Will California Eliminate Anonymous Web Browsing? (Comments on CA AB 2273)
blog.ericgoldman.org
blog.ericgoldman.org
https://blog.ericgoldman.org/archives/2022/08/op-ed-the-plan...
I don’t think we should have books moderate their content for children. The library, parents, teachers and everyone else responsible for children should take the responsibility to restrict these children’s access to material deemed inappropriate. This is how things have worked for countless years, and worked reasonably well. I don’t think controversial shoehorn legislation is going to work any better, but it will come with some downsides.
Things have never worked that way for any other medium. Mass internet access has only been around 15 to 30 years, depending on how you count it and arguably it has had disastrous impact on the well-being and mental health of children.
Yes, parents shouldn't be leaving their kids alone with the internet, but:
1. Many parents are going to a bad job at monitoring their kid's internet and if we can create rules that will leave their children less messed up, we should do so. We all pay a price when parents raise messed up kids.
2. Even for strict parents and well meaning children, it is so, so much easier to access poisonous things on the internet than on other mediums. It is hard to keep it out 24/7, it needs to be harder to access bad things.
3. As a strict parent, it sucks being stricter than all the other parents, sucks having to battle with kids about why their peers can do something they can't. Without common norms and common rules, their is an incentive for parents to defect by being the "cool" parent. And the reality of life is that no matter what parents do, teenagers are in large part "raised" by their peers. Teenagers view their peers as a source of authority because they have to live with their peers of the rest of their lives, peers represent the new generation. So what indulgent parents allow their children to do matters for my ability to parent my own child.
they've been working that way for every other medium. Some movies are good for kids, some are full of sex and gore. Parents have the responsibility to keep their kids from watching movies with content they don't want their kids to see. It's the same with TV shows and video games and books and music and plays and puppet shows. All of those mediums exist, and some content will be good for kids and other content is not intended for them. It has always been the job of parents to make sure they aren't sitting in their kids in front of things they don't want them to see/hear.
>Many parents are going to a bad job at monitoring their kid's internet... As a strict parent, it sucks being stricter than all the other parents,
"Being a parent is hard and some people do it better than others" is not a valid reason to censor content for everyone regardless of their age, or for forcing everyone to hand over personal information and identify themselves to access uncensored content.
Neither Comcast or HBO are going around checking IDs before airing Game of Thrones. I'm curious about which countries would require such a thing.
Ratings and V-chip use aren't enforced by law however. Ratings are intended to help parents decide what to allow their kids to watch, not to make the choice for adults or require adults to prove they are over a certain age to access content. V-chips give parents a tool to help block some things when and if they decide to, but most people never use it.
> Comcast and HBO refuse to sell their services to minors
ISPs don't sell their services to minors either. Adults sign up for services and it's their job to decide what their own children see on those services.
> Brick and mortar stores open to children do not display pornography
They do in the US. Any child can walk into Barnes & Noble and see porn on the shelves for sale, or open a book and read graphic descriptions of any number of sexual and violent acts. At the Barnes & Noble near me, porn is kept closer to the children's books than bibles are. Actually, any kid can walk into the store and open a bible and read descriptions of sexual and violent acts.
Libraries also do not police what content children can access within their walls.
> Providing this material to them is a crime.
Not at all, as shown above.
> Some places in the US did have laws regarding ESRB ratings on video games until SCOTUS recently overturned them. etc.
Another example of an overbroad and dangerous California law designed to "protect the children" and it's a damn good thing it was struck down by the courts. The government has no business policing what media I can see as an adult or in policing what media I can show to my own children.
https://www.fcc.gov/consumers/guides/v-chip-putting-restrict...
https://www.fcc.gov/consumers/guides/obscene-indecent-and-pr...
https://www.law.cornell.edu/uscode/text/18/1470
https://law.justia.com/codes/new-jersey/2009/title-2c/2c-34/...
Movie theaters and video rental places tend to refuse to serve minors for X or R material, and (if they look quite young) even PG-13 films. Stores may and often do refuse to sell R-rated films to minors. It may require active parental assistance for a minor to see those kinds of things (before the Internet, anyway—which is kinda the point of this whole discussion) and, even if enforcement is imperfect, surely serves to limit how much of that material even a very motivated kid can practically see (again, pre Internet, I mean). Also, kids have to get to those kinds of places, which can be pretty damn hard for them to do without a parent at least knowing they're out doing something, if not specifically what.
Broadcast TV stations risk FCC action if they show anything too outrageous when kids may be around, and have further restrictions even in night-time hours.
These behaviors are due to a combination of actual government regulation, and ongoing or historical credible threats of regulation if these industries didn't police themselves well-enough, which prompted the creation and enforcement of things like the MPAA's rating system (plus some now-defunct frameworks like the Comic Books Code or the Hays Code, both of which were much stricter than anything we'd likely accept these days—but for the "what's historically been within the Overton window of the freedom-loving United States?" perspective, those aren't that old and did co-exist with and apply to modern mass media, so still have some relevance).
