), or legal threats (impossible to do anonymously, because you must track the adult who gave their kid access; and many people are dumb with technology even when it matters, so you either have to fine or jail many people or selectively enforce).
The easiest implementation I can think, which I'd recommend, is to make locked-down kid devices, require ID or even just a credit card (18+) to purchase a normal device, put the burden on adults to not share their device with kids, and only police merchants (for selling normal devices without ID) and websites (for serving adult content without blocking kid devices). Like what we do with alcohol, except not even trying to police people for sharing, because it would be ineffective and messy. Like alcohol, many kids will get access anyways, although less than now.
I like this approach because, IMO importantly, kids who don't try to see adult content will be far less likely to, and parents who try to restrict their kids from adult content will be far more successful. I don't think you can stop determined kids with neglectful parents without drawbacks.
Almost anything is possible, but even in this case it was never inevitable or inherently true that age verification for X meant age verification for Y. Which means the value - if any - for a slippery slope argument is "consider the possibilities X might open up"
That said, I understand where the EFF is coming from. Data collection and "sharing" is rampant these days. Any meaningful form of age verification opens up the potential for abuse. What I don't understand is their failure to address how to handle restricted goods.
Rhetorical arguments are more important than ever in the age of AI, because AI is our attempt to simulate that. Probabilistic AI mimics rhetoric (inexpertly). It uses past knowledge to predict future behavior (rather, just the next token) based on probability.
To be clear - I'm not arguing that logical argument aren't important; I am a logical person, and prefer logical arguments to rhetorical ones. I prefer the certainty. I still recognize the need for rhetoric. Not everything is certain, and you have to make decisions based on probabilities and unknowns.
Here’s the beginning of the rabbit hole you need to go down to understand why so many former debaters not only hate the activity but specifically cite it as an example of post-modern neo Marxism:
Also, neither deductive nor informal fallacies mean that the conclusion of an argument is wrong, in any case, so the conclusion of an argument being right does not disprove (or even provide strong counterevidence) that the argument contained a fallacy. Fallacies are about whether and to what degree a conclusion is supported by the reasoning (and evidence, in the case of informal fallacies) offered to support it, not about whether or not it is true.
That isn't a fallacy at all, it's just an argument that requires you to establish its premises, like all sound arguments. People call it a fallacy as a pejorative when they want to dismiss the legitimate concern and shut down the debate even in the cases where the premise is correct.
Like, think of the worst guy you know. Now think of what that guy thinks about the state of the world, in as concrete detail as you can. That's probably a pretty good reason in itself not to think that, because if you think like that for too long, you risk becoming that guy yourself.
This feels like it should work far less often than it actually does.
Grease down your self, and you'll slide for a lifetime
Incorrect. Slippery slope is an informal fallacy, which applies to arguments based on evidence not logical relations under certainty. But it is a component of the slippery slope fallacy that the implicit premise (that the precondition that is the subject of the argument is likely to lead to the result that is the endpoint of the slippery slope) is inadequately justified, not merely that a slope from the precondition to the endpoint is presented.
No personal information is shared.
While I do not aggree with pervasive age restrictions, this is a nice technical solution to privacy preserving age verification
The correct flow for preserving anonymity is: the requesting party issues a challenge token to the user -- the token header describes the type of request (>=18yo?) and the token body is completely random(). The user then takes this token and has the challenge verified (signed) on their side, the signed token is then returned to the requester.
This way the state never knows the identity of the challenge issuer.
() Note that this scheme requires good faith on the part of the challenge issuer that the token body is actually random, although it would seem that a simple DH-key mechanism would patch this vulnerability.
You'd know the state they're a legal resident of as they use state-specific keys used for signatures.
If the request allows checking arbitrary ages like Apple's, then you can get their age with a handful of requests. If one has to verify every visit, then you can get exact birthdate eventually.
If the one verifying has to pass data to the verifier site or the request to the verifier has any site/app/company-specific IDs (again, Apple), then you're leaking what you're visiting to the verifier.
