Hacker News Reader

Comment by paxys | Hacker News Reader

https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...

The author is right that:

1. Every single website and app regardless of whether it is specifically built for kids or not is covered by this bill, and

2. It is virtually impossible to identify and segment your user base and apply the bill's protections to only those you can 100% confirm are under 18.

So, the likely outcome is that this bill becomes an enhanced CCPA and something businesses have to generally comply with for every user.

Looking at the actual contents of the bill though, my response to that is – great! I do want to be treated like a child online. I want sites to present terms of service in a language I can understand. I want them to set my account's privacy settings to the highest offered by default. I want apps to remove dark patterns that get me to spend money. I don't want them to store my data unless using it to provide a service. I want them to tell me up front if my browsing is being monitored by someone else. I want actual consequences if a company decides to leak all my personal data. (All of these are provisions that will be enforced).

The author is critical of the bill as a whole but I don't see any argument against any of the individual provisions. I also don't get where the "eliminate anonymous web browsing" in the title comes from. If anything it will make it less likely for sites to track you.

View on HN

> ...great! I do want to be treated like a child online. I want sites to present terms of service in a language I can understand. I want ...

That's what you want, but you may not get it.

What you might get instead is:

  - no service unless you "prove" you're over 18

then, to add insult to injury:

  - privacy-invasive age proof

Also, you might instead get:

  - no service at all if you're in CA

Being cynical for a moment, I'd say: you'll never get what you want.

If a service wants to place these restrictions then sure, a competing one will pop up to take its place the next day. I will happily build one myself.

This becomes an issue when ad companies put unverified users on a lower tier.

And, the user experience will be restricted (no commenting, video uploads, and who knows what "safe" means).

I admire your optimism.

It's worth mentioning that there was also a very controversial post on HN about Chinese game companies having to do exactly this. There were discussions about things like using cameras and machine learning to verify someone's age but that also is putting a camera into the room of a child (nothing can go wrong here...). There are people condoning as well as advocating for these systems. But I think we're coming to a turning point in our society where we are going to either abandon privacy all together or shift away from surveillance capitalism. Either option will have dramatic changes on our society.

https://news.ycombinator.com/item?id=28356141

Any legislation that is known up-front to affect all websites on the Internet associated with any business is, to me, bad legislation. I'm surprised you can support any kind of regulation that is consistent with your #1. Fundamentally any kind of regulation of internet websites ought to be at least partially directed by the counterfactuals. In other words, big sites and small sites are different things, and should be regulated differently in almost all cases. Otherwise you will eventually stop having small sites, since the regulated needed for big sites will be imposed on them too, until it is too burdensome for them to exist. This would effectively kill the Internet/WWW as it is today.

Yeah, I think people underestimate that risk and what it means long-term. Do we want to solidify the web as purely just an access point for one of a dozen huge platforms?

There are several web forums I’ve visited that allow anonymous accounts to be created and allow commenting. They are well-moderated. Some were also very niche and run by like one person. Making a law like this is a one-way street that could potentially destroy that capability, some of the best parts of the web.

The article makes a decent point: Websites will have an incentive to prove their visitors are not children.

> It is virtually impossible to identify and segment your user base and apply the bill's protections to only those you can 100% confirm are under 18.

Doing this might be(come) possible by completely destroying anonymous web browsing.

How? Idk and it wasn't mentioned, but you could imagine Credit card checking, Electronic IDs, post-ident maybe backed into the browser for a one-click identification.

Though it's all a hypothetical on unwanted side-effects. I don't think it too concerning as people value random websites less than their personal data and I'd expect websites using the "everyone is a child" approach to have the advantage.

It could be done by requiring client side certificates and creating issuing authorities for them.

This is a fascinating idea. The only way to preserve a modicum of privacy would be if the certificates are issued by a privacy-regulated authority, are not directly attached to your identity, and are trivial to renew / replace, but seems doable

Yeah I agree, but doubt the senate's ability to understand the concept, much less draft regulations that enact it.

The how isn’t the point - the point is that the what means the end of anonymous casual web browsing.

No more firing up incognito mode to view some YouTube video you’d rather not feed your algorithm. No more browsing the ‘other side’ on twitter privately. No googling for information about embarrassing rashes without Google and webmd knowing exactly who you are.

This is not cool.

In my humble opinion, children should be prevented from browsing much of the horrific content and/or pornographic content on the internet, and I think it is worth thinking about how to prevent it.