The closest analog we have that I can think of is cable TV, since it's in the home and offers a whole lot of content, and even that tends to self-censor to a substantial degree and doesn't offer many of the worst things the Internet does at all—even on premium channels, which are another thing an adult has to actively work to bring into their house, totally separable from the rest of what cable offers.
Libraries are less-restricted and librarians seem to enjoy providing things a bit subversive (which is great) but I bet even lots of librarians would ask to talk to a parent before lending out certain books, let alone R-rated films, to young kids.
Support from outside entities—including, and largely, due to government action or threat of same—for parents to control what their kids see and hear is, as far as I can tell, the norm since fairly early in the days of modern mass media.
It's the Internet's model that's an aberration, requiring parents to take active steps to keep prevent kids from seeing hardcore porn or extreme violence or whatever on the same device they have to use to do homework, rather than having to take active steps to enable seeing those things, as they'd have to in most other contexts. Isn't it? Which doesn't necessarily mean these kinds of measures are a good idea, but I don't think "parents have always had to actively work to keep their kids from being exposed to awful stuff without substantial help from government and the private sector" really holds up, unless I'm missing something.
The Internet's unprecedented in its reach and being something that's basically required in a modern household, and required to allow kids some access to (again, it's not really optional for school anymore), but even other far less necessary media have had effective, if not perfectly iron-clad and universal, age restrictions imposed by businesses and the government. Right?
that isn't a law, movie ratings are a voluntary system designed to help parents make smarter choices about what they will allow their kids to see. It is not intended to police the actions of adults so that parents don't have to do their job. That's the extent of "Support from outside entities" that exists in all other mediums (with the exception of FCC regulations on broadcast TV and radio which were themselves commonly seen as a mistake which is why we didn't see them applied to cable TV, satellite TV/radio, or the internet)
> t's the Internet's model that's an aberration, requiring parents to take active steps to keep prevent kids from seeing hardcore porn or extreme violence or whatever on the same device they have to use to do homework, rather than having to take active steps to enable seeing those things, as they'd have to in most other contexts. Isn't it?
Nope. The same TV that shows sesame street shows porn, HBO shows both kid's movies and Game of Thrones, the same theater that shows G rated movies shows R rated movies, the same car radio that plays disney songs plays howard stern. It has always been the job of parents to monitor how children consume media. Always.
> I don't think "parents have always had to actively work to keep their kids from being exposed to awful stuff without substantial help from government and the private sector" really holds up, unless I'm missing something.
Having "help from government and the private sector" isn't the problem. There are lots of things the government and the private sector can do to help parents which would be perfectly acceptable. The rating system on movies is a good example. Requiring adults to scan their faces every time they want to access a website isn't one of them. Requiring adults to scan their IDs to every website they visit isn't either.
As I covered, most (all?) "voluntary" mass media industry regulation schemes have been much more of an outcome of "sort your shit out to our satisfaction or we'll regulate you into the Earth's core" grumbling from government, than actually voluntary.
Part of the trouble here is there's just nothing comparable to the Internet. The default before was "parents will have to work to enable their kids to access questionable material", not "parents will have to work (really, really hard) to keep their kids from accessing questionable material, including possibly by accident, and maybe stuff pushed on them by some god-awful 'algorithm' trying to radicalize them or push them into some other harmful rabbit-hole because it helps with 'engagement' or some other dumb-assed metric".
Again, the closest thing I can think of is cable, and that had a much more limited set of content and kept the adult stuff mostly opt-in (so, again, active effort required to enable it), plus cable TV was never 1% as valuable for getting by in modern society as Internet access is—the easy answer of "just don't pay for cable" doesn't apply to the Internet, and hasn't for more than a decade.
However, even with media that are far easier to keep out of the home, government pushes for regulation, and effective imposition of such regulation—de jure or, in fear of what de jure might look like, de facto—has been the norm. Much of this absolutely applied to what adults could access (see, again, the Hays or CCA regulatory regimes). As for "scanning their face every time they access a website"—in earlier situations in which a kid might access some piece of media a parent hadn't deliberately invited into their home, and in which some business was involved, everyone did get a face-scan, by the flesh-and-blood clerk, and since 1990 or so those situations almost certainly also involve being recorded on multiple CCTV cameras (and these days, having all that uploaded to god-knows-where and maybe even having face recognition applied to it—ugh, the Internet was such a bad idea)
Again, part of the trouble with these analogies is there's nothing comparable to the Internet. How do you have a clerk judge whether a person's face looks old enough, at "web scale" and before your web server sends a 200 response? You can't, really, but that doesn't mean something of that sort isn't typical practically everywhere but the Internet. The closest thing you can realistically do is automate that process, instead, to bring it back into something resembling the past norms.
This is, I repeat, not necessarily a defense of this kind of legislation as a good idea–I just don't think it actually is a deviation from what was the overwhelming norm for how society operated in most of the 20th century. The Internet free-for-all model is what's the odd-man-out.
I'll agree that the internet comes with it's own set of challenges, however computers enable unique sets of solutions. There is parental control software you can install, logging you can put in place, you can even screen-record and keylog everything that takes place on a device. Access can be restricted with passwords and devices can be set up to automatically disconnect the internet at certain times.