And not to beat a dead horse, but as long as there are jurisdictions that don't require age verification in the world, children can easily use a free VPN or proxy to avoid checks altogether at which point, one has to ask, why do it at all?
If you assume a sensible rate limit, that entering the check is voluntary (and unlikely to fail), and that people age monotonically, then it's going to require a lot of cooperation from the victim to get more than a couple of bits of entropy.
I wouldn't trust Apple here regardless, since they are not the state and have their own separate interests.
It seems like this line of thinking would lead you to ask the same question of literally any law, wouldn't it?
Laws often don't rely on being 100%. Even though there is a law saying people need to wear a seat belt, they can just not wear it! So what's the point, &c, &c?
If you use a VPN to visit a porn site to bypass age verification, you haven't broken the law as it applies to sites, not users. There will be no measurable impact on underage people visiting since the barriers to VPNs/proxies are almost nil while still costing money to enforce on non-tech savvy adults - an overall detriment to society.
Laws that are unenforceable and don't benefit society are bad laws.
There’s a video halfway down this page showing the process in Apple Wallet: https://learn.wallet.apple/id/ (notice “Age Over 21”)
https://apnews.com/article/utah-app-store-age-verification-7...
With an eID card, if it's just saying "yes, this person is old enough" then any teen can swipe a device with an eID card and start using it.
Why would we want to keep minors safe from "harmful chemicals" but not adults? If skin cream products with Vitamin A or alpha hydroxy acids are harmful, and I'm entirely unconvinced they are (at reasonable concentrations), lets just get rid of them.
However, there’s also been a rise in reports in kids damaging their skin by using these products in the first place or using them wrongly (vitamin A and AHA are amazing but they are very tricky to handle and can easily lead to chemical burns / retinol burns …).
I don’t think there’s any good reason to let kids handle those on their own. And stuff like retinol is starting to get regulated for “everyone” anyway.
My understanding is they’re harmful if misused.
Is this about the chance about being inadvertedly misused to the point they’re harmful.
I dunno, by all means, don’t sell them to kids, but should we really forbid a 15 year old unless they can show some form of ID? They’re not any more likely to do something dumb with it than an 18 year old.
If they contain known substances that cause cancer or birth defects*. There are plenty of substances that can harm you that aren't subject to requiring P65 warnings.
The reason "we", scratch that, the reason the state allows adults to drink and smoke is because adults have been known to fight back, sometimes quite effectively, when they feel like something is been "taken away" from them. The obvious example here is the rise of bootlegging during prohibition; all that did was empower the organized criminal class, rather than get the nation to realize the awesome benefits of being a sober working stiff. That's why contemporary Western states disincentivize harmful goods by taxation, and gradual, rather than total, prohibition.
Consuming liquor and tobacco are also traditional communal activities, dating from before the total enclosure of industrial civilization upon people's personal lives. Meaning, people would actually be inclined to fight for the right to carry on like they're used to. This is one of the greatest motivators ever; very much not the case with the more novel intoxicating substances, even where those might actually be less harmful than good old alcohol and nicotine.
I'm all for creating an environment that encourages people to make optimal choices about their own lives. Generally, we do not live in an environment that even makes that possible. Case in point, why would one be driven to apply the toxic skin creams in question, if they did not have toxic beauty standards imposed on them in the first place? How do "we protect the children" from those, when all over the world conformance with Adobe Photoshop's idea of the human form can directly determine the social market value of a human being?
The answer is, we have no idea - we're not even asking ourselves the questions that make sense, because "protecting the children" is a moral scam. A just society would protect the inexperienced and the powerless, regardless of age - and, conversely, acknowledge the personhood and autonomy of all citizens in accordance with their demonstrated degree of self-awareness, rather than determine their human rights by some involuntary biological marker. I don't know how that society would work in practice, I'm only here to remind you that instead we live in another kind of society - one that is based on the non-consensual extraction of human resources. Such a society has no incentive to "protect" most of anyone. All it needs is to raise obedient children into dependent adults. (It also needs a stable population of scapegoats - "juvenile delinquents" growing into "hardened criminals", who are to be blamed for all dysfunction.)