> No more firing up incognito mode to view some YouTube video you’d rather not feed your algorithm. No more browsing the ‘other side’ on twitter privately. No googling for information about embarrassing rashes without Google and webmd knowing exactly who you are.

I agree with you on principal and don’t mean to sound dismissive but they’re all doing this already.

When I’m trying to look at anything on Twitter it shortly launches a full screen thing demanding I login (I refuse to sign up).

YouTube requires sign-in for age restricted content.

Google, most annoyingly, makes me complete several captchas for using incognito+private relay

Instagram won’t open in safari with incognito+private relay; I have a throwaway account for just looking at the odd link someone sends me in a meme group-chat; I have to use another browser.

I often have to replace “www.whatever.reddit” to “old.reddit” on my phone to be able to see an “age restricted” post, most of the time they aren’t anything a kid shouldn’t be see either, not sure how they’re determining that.

It could also be done by requiring you to submit a photograph of yourself and your state-issued ID with intact image metadata. I wonder which would be less expensive to implement, and which would be simpler for a customer base to adopt.

> people value random websites less than their personal data

That's debatable. People would balk at the friction and invasiveness of typing in their cc details on every search result, but an automatic tool integrated into a browser could see wide adoption. Virtually everyone just accepts whatever privacy policy and cookie notice is blocking the content on random websites.

> I also don't get where the "eliminate anonymous web browsing" in the title comes from. If anything it will make it less likely for sites to track you.

Presumably the author is assuming that websites would prefer to offer no functionality at all to age-unverified visitors than to offer the child experience. In such a world, every website would presumably require you to login (to prove your age) before offering even basic functionality.

With such a system, private/incognito browsing would be obsolete.

Which is a weird thought process. Would a site rather get rid of 99% of its user base overnight (by making them go through identity/age verification) or change some basic privacy policies to be compliant with the law?

I think I’d really enjoy competing with those who force logging in for viewing a website.

In the usual submarine fashion the actual text of the bill includes "privacy, safety, and well-being". So its rather unlikely that political censorship will be enforced via the privacy clause, but everyone wants to "save the children" so there will be massive government censorship via the "safety and well-being" clause.

We had the same complaints when GDPR was starting to gain steam: "Surely websites would rather just 'go Galt' and shut down than lift a finger to comply with any regulation!" In fact, that's a pretty standard (and IMO ridiculous) talking point from all kinds of businesses when it comes to regulation. We'd rather stop making money than comply with new laws!

I mean, 1. if respecting user privacy means you actually have to shut your doors, well... bye. The web is probably a better place without such a site. And, 2. that's almost never the case. As soon as the regulation takes effect, companies all of a sudden find ways to comply and go about their business making money. It's all knee-jerk complaining.

This will force you to log into every single web site that has commenting. So much for privacy. Privacy will go out the window. Discussion and commenting will go out the window. This bill is deeply undemocratic and very much against a free and open society.

I hope your comment was just being sarcastic.

> This will force you to log into every single web site that has commenting

Says who? You just made up a random scenario.

That's the sense of the bill, essentially. If sites are required to confirm you aren't children before you're allowed into adult conversations, they have to be able to authenticate and authorize you.

What is the practical implication of this anywhere beside eg 4chan? Almost every place with any quality of discussion requires logging in.

In theory anonymous and instantaneous commenting is an ideal of free speech. In practice it repeatably seems to just become wasteland.

Are you suggesting the lack of it is a preferable alternative?

I'm suggesting that it's utterly irrelevant.

Logging in and verifying age are very different. See the new account creation process for the comment you typed, as an example.

Actually this won't really affect 4chan either; while it's speculated the servers reside in California there's no critical dependency that they actually stay there, and once the physical servers leave all ties are severed with the state and California looses any reasonable way to enforce the new law.

It's kinda the same reason the site is accessible in Germany/UK/whatever despite violating every hate speech law in there jurisdiction

> This will force you to log into every single web site that has commenting.

which website doesn't? I can only imagine the high quality discussions that such a site encourages.

You're literally on one. Do you want to upload your driver's license to Hacker News? Does Hacker News want to be in the business of storing those driver's licenses securely?

I wouldn't use hackernews if they required that. So, maybe they shouldn't store my IP address and location by default.

If this bill passes it will be illegal for Hacker News to not do that.