It takes some work to set those kinds of things up, but parenting has always required work. The internet has a ton of free resources to assist parents in that work. Nothing is perfect, but thankfully no kid ever died from seeing a boob either so mostly things tend to work out. My generation was online long before any parental control software or porn filers existed and we survived after all. Parents today have more tools at their disposal than ever.
Before, the usual way to keep your kids from seeing (very much, anyway—no system is fool-proof) porn or brutal violence or from encountering any excessively-weird or dangerous subcultures was basically do nothing—if you didn't try to bring that stuff into contact with your kids, odds were they'd encounter very little of it, and likely none unless they were themselves trying to find it. The Internet's flipped that around, so the default is all kinds of horrible stuff being not just available, but possibly pushed at people in your household, including kids, unless you actively work to avoid it.
The norm in earlier cases when others have some say in whether your kids can access such material, is that they're either prohibited by law from providing it, or else are following some prodded-into-existence-by-government industry guidelines that largely prevent access to it by kids. Parents didn't need to spend much time or attention policing that kind of thing, previously.
Not entirely all the ones that have already existed. Parents used to have to worry about what their kids would rent on their own from video rental stores, or who they were communicating with on teen party lines (look it up if that was long before your time) or the local BBS scene, or going back even farther if they were viewing lewd content in penny arcades or by sneaking into drive-in theaters or sideshows.
> Before, the usual way to keep your kids from seeing...porn or brutal violence or from encountering any excessively-weird or dangerous subcultures was basically do nothing
I'm afraid that's never been true. Arguably, it was much harder in past decades to monitor what your kids were doing because children were far more autonomous than they are today where many are tracked by GPS 24/7. If I were a teenager I think it'd be much easier to hide compromising polaroids and skin mags than to try to hide sexting and visits to pornhub from tech savvy parents. Really though the challenge is simply constantly evolving as old media dies off and new forms pop-up.
> The norm in earlier cases when others have some say in whether your kids can access such material, is that they're either prohibited by law from providing it, or else are following some prodded-into-existence-by-government industry guidelines that largely prevent access to it by kids.
I can say from experience that libraries don't care what you're reading and only occasionally care when you try checking the materials out. As a kid I was never told I couldn't purchase any book I brought to the counter in bookstores and many of them were not remotely appropriate for my age by most people's standards.
When video rentals were a thing the clerks would also routinely rent R rated materials to us as small children (although not 100% of the time). Record stores had zero issues selling music with 'scandalous' lyrics to kids even after parental warning stickers became a thing. Actually getting into an R rated movie as a kid was hit and miss if you bought the ticket, but most people I knew would buy tickets for a kid show and just enter the R rated show once inside (now that theaters have assigned seating that might not work as well today). I do think video game stores have been more strict comparatively because of all the attention on them from parents and media, but they've also been the most tame in terms of sexual content for the same reason.
Generally kids have never had much of an issue finding ways to get into trouble and there's nothing more appealing than the forbidden. I think every generation's parents had to stay on their toes and put in genuine effort to restrict what their kids were seeing and doing and usually with only very limited success.
Then we should make a law that holds parents responsible for poor decision making. It's not incumbent on anyone else to make the world a "less messed up" place for them, I had zero say in whether you got to have children or not.. you just decided to do it one day.
Further, most of us don't believe that this law as written or any law in general stands a chance at actually addressing your claim. This law does a really good job of protecting entrenched entrants and denying new startups access to the internet by creating unnecessary technical barriers that cost a lot to erect but don't actually protect children.
It's the worst of all outcomes, if you actually care about "messed up" children.
> it is so, so much easier to access poisonous things on the internet than on other mediums
Is "two children talking to each other" a medium or not? If so, I don't think the internet holds a candle to this.
> it sucks being stricter than all the other parents, sucks having to battle with kids about why their peers can do something they can't.
So.. because some parents find it hard to be strict, we have to force all parents to be strict. And if they aren't? Should we take their children away? I mean, if they're too tempted to be "cool" then we shouldn't even allow that to occur under any circumstance, should we?
If done right, it might actually be seamless, much unlike the GDPR pop-up which needs to be manually cleared.
Sites for children typically have strict moderation, or more often, do not have user-generated content.
That puts most of the burden on the poster, and checking the occasional box is not much of a burden. And these days it also acts as a great tagging system for automated ML filters. Combine that with good tools for users to report violations, and the burden seems pretty manageable.
And honestly, it might lower site burdens. If people only see what they want to see, it could reduce user friction and incoming reports.
Create a standard header with a "Parental Advisory" PG kind of label. Then let the consumer decide what to do with it. The web is "content", and it is up to the parents to decide how to police their kid's content consumption (same as with music, video, etc).
Then we can start talking about Operating Systems, Browsers or Access points features allowing parents to block pages with specific PG ratings.
Lack of label should be equated to UNRATED, just like for movies. By _default_ the Internet should be for Adults who have their own right to choose what they see or don't see.
Let the OS / browser / etc WHITELIST things based on a claim something is safe for children, or rated in an academic context (E.G. Wikipedia / medical / etc).