Minors are an oppressed minority. They are subjected to extensive brainwashing, and deprivations of liberty that society claims are "for their own good". These rather serve the preservation of power structures, which start with the oppressor's drive to forget their formerly oppressed status. Thus, the purpose of age verification can only ever be the violation of privacy and autonomy of all market participants; it will do absolutely nothing to prevent kids from emulating the harmful and unmoderated behaviors of the adults around them.
Which is also the same reason adults are allowed to do all these other things, like buying toxic skin creams.
Lately, a new law just passed to force porn websites to check the age of visitors. I would have been fine with an authentication going through France Connect:
- the gov knows which website you went to, just like your DNS provider would, but it doesn't which content - and the website knows which content you've watched but not who's watching.
Best of both worlds!
But no, we have to send a copy of our ID card to the website, which is INSANE because the website knows WHO you are and WHAT you're watching.
Going further, how might this effect folks having “freedom is more important than safety” beliefs, given they reside in areas more likely to deny civil liberties-ish rights in the name of family values-ish rights, when this starts to really hit them where it hurts? Everything they do or say online becomes traceable to them, for a notoriously vocal-on-social media set.
If only this hadn't come out of the blue, maybe there'd be someone out there, right now, who could make it so that your identity traveled with you everywhere across the internet, an authentic digital fingerprint and passport so invisible that you can't even see or access it to keep people from having to prove themselves over and over and over again.
What a solution in search of a problem that would have been!
Right?
All of a sudden, the internet is incapable of tracking me with that much fidelity. They don't know how old I am. Discord knows how old I am. I never told them my birthday.
This gets a big "hrrrrrrr. Durrrrrrr." From me.
Having an account that's at least 5 years old, assuming a legal age of 13 for registration on most services, should be enough.
Some services already do it this way. Others offer to scan and analyze your face or ID. Leisure Suit Larry 1 used 1960s trivia for age verification.
Given the list of states and awareness of some notable tech companies that operate out of them, it sounds like someone is doing a little competitive market making with the help of their legislators.
/s/s
parents should be able to access a (password protected) setting in any browser that can exclude some types of websites (like porn).
governments should be free to go after any website not respecting that setting.
but forcing the age-verification onto websites is just moronic.
Agree.
> parents should be able to access a (password protected) setting in any browser that can exclude some types of websites (like porn).
How would this work? Who's going to set up the taxonomy / classification tree for every domain/site on the internet just so a guardian can say "yes to drugs, no to porn, no to news, no to weapons..."?
Or if that's not the implementation, how would an arbitrary site signal to the browser what the age limit is? Once you move beyond a binary "require parent consent for $domain" flag, you're quickly approaching traditional parental control software.
I know I'm not the only one one this site that made a bit of spare $ back in the day helping kids at school go _around_ overbearing parental controls.
This isn't really an answer, but the same problem exists with current age verification laws. I think the main difference with traditional parental control software is that the burden would be on the site maintainer to accurately report the appropriateness of their content. If not, they would be legally liable. Of course this introduces the problem that foreign entities not subject to the law are effectively exempt from the requirement.
if it's illegal to show porn to minors, all a website should have to do to comply with the law is to send a header saying "this is porn" and leave it up to the browser to decide whether or not the human using the browser can see it or not.
Make a standard set of tags and a yes/maybe/no response to them. (Maybe is for a website that has user content that permits such stuff.)
I do agree it would be defeated in many cases, though. Tech-ignorant parents aren't going to be very good at stopping tech-savvy kids.
I would think adblock lists are a pretty good example of similar efforts (that is, people classifying large amounts of random sites), so I don't think that would be impossible.
Such things don't need to be perfect, either - just good enough.
(I don't agree with age verification efforts or even parental control software; just pointing out it's not impossible)
Pornhub knows they do not want to have trouble so they will respect the browser setting and not serve minors. There could be an institution that can receive complains about websites not using this API and those wbsites can be blocked from the country and fined if possible until they implement the API.
We need all mobile and desktop OSes to make it easy for parents to setup accounts for their children, the church could also educated the people instead of just complaining.