Also interesting is this site: https://www.doesthedogdie.com/
Maybe this could go beyond parents. There are whole classes of image that I'd like to have to choose to see. E.g., if I'm eating breakfast and scrolling through Twitter, I don't need to see, say, mangled flesh in an accident photo. If there were standardized content tags, then parents could tell browsers to block outright and adults could make it click-to-view.
As a parent, I wholeheartedly agree. It's not the government's job, or anyone else's job besides mine, to determine what content my children see or do not see.
Congratulations, you've now managed to leak enough datapoints to be deanonymized.
Do not do this.
It is also a super terrible user experience, since now, changing the driver of the web browser requires what amounts to a login.
I repeat, do not go down this road, there are bad things there.
I think a header field that classifies the content could help. The client needs to do the filtering.
I will never use a OS account synced at the OS provider.
> require a business that provides an online service, product, or feature likely to be accessed by children to comply with specified requirements, including configuring a requirement to configure all default privacy settings offered by the online service, product, or feature to the settings that offer a high level of privacy
I'll take that as an adult. I hate having to go through the settings of a newly installed application to disable all privacy violating settings.
Also, if someone can point it out, where does it say that it'll require every website to authenticate the users age?
Section 1-5: (5) Children should be afforded protections not only by online products and services specifically directed at them, but by all online products and services they are likely to access. In order to help support the design of online products, services, and features, businesses should take into account the unique needs of different age ranges, including the following developmental stages: 0 to 5 years of age or “preliterate and early literacy”; 6 to 9 years of age or “core primary school years”; 10 to 12 years of age or “transition years”; 13 to 15 years of age or “early teens”; and 16 to 17 years of age or “approaching adulthood”. adulthood.”
I don't know if I fully agree with it being required on every website but the arguments claiming that typically seem to say: Who gets to define "likely access"? If a website link gets posted on a kids forum or social media does that not mean the site will likely be accessed by children?
I don't like this bill and think it is at best an example of the politicians' syllogism and at worst a trash fire of regulatory inefficiency, but it would be good to analyze and complain about the actual indicators mentioned in the bill now that they exist as otherwise the people working on this bill can (and in my experience will) discount your complaint as "we already fixed that".
Quite the opposite. Most dissent since the time of print has been anonymous, and plenty before then. Society feeling that every utterance or bit of expression has to be assigned to a specific identity is quite a new concept, especially because it's only begun to become technically feasible.
AI is automating this process at scale.
You can do this with non-anonymous discourse too but anonymity just makes it easier.
The future is private forums, channels, Discord/Slack instances, invite-only private networks, etc. The public web and public social media are entering their twilight.
This bill sucks, but it's no real threat to "anonymous dissent".
My understanding is that the bill applies to the same businesses that the mentioned law does. Considering California has 40M people, that's not a cohort businesses can shut off from the internet.
Many US websites now block Europeans because they don't want to bother with the GDPR and I would not be surprised if the opposite starts happening too.
"For many websites that target a global audience that would not be a big number to lose out."
Now replace that with India, Germany, Japan, France, or Britain; because California is in the same economic tier as those countries.
I'm sure sites that are not specifically targeting the US will consider this too if it becomes too much of a burden.
As someone who lives in a 447-million European Union and who keeps on getting HTTP 451 responses from various US-based services and websites after GDPR has gone into effect, I can't help but chuckle at your comment.
This is a very different proposition than saying that Tik Tok, Youtube and Facebook would block CA-based users. In addition to the obvious fact that they all have hundreds or thousands of employees in CA, they would be forgoing one of their most important markets in terms of advertising. Furthermore, a lot of the top creators on these platforms live in greater LA.
It's a non-starter. If you're doing anything social for anything that's not an domestic only market (e.g. VKontakte, WeChat) then you need California.
> have concluded that the cost to comply with GDPR is likely to be more
> the than the revenue that could be gained by allowing the occasional EU reader
GDPR looks easy to comply with if you imagine you work for the newspaper. Instead, imagine that you literally are the person who currently works for the newspaper and it will become a bit more clear why they've made the decisions they've made.
I almost don't mind the idea of just 451'ing California and telling them "Sorry, your politicians are REALLY fucking dumb". It would be waaaaaaaaaaay easier than putting up with this absolute walnut-brained moment.
The craziest thing about the lack of data protection laws in the USA is just how EASY it is to glean WAY TOO MUCH INFO on any American. I need to know two data points about you (say your last name and phone number) and from that it costs me like a few dollars or maybe more for more info (on pipl they jacked up the rates really hard), and I can tell you stuff like "Oh yeah your grandpa died in the holocaust" - All this barely knowing who you are, and getting access to these APIs is like a written test away in many states for a PI license. It's completely fucked.
A: follow Californian law to get ads and income, even though you're in some other part of the world, or
B: Don't follow Californian law,get no ads, thus no income and no site.
The reason for this is that the companies that can give you ads on your website are mostly in California and needs to follow Californian law. If you want their ads, you'll need to follow Californian law too.
One potential outcome, at least for US businesses where their legal teams believe they have some nexus to California, will be either:
1) apply these rules to any incoming California IP address;
or
2) apply these rules to everyone, no matter where they are located.
Naturally, the easier route above is to just do #2, which means these changes could, much like the EU's GDPR resulted in paranoid legal teams adding "cookie banners" everywhere, impact all sites that have any US presence at all.
Shoutout to this [1] firefox plugin that I rely on daily
Laws like this do not apply to IP addresses AFAICT, they apply to people. Someone CA law applies to can access your server using a non-CA IP address and someone not restricted by this law can access your server using a CA address. I'd be surprised if you'd be "off the hook" for a child covered under this law accessing your service via a VPN. And, as a user, I'd be upset if I couldn't access your site using mullvad.
I wonder if banning CA users in your ToS is sufficient for passing the burden of this law down to CA residents?
See also: GDPR compliance by US websites.
To respond to the question: yes, it will.. it will polarize and strengthen the darknet, first. Your ordinary Calif. consumer will have to buy more things, second. Fines and lengthy, pointless court action, third.
This just says: don't collect info on children you don't need and assume people are protected unless you verify otherwise.
Just don't collect the info you don't need. Seems straight-forward to me.
Now you need to take steps if "A significant amount of the audience [...] is determined, based on internal company research, to be children."
I don't see anything about requiring every site to check if every visitor might be a child and keeping that personal information for compliance. I don't know where this rhetoric comes from.
But still somehow, there is this feeling that giving the government more power is good.
When the government actually does get involved it’s a different thing.
Nobody should have to fork over biometrics and government IDs to get on the web.
I'm pretty sure some of the websites I'm running are breaking laws in about fifty countries, but I don't care because I don't live or do business there.
And the 'business' requirement is more about "doing business" in the state and not "the service provider is a legally registered business", so individuals also must comply.
I think you are underestimating the impact. Anything that stores account names or emails (forms, comment sections, commerce sites, ...) is a very broad list.
Even if none of this is true and you ONLY serve static content without analytics delivered to the user you are not guaranteed to be safe. Apache by default logs IP addresses [1].
[1] https://www.ptr.co.uk/blog/which-ip-addresses-have-accessed-...
[0] https://www.howtogeek.com/701176/does-apple-track-every-mac-...
It's an arms race all the way to the collapse of the system (or revolution). Rinse, repeat.
How easy is it to hack an iPhone to make it run unsigned code, which reports to a remote server that it is running the latest iOS version (with the correct cryptographic proofs)?
Maybe other phones are more hackable right now, but I'm sure Apple wouldn't mind lobbying for a law that requires phones to meet the same standard as them, and that makes ISPs / mobile networks refuse access to any device whose Secure Boot implementation has been circumvented by "independent researchers".
Five years from now, the only people inconvenienced by such a draconian law will be 1) those whose phones run on completely Free Software, and 2) those who illegally import devices that use unpublished zero-days in order to commit highly profitable crimes online. Both groups will probably end up paying thousands of dollars per device, but governments will not care about the desires of either of them.
But but but, we gotta protect the children.
But but but, we gotta stop people from saying bad things that could hurt the feelings. Free speech bad. Must regulate speech.
Cycle forward a decade: the government is going too far! This is outrageous! Too much surveillance! Muh privacy. Who gave them all of this power?!?
Yeah, gee, who indeed.
But at the same time I’m very much not into great firewalls.
Not to mention all the patent trolls. Have login functionality, there's another lawsuit threat you're going to have to settle for $10k.
Whether this is accurate or not, I think it's clear the deluge of privacy legislation will have the opposite of the intended effect in terms of empowering the facebooks, googles, etc who can afford an army of lawyers, privacy engineers, privacy ops people, etc.
Is CA just relying on the crunchy state politics plus the right-biased SCOTUS to pass this with no challenge?
But it's likely not true of Thomas. Is it true of the rest? Who knows. The liberals might well side with California's liberal government. Hard to say. Even if that would surprise you, Scalia's turn in Raich surprised many. It's hard to predict the SCOTUS' decisions.
I suppose that the love/anxiety for children is the same everywhere. For example many parents are currently concerned with "screen time".
https://www.weforum.org/agenda/digital-identity/
The goal is to de-anonymize all dissent, and unperson anyone who dares criticize the regime. See: Canadian truckers, Australian anti-lockdowns moms, etc.
If you want to protect children from adult content, just require ISPs to block a list of explicit websites unless the service owner opts-in.
Now all I read is “websites must collect a ton of personal information about you and send it to the government to verify your age, and also tell them all the websites you visit.”
Why are we so worried about corporations getting our data? The worst thing they’ll do is try to sell me something. It’s the government I’m worried about - they can do far worse.
None of this is in the bill though.
There's a case pending about the impact of their recent legislation on humane livestock handling for meat sold in California. Regardless, of how people feel about the livestock issue, single states should not be able create legislation that forces entire national and international industries to re-tool.
If you want to do that you should be a country, not a state.
California has substantial market power. It is entirely within its rights to dictate how things will be done within California. If that means that some companies then feel some financial inventive to do it that way in general because it's easier, then that's just too bad.