It is not perfect, soem clever kid can find a way to reset the BIOS/UEFI and install Ubuntu with a fake age on his PC , but most parents can feel safe and we would not have to show our ID card to Pornhub or even Steam because some game shows nipples and nipples are more dangerous in USA then nazi propaganda.
Benefits:
1. Orwellian abuse: No creepy-ass super-abuseable government panopticon knowing every goddamn service you've ever made an account on, with the ability to arbitrarily revoke them and/or block new ones.
2. Costs: The majority of the costs of creating and maintaining the system fall upon the people who actually use it and want it to exist, rather than a bunch of other adults across the globe.
3. Parent focus: Most enforcement exists in a physical realm where parents/guardians at least have a chance of understanding, monitoring, and managing it. "Little Timmy is using Daddy's phone" can be determined instantly at a glance.
4. Exceptions: If the child has some health-class homework and can't access the right Wikipedia pages anymore, the parent can easily grant exceptions and revoke them.
5. If someone's religion says that unclad ankles are smut, then their church can create their own site-rating-site and adherents configure their family's devices to it.
As always, parenting starts and stops with the parent. The internet should be open and if the child sees something that upsets them (or makes them question one of their assumptions), it's the parent's responsibility to cultivate an environment where the child feels comfortable talking about it with them.
I hate the breakfast club and think it’s one of the examples of movies which idolized anti-intellectualism and basically celebrates bullying nerdy types. Sadly ironic of a password choices from my “nerdy” family.
If the rainbow tables didn’t work, I’d have rootkitted/RATed the computer.
It's about the only place it might have the intended effect anyway, and has the advantage of not enabling mass surveillance.
The data already exists, it's what bars use to scan IDs with handheld readers IIRC.
Sorta, yeah.
But the reason that works is because there's a human guarding the door that can assert that the hand presenting the ID is attached to a face that looks just like the one on the ID.
Otherwise a very smart 17 year old would just get their hands on the UUID or whatever for literally any ID that belongs to somebody that's 18+. Within _hours_ of this type of system going into effect, you'd have the age/id version of bugmenot.com
Operator: "let me take a look sir. It's probably a bug. It's definitely not the censorship metrics opaquely changing behind the scenes, sir."
One of the biggest problems that grows with each generation, is how do you get the youth to actually engage in constructive development of real skills? How do you get them to be interested in something that will be useful for society down the line? Quietly looking the other way while a statistical minority breaks some of the safety-rails of society basically solves that problem. Breaking the rules is cool. You're basically exploiting the rebellious nature of the youth to trick them into learning useful skillsets. So long as the hurdles to circumvent the rules remain reasonably involved to overcome, and the secret intention remains unspoken, you basically double up the rewards of the rules.
Moving the verification to sites also isn't going you any good, as the site owners could just move to more liberal countries.
You want a mandated block of government code in every browser?
having a checkbox that corresponds to info passed with the HTTP requests is hardly something that requires a library or more than a few lines of code
Yes, that means not buying a smartphone and give it to your 3 year old.
I think, slowly, the world is starting to realize this.
Agreed.
>I think, slowly, the world is starting to realize this.
Unlikely. You'd be surprised at the proportion of parents that want to outsource parenting to the govt.
I am someone who would probably not own a smart phone if it wasn't such a pain to not have one.
I can see with the kids in my extended family how even by 12, not having a smart phone is going to damage your social life. It was awkward enough for me at that age with rotary phones. I couldn't do that to my kid if I had one.
We have put ourselves in a really bad spot. Even if a parent wants to do what is best for the kid, I have no idea what that is. To pretend there is some simple and obvious answer here is completely divorced from reality.
If the only porn requires this, then the third party has a record of every single person who wants to view porn.
1. Me from sharing my credentials with everyone by publicly publishing them.
2. The third party from connecting with any service providers requiring verification to share info?
And the precision of one year is way too low.
Responsibility really is the only fix here. I know we love technical solutions to problems but either porn is illegal for everyone or it isn't.
The German constitution actually provides for a "right to informational self-determination", i.e. any individual has the right to decide what happens with their personal information, including what websites they visit.
We also have a standard governmen-issued ID. In combination that makes it possible for private companies to offer web-based age verification, that check you ID-number against a government-provided service, verifying the age but not providing additional information. And because of the privacy laws, it would be a criminal offense to store the identity of the person being verified or for that information to be connected with the website you visit.
The website in turn gets a legal record that they verified the age of the person, but not necessarily the actual identity of the person.
Ideally, in the end each party only gets a piece of the total picture but by confirming to each other that the piece they have checks out, you can confirm your age to a porn site without any single party being able to piece the entire picture together.
A child could borrow an adult's card, but then the items would be shipped to that adult's address which could make it hard for the child to get them without that adult noticing, and the purchase should show up on the next credit card statement further increasing the chances the adult will notice if the child is surreptitiously using the adult's credit card.
Maybe even require the listing on the credit card statement to have a prominent annotation stating that there were purchases of age restricted products that month.
This wouldn't stop all such purchases, but it should make it harder and it should make it easier for parents to find out that it is happening.
One party to the debate claiming that the solution (age verification) to the problem (kids accessing adult content) is imperfect, is worthless.
We know what the position of the EFF or FSF is on the matter, they prioritize online privacy over kid safety, got it. But if the message is going to be that the solution has a problem and there is no more contributions, then the implicit proposal is that there needs to be no solution and the initial problem is ignored.
If the opposition to current age verification take this naive approach of denouncing age verification and offering no solutions, they will be kept at the sidelines while the adults vote in the senate for these solutions. Newsflash, you lost the debate, if you want back in, you are going to need more than this.
And we don't even have to speculate anymore what they are because the plan is out in the open. So when someone shows up with what is ostensibly a non-problem in the real world but the solution to which happens to be the legal tool they need for this other less popular worse thing they've loudly said they want I think it's normal and intellectually honest for that to be the analysis. "The EFF doesn't care about child safety" is exactly what they wanted you to say to dismiss any reasoned opposition.
How about recognizing the inevitable conflict between two priorities: kid safety and online privacy? Simple thing really.
Again, you don't need to do this, but you will be ignored and put in a kiddy table while the adults talk in the senate and in school boards.
Most schools have deep inspecting firewalls btw. Go tell them that it's an invasion onto kid's privacy, and that you should be able to speak with them without their parents or guardians snooping. See how they look at ya
That being said if I a parent at such a school I would assist my child in every way possible to make sure that their own browsing is exempted or shielded from such systems because I do think it's a violation of their privacy and that's my right as a parent but I digress.
If that same philosophy requires everyone to be subject to such a monitoring and filtering system by law then that's where I take issue. Because having teacher's credentials by virtue of being an adult isn't enough. I'm still being monitored and identified.
Do you really not see the difference between an opt-in filtering system controlled by the responsible party for specific children and a global mandatory filtering system controlled by literally the worst human beings alive? That have an explicitly adversarial relationship to you and control the global definition of child appropriate to suit their agenda?
And note that I haven't noticed anyone objecting to any client-side filtering approaches--I've even suggested one. We are objecting to mandated server-side verification because we know it's a camel's nose.
The privacy of attackers is a risk to kid safety.
The privacy of messages sent is a risk to kid safety (law enforcement should be able to access them)
The privacy of chilren activity is a risk to their safety (Parents should be able to view what their children do.)
However, I know of no children who independently acquired and maintain a device with a connection to the internet. Are you entirely sure we need a governmental edict to allow parents to monitor and influence what their kids see and do online?
Should law enforcement be able to access messages sent to my kid? I'm going to have to say no to this one.
And the reality is as always it's focusing on the wrong "threat". Like the vast majority of sexual abuse is by trusted people in the kid's life, not by anything on the web. The real threats on the web are social media and chat rooms, not the "naughty" stuff.
Or look at the perennial attempts to allow governments to block "child sexual abuse images"--since it's always done with hashes there's no verification that that's all they're doing. Think China wouldn't block images of tank man in Tienanmen Square?