What we need is basic, common sense legislation that says:
- Gather no more data than you need for business purposes. Persist even less. If you can't express a specific business purpose for the data, you can't gather it.
- Share no more data than you need to for business purposes, and with as few parties as possible.
- Publicize those specific business purposes paired with what categories of data you collect, and who you share it with. This should be a table, with 4 columns: "category", "justification", and "Shared With", "Duration".
- Whatever data you do gather, you're liable for, with good-faith attempts at following industry best security practices being an mitigating factor but not a complete defense in civil suites following a data breach.
The GDPR didn't go far enough: the law should be explicit in stating that the user CANNOT consent to data being gathered about them in excess of what a service they are actively engaging with needs for legitimate business purposes. The less wiggle room you give, the less ridiculous, user-hostile attempts to circumvent the law you'll have.
I suppose this raises the question how will California enforce this?
A superficial understanding of current adtech points that Ad companies increasingly use IP to show the type of ads - and that has a potential to misidentify who's on the user end: a grown adult looking for some intimate connections or an underage child who shouldn't be exposed to gambling, betting, pornography and the likes.
With GDPR, one consequence of the vagueness is the current hellscape of ubiquitous cookie popups on the web, most of which don't actually comply with the regulation, and most of which have not actually empowered consumers in any way.
I don't know why we are discussing a law that was passed yesterday under a link to a two-month-old review of a different version. That seems a bit contrary to "news".
Of course because this doesn't profit companies like Google or Facebook, they'll do anything they can to promote voices opposed to it. And because they control what most people are shown as "the Internet", they might succeed.
A properly working, democratic government is the only thing that can protect the society from corporations. If you trust the government less than corporations, it's probably because your government is shit.
Corporations need to make something useful to someone to get their profits and they are also kept in check by their competitors (unless they have a government-granted monopoly, of course).
Governments only need to fool enough voters to get re-elected. That is easily done these days with media, propaganda, and plenty of populism (vote me and I’ll steal from creators and throw some your way). Most governments on the planet are shit, both historically and presently.
Facebook is indeed an excellent example of an often vilified corporation which is:
1. not a monopoly (plenty of competition around, from twitter to tiktok and even this very site)
2. providing its services to users happy to give their attention and privacy in return
3. easily replaced - my kids don't even use it and escaping it is simply... not using it really
Good luck buying law enforcement, roads, or healthcare, on a free market.
Once again - consider moving to a country that’s not shit.
tldr; no.
The author is right that:
1. Every single website and app regardless of whether it is specifically built for kids or not is covered by this bill, and
2. It is virtually impossible to identify and segment your user base and apply the bill's protections to only those you can 100% confirm are under 18.
So, the likely outcome is that this bill becomes an enhanced CCPA and something businesses have to generally comply with for every user.
Looking at the actual contents of the bill though, my response to that is – great! I do want to be treated like a child online. I want sites to present terms of service in a language I can understand. I want them to set my account's privacy settings to the highest offered by default. I want apps to remove dark patterns that get me to spend money. I don't want them to store my data unless using it to provide a service. I want them to tell me up front if my browsing is being monitored by someone else. I want actual consequences if a company decides to leak all my personal data. (All of these are provisions that will be enforced).
The author is critical of the bill as a whole but I don't see any argument against any of the individual provisions. I also don't get where the "eliminate anonymous web browsing" in the title comes from. If anything it will make it less likely for sites to track you.
Further, business do not want to be in charge of validating PII information, nor do they want to place roadblocks to casual users. The darn cookies and GDPR popups are already annoying enough. Are we trying to make the web unusable?
This is just insanity, and will lead to a bunch of ecommerce businesses and website companies leaving CA. ie, no one will comply unless they have absolutely zero other choices.
the majority of the bill is restrictions on collecting personal information in general
I'm not sure most ecommerce sites would meet the criteria as something marketed and targeted at children
I agree that 'likely visited by children' is nebulous but this seems to be heavily aimed at live streaming/recording services(twitch, tiktok .. etc), large public social forums (discord) and things like youtube kids
Making a person/business predict someone's age over the internet is just absurd... and fallible... so you will have verify identity.
A business that provides an online service, product, or feature likely to be accessed by children.
"Child" or "children," unless otherwise specified, means a consumer or consumers who is are under 18 years of age.
[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
This seems stupidly vague.
If people/businesses have to guess at what's compliant, then they will often choose the most restrictive form of compliance out of an abundance of legal caution.
(4) “Likely to be accessed by children” means it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children:
(A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.).
(B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.
(C) An online service, product, or feature with advertisements marketed to children.
(D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).
(E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.
(F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.
None-the-less, the above applies to all websites unless you want to chance being a test case (and no one does). Child is defined as anyone from 0-18 years old, which is an incredibly broad category.
Ever once talk about music on your blog? Talk about food? Cars? Games? Math? School? Clothing? Programming? TV Shows? Upcoming movies? Flying airplanes?
All of these things are of interest to folks 18 and under too... you don't have to have a blog about Blue's Clues to fall under this deliberately vague, ultra-wide net.