In meatspace there are rules of how close those can be from schools and churches (of any denomination).
When the CDA's porn provisions were struck down, the sort of industry argument was that they'd use the PICS site ratings and the content could be blocked in proxy/client side. This made a lot of sense in the context of the V-chip mandates of the 90's. AFAIK browsers stopped supporting this a long time back.
No method of age verification is entirely actuate. It seem a hardline stance that we can't think up a process that would allow for a reasonable level of accuracy with privacy. It could literally be drawing a usb token from a bucket full of them after a human at the DMV visually checks your license.
[1]: https://www.independent.co.uk/news/uk/home-news/porn-passes-...
I should be able to prove to iPhone apps that I am 18+ (only a binary yes/no with no metadata) by the apps making a local API call to iOS, which checks this information with the unexpired drivers license on device.
We can do better with zero-knowledge-proof-based schemes, which also allow securely decoupling issuance/certification from online verification.
E.g. https://linc.cnil.fr/en/demonstration-privacy-preserving-age...
What if you're borth on March 1st and it's currently February 29, 18 years later?
Where's the stuff that isn't a smoke screen?
Pornhub publishes insights on their blog where they include an age/gender/country breakdown of their viewers. That data must come from somewhere, likely google analytics or something like it, which means that there is a thriving surveillance market whether there is age verification or not.
The surveillance is already happening, there isn't any need to backdoor it because it's already there.
People think google is a search company, but it's not. People think Facebook is a social media company, but it's not.
They are privatized intelligence companies, intelligence as in the I in CIA. And rather than that intelligence being used to, said charitably, make America a safer place, that intelligence is being leveraged to make rich people richer and less regulated.
Not enough of a spotlight is on privatized intelligence functions. It's no wonder it feels like corporations have more power than the government, they have access to mini privatized CIAs, with arguably much less oversight.
Data brokers. But that data isn't exactly accurate. Relatively over the large population yes. Accurate for identifying indivdual users: no.
Maybe we can even protect adults from being exploited online one of these days too (obviously not in the current US administration, but some day).
Texas' law, H.B. 1181, requires people visiting porn websites to prove their age by either uploading government-issued identification or a "commercially reasonable method" such as bank information. More than a dozen other states have passed similar bills, though they are all on hold pending what the Supreme Court decides.
> When I go to pornhub I have to click a button that days I’m 18.
if you were in Texas, it'd be not reachable at all [0]. this is due to a bill [1] that would have required Pornhub to use the more intrusive age-verification options. it also allows for significant fines for non-compliance. if a 16 year old kid used their 19 year old brother's ID to get through the verification, Pornhub could potentially be liable for up to $250k. and the broadest reading of that bill would mean that quarter-million fine applies every time a minor bypassed the age-verification check.
0: https://www.texastribune.org/2024/03/14/texas-pornhub-5th-ci...
1: https://capitol.texas.gov/tlodocs/88R/billtext/html/HB01181F...
no, that's not accurate. quoting from the bill:
> A civil penalty imposed under this section for a violation of Section 129B.002 or 129B.003 may be in an amount equal to not more than the total, if applicable, of:
> (1) $10,000 per day that the entity operates an Internet website in violation of the age verification requirements of this chapter;
> (2) $10,000 per instance when the entity retains identifying information in violation of Section 129B.002(b); and
> (3) if, because of the entity's violation of the age verification requirements of this chapter, one or more minors accesses sexual material harmful to minors, an additional amount of not more than $250,000.
if they don't have a system for age verification, the possible fine is $10k per day. run a website for a year, and then the Texas AG gets around to filing a suit against you? that's a possible 3.65 million fine.
the possible $250k is on top of that, if minors access porn on such a website.
crucially, the law says the age-verification system used must be "reasonable" which gives prosecutors a significant amount of leeway. does your porn site use Honest Achmed's Age Verification Service? if that is easy to bypass, there's nothing stopping them from arguing in court that you may have implemented age-verification, but you didn't comply with the law because you didn't use a reasonable verification service.
That said, as a parent to teenagers, I don't know that I believe that age verification is such a terrible idea. The reality is that there's a lot of fucked up porn out there and blocking it effectively across all networks and every device is non-trivial. I understand this is a minority viewpoint on HN.
Of course I have absolutely no interest in uploading scans of my drivers license to porn sites so I don't know what the right answer is. I'm sure there's some cryptographic scheme whereby a 3rd party could verify my identity without knowing for what purpose and then the porn sites could validate that verification without disclosing who or what I'm doing. I dunno.
Which is one reason that the EFF is trying to lay down their argument that the technology won't work.
I agree with you. I’m very pro-privacy/anti-surveillance and pro-freedom, so I’m entirely against the invasive ID-based systems, but the problem you highlight is pretty real and has to be addressed somehow, and I’m just not sure what the solution is.
As a parent of very young children, I’d hope that we’ve already figured this out by the time my children are teenagers.
Also, I doubt your viewpoint is actually a minority viewpoint here—it’s more likely those with your viewpoint just won’t post it here.
The solution is client-side filtering/blocking software on the machines you own. And if your response is "but that's hard", that should increase your confidence that server-side filtering and verification are unacceptable. If even tech-savvy people can't get verification working on a local device-- which has the full, correct context who is using it and what should be blocked-- then certainly it's not going to get any better by mandating a solution at scale on the public Internet, where there is much less context about the individual user, credentials can be mocked, proxies can be used, and so on.
Would you be okay uploading your ID to online gambling sites?
Louisiana, AFAIK Does not require age verification, but all of our traffic goes to Dallas, so we get lumped in with Texas.
Of course this raises questions as to what is the point of requiring verification that doesn't actually verify anything, but that's an entirely separate problem.
if you did check the other two, you'd notice that they're much more restrictive.
from the NY bill, apologies for the all-caps but it's in the original [0]:
> "IDENTITY VERIFICATION" SHALL MEAN THE USE OF AN ON-DEMAND SELF-PHOTOGRAPH TO VERIFY THE OWNERSHIP OF A PERSON'S GOVERNMENT-ISSUED IDENTIFICATION;
> "LICENSE VERIFICATION" SHALL MEAN THE USE OF TECHNOLOGY TO VERIFY A PERSON'S GOVERNMENT-ISSUED IDENTIFICATION;
and the one in WA [1]:
> For the purposes of this section, proof of legal age includes any of the following officially issued identification that shows the purchaser's age and bears the purchaser's signature and photograph:
0: https://www.nysenate.gov/legislation/bills/2025/A3323
1 (PDF): https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bills/Se...
2/3 examples being heavily exaggerated is a pretty bad look for the author (even though I agree with the article sentiment in general).
Like what public interest is served by having a date of birth entry or a checkbox for 'verifying' age?
To me it serves no public interest as it's functionally useless and it will only serve as a thin end of a wedge to normalize more egregious requirements.
To be clear: I'm strongly against any laws that require uploading government ID to sketchy websites, but at least 2 out of the 3 examples listed are not this.
If we trust the legislative to have a modicum of common sense and don't try to invent a technical solution to a non-technical problem, then a warning "what you're going to see is not for the younger audiences" might be a reasonable compromise.
And it's a shame we live in a world where the former doesn't sound completely nuts.
Either you believe the state is out to get you, or you believe that kids shouldn't access porn.
Free software maxis will tell you that age laws are surveillance and that child pornography is an excuse to have subpoena mechanisms.
And in fact, the Internet is not anonymous or private, as there are multiple ways to track and surveil members of the general public.
IMO the next step in the Internet's evolution needs to be the authenticated internet. An Authenticated Internet pretty much removes all the security issues, since every connection is authenticated. And authentication doesn't necessarily mean you're not anonymous.
Right now the Internet has become the worst of both worlds - not private, not anonymous, and all the problems associated with that (insecure, spoonable, etc).
That's what the EFF has wrong: the Internet is already a backdoor to surveillance. They're trying to stick their finger in the dyke. But what needs to happen is to rebuild the whole thing.
You can't block technology though. Government or not. People find a way.