Don't get me wrong, this looks like a garbage law and I truly hope every California resident is writing or calling their elected representatives to complain about it in specific and excruciating detail, but acting like every nerd's low traffic weblog is putting them at risk of civil action from the State of California strikes me as somewhat hyperbolic and misleading.
(C) An online service, product, or feature with advertisements marketed to children.
(D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).
(E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.
Take a look at Michael Dominick's SE blog: https://dominickm.com/
The home page alone violates all of the above.
Lastly, "Business" is not defined here, which is odd since these consumer protection laws always define explicitly who they apply to.
I have extensive experience with P65 and ADA compliance - so vague laws like this one really scare me. The only saving grace here is there is no Citizen Enforcement provision - ie. the AG has to bring suit. Which also means voluntary compliance will be low until the AG makes an example of a few unlucky website operators...
So if you write an extremely technical blog that happens to include a cartoon avatar, is your blog directed at children? Example: everything on this blog https://gankra.github.io/blah/deinitialize-me-maybe/
If you're defining "child" to mean 5 year olds, I completely agree. But I'm almost certain that there are 17 year olds out there who are world-class Rust programmers who are reading that blog.
"Sorry kid. We're deleting your question and banning you."
Kids are curious. They go places to see what's there. Kids visit your blog, whether you intend for them to or not. (They may not come back for a second visit, but a number have come for a first...)
Also, to be clear, I'm not trying to be pedantic or split hairs here, I'm trying to explain my own actual thought process in reading the law and considering my own risk/exposure. As I mentioned in a reply to a sibling comment, this law looks genuinely awful, but I'm not going to lose any sleep over the likelihood of getting sued by the state of California for a personal website where I mainly make a half-assed effort to write about the nerdiest shit possible (i.e. computer programming and board games that are best played with the aid of a spreadsheet).
Deliberately vague...
There are several web forums I’ve visited that allow anonymous accounts to be created and allow commenting. They are well-moderated. Some were also very niche and run by like one person. Making a law like this is a one-way street that could potentially destroy that capability, some of the best parts of the web.
I hope your comment was just being sarcastic.
Says who? You just made up a random scenario.
In theory anonymous and instantaneous commenting is an ideal of free speech. In practice it repeatably seems to just become wasteland.
It's kinda the same reason the site is accessible in Germany/UK/whatever despite violating every hate speech law in there jurisdiction
which website doesn't? I can only imagine the high quality discussions that such a site encourages.
Privacy already doesn't exist online. And discussion and commenting (anonymous or otherwise) have been absolute net negatives for "free and open" society.
This law doesn't appear to cover content, just what information you are supposed to collect about your users.
Presumably the author is assuming that websites would prefer to offer no functionality at all to age-unverified visitors than to offer the child experience. In such a world, every website would presumably require you to login (to prove your age) before offering even basic functionality.
With such a system, private/incognito browsing would be obsolete.
I mean, 1. if respecting user privacy means you actually have to shut your doors, well... bye. The web is probably a better place without such a site. And, 2. that's almost never the case. As soon as the regulation takes effect, companies all of a sudden find ways to comply and go about their business making money. It's all knee-jerk complaining.
I see your point, but smacking down a state for having different principles is a violation of the principles of federalism. If federalism means anything, it includes the freedom for a state to make its own experiments in democracy as long as they don't cross enumerated federal powers.
If this bill treats people from different states differently then it is vulnerable to the commerce clause, but that isn't clearly the case.
California regulation has affected people outside of the state since long before the internet. If that's enough to toss out federalist principles and to handcuff a state beyond constitutional justification, then federalism is quite weak.
Your argument seems to be that federalism should be ignored here in order to protect the integrity of federalism. I'm not understanding how that works.
BTW, I very much disagree with California's direction here. I moved out of the state after growing up and living there for 37 years because of this kind of policy making. But as a federalist I value their independence more than their correctness.
Quite the opposite. This is exactly the definition of federalism.
Here the key question regarding interstate commerce should be about who must comply with this law (if it becomes law). California wants it to be "businesses" with a "nexus" in California, but that seems like rather expansive. But finding a more limited way to specify "California businesses" that isn't also de-fanged is very difficult in today's world.
Still, now, suppose that Texas or Florida had conflicting laws? Then what?
> It is virtually impossible to identify and segment your user base and apply the bill's protections to only those you can 100% confirm are under 18.
Doing this might be(come) possible by completely destroying anonymous web browsing.
How? Idk and it wasn't mentioned, but you could imagine Credit card checking, Electronic IDs, post-ident maybe backed into the browser for a one-click identification.
Though it's all a hypothetical on unwanted side-effects. I don't think it too concerning as people value random websites less than their personal data and I'd expect websites using the "everyone is a child" approach to have the advantage.
No more firing up incognito mode to view some YouTube video you’d rather not feed your algorithm. No more browsing the ‘other side’ on twitter privately. No googling for information about embarrassing rashes without Google and webmd knowing exactly who you are.
This is not cool.
I agree with you on principal and don’t mean to sound dismissive but they’re all doing this already.
When I’m trying to look at anything on Twitter it shortly launches a full screen thing demanding I login (I refuse to sign up).
YouTube requires sign-in for age restricted content.
Google, most annoyingly, makes me complete several captchas for using incognito+private relay
Instagram won’t open in safari with incognito+private relay; I have a throwaway account for just looking at the odd link someone sends me in a meme group-chat; I have to use another browser.
I often have to replace “www.whatever.reddit” to “old.reddit” on my phone to be able to see an “age restricted” post, most of the time they aren’t anything a kid shouldn’t be see either, not sure how they’re determining that.
That's debatable. People would balk at the friction and invasiveness of typing in their cc details on every search result, but an automatic tool integrated into a browser could see wide adoption. Virtually everyone just accepts whatever privacy policy and cookie notice is blocking the content on random websites.
That's what you want, but you may not get it.
What you might get instead is:
- no service unless you "prove" you're over 18
- privacy-invasive age proof
- no service at all if you're in CA
And, the user experience will be restricted (no commenting, video uploads, and who knows what "safe" means).
I suspect this will be used for selective political censorship.
The truth is that there is no such dichotomy. Ads do not need tracking/"personalization", and if tracking/data collection were made illegal, there would be no commercial advantage for the scummiest "ad tech" company.
(I'm not commenting on the California legislation, but just generally in response to parent)
Many of us don't want to be treated like children, much less have the government mandate that we treat everyone has children. We already have a mechanism for protecting children and filtering what they are exposed to, this mechanism is called parents. If this mechanism is broken, then we should work on ways to fix the mechanism instead of deciding that we will simply treat everyone as children and absolve parents from their parental responsibilities.
Isn't providing a server you can access "providing a service"?
You folks (not specific to the OP here) have to stop assuming everyone has the same amount of free time as you do, or perhaps some of you folks don't have kids and don't realize just how much time and effort they are!
Here's what I think, but every parent needs to decide for themselves: like it or not, the Internet is an integral part to socializing today. Not allowing your children to socialize this way will hinder their social development, especially when you have no control over them in 0-18 years from now. They need to be able to learn about how to behave on the 'net from a young age, with good supervision and guidance. Sometimes it's good to prevent a child from doing something harmful, and perhaps limiting their screen time in certain ways is necessary, however an extreme version of what you say (15 minutes) is definitely going to hobble their social lives at some point.
For millions of years kids never had running water in the home and they grew up just fine. In fact they grew up with fewer cases of depression etc. I’ve got a kid and I don’t let them use a sink, bathtub, or toilet unless I’m there interacting with them, doing stuff together. Maybe I’ll let them watch for 15min for a job well done but not for hours on end.
I think shadow bans are applied to accounts rather than comments on this site.
TBH "this site loves authoritarianism" seems a bit over-dramatic. But I guess we'll see what happens...
Charitably, they want to protect neglected kids. Uncharitably, they think they know what’s right for everyone and want to institutionalize it.
But most of supporters probably either have no kids, adult kids, or kids who they think they parent well enough to not be in danger.
I don't believe we're on a path for this to get better either.
This is why I'm generally in support over codified + regulated child protection acts, especially the online ones.
I said "This is why I'm generally in support over codified + regulated child protection acts, especially the online ones." This is clearly not advocating for a "nanny-state." I'll rephrase in case I was misunderstood: I am generally in support of online child protection acts.
> Am I correct to say
I think it's clear you've already made your mind up by pushing what I said to such extreme examples: "nanny-state," and claiming I'm advocating for the government to fully take care of children/adults.
We need to move beyond the “it’s a melting pot, everyone has their own way” and realize that people are making babies with little understanding of how to do more than keep them alive.
There is a whole field of early childhood development and another in early childhood education and none of it is taught except to specialists.
edit: I realize this is imperfect but I believe it is better than doing nothing or regulating actual reproduction (however you propose to do that).
I do not, in any way, support this bill. It's idiotic. I do, however, have some sympathy for parent who are not technically savvy, do not know how to block unpleasant content from the internet, and do not watch their kids all the time. If they did watch their kids all the time they'd be called helicopter parents so there's really no winning.
I'd be more motivated to sneak around my internet activity just so I could watch something embarrassing like Smurf cartoons.
Do you think there ages between 7 and 14 when kids should be allowed to watch videos unsupervised and kids should have some form of filtering they don't see inappropriate content? If so, who will provide that filtering? You probably can because you post to HN but not every parent will have that skillset
The parent ostensibly purchased that device from a business. That's where you apply the fix, not to the internet in general. This is like trying to put the cat back in the bag by legislative fiat.. I expect the same results.
"Provide an “obvious signal” if parents can monitor their kids’ activities online. How does this intersect with COPPA?"
Are they saying they are going to warn the kids that their parents can check up on them?
Are they utterly insane, or did I read this wrong?
Try it sometime. If you see a title question mentally just say “no”.
The reasons for this law of media are manifold but boil down to 1) if there was evidence that the thing would happen they would state it. I.e. this title would read California will eliminate..
2) there is no 2
What’s left is for you the reader to try and figure out why the author is trying to scare people by posing a question even they know can only be answered in the negative.
"tome's law: In any discussion about an article whose title is a question, Betteridge's law is mentioned with probability 1."