How many different websites is any one person really commenting on these days anyway? It’s not like 1) independent blogs and forums are really a thing any more, 2) the blogs and forums that do barely exist have comments any more, 3) the major news and media companies have comments on their websites any more, or 4) you’d ever want to read them even if they did (let alone post your own!).

Can you qualify any part of your statement? I'm trying to understand where you're coming from, but none of it follows at face value.

This fear is completely disconnected from reality.

Privacy already doesn't exist online. And discussion and commenting (anonymous or otherwise) have been absolute net negatives for "free and open" society.

But the result of this is only big companies will be able to comply, in which case you'll be faced with a worse privacy future than if this bill had never passed

That argument is used for every new law that is ever considered. Did GDPR kill startups? Did CCPA? COPPA? They will survive this one as well.

GDPR made the web noticeably worse than Before.

They all certainly made the web a worse experience for those using it. Wether that was avoidable or not is moot compared to what happened in practice.

Well that's because it's the trade off for new regulation; the bar of entry will be raised ever so slightly, and a small percentage of struggling/hobby companies will not be able to compete. Eventually with enough regulation the regulated industry becomes effectively an oligopoly. I mean this bill is being pushed in the home state of Facebook, Apple, and other tech giants where they donate the most money. This is not in spite of them but because of them that a bill like this is being pushed through, and I bet if you checked up on who's donated to 5rights or the bills authors you'd see people bought with big tech money https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

>I do want to be treated like a child online.

Many of us don't want to be treated like children, much less have the government mandate that we treat everyone has children. We already have a mechanism for protecting children and filtering what they are exposed to, this mechanism is called parents. If this mechanism is broken, then we should work on ways to fix the mechanism instead of deciding that we will simply treat everyone as children and absolve parents from their parental responsibilities.

Unfortunately your list of benefits is not in the bill, and the bill uses language like "safety, and well-being" in section 1798.99.29

I suspect this will be used for selective political censorship.

Just want to chime in that ads-based network effects are a huge boon to the economy and ability to be innovating and build business on the internet. It's important to recognize that with "privacy" regulation like this will likely come an unexpected chilling of the online economy. I wouldn't be surprised if regulation like this reduced PPP growth for Americans by around 1-2% on average in the long term.

If the choice were really all ads going away and all ad supported websites going with them, or pervasive tracking, I'd gladly give up the minority of ad supported sites that provide value to rid the Internet of the scourge of the remaining ad supported trash.

The truth is that there is no such dichotomy. Ads do not need tracking/"personalization", and if tracking/data collection were made illegal, there would be no commercial advantage for the scummiest "ad tech" company.

(I'm not commenting on the California legislation, but just generally in response to parent)

The collection of identifying information for every user on your website is antithetical to the goals of CCPA and anyone that values any resemblance of privacy.

Further, business do not want to be in charge of validating PII information, nor do they want to place roadblocks to casual users. The darn cookies and GDPR popups are already annoying enough. Are we trying to make the web unusable?

This is just insanity, and will lead to a bunch of ecommerce businesses and website companies leaving CA. ie, no one will comply unless they have absolutely zero other choices.

Where is the need to do that specified in the actual bill? https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

the majority of the bill is restrictions on collecting personal information in general

I'm not sure most ecommerce sites would meet the criteria as something marketed and targeted at children

I agree that 'likely visited by children' is nebulous but this seems to be heavily aimed at live streaming/recording services(twitch, tiktok .. etc), large public social forums (discord) and things like youtube kids

It's spelled out everywhere in the bill. They make it so scary to serve content to children (knowingly or not, since it's so vaguely defined) that you'll either have to A) Verify age (which requires identity) or B) Lock it down for everyone.

Making a person/business predict someone's age over the internet is just absurd... and fallible... so you will have verify identity.

This has been california's strategy for about the past 30 years, trying to write laws so it is too onerous for businesses to only comply with them in CA. It's a violation of the principles of federalism and should be smacked down, and california should be harshly penalized for doing so.

> It's a violation of the principles of federalism and should be smacked down

I see your point, but smacking down a state for having different principles is a violation of the principles of federalism. If federalism means anything, it includes the freedom for a state to make its own experiments in democracy as long as they don't cross enumerated federal powers.

If this bill treats people from different states differently then it is vulnerable to the commerce clause, but that isn't clearly the case.

Right, but a state can't e.g. cut off a river to do something with the water then be like "lmao it's an experiment in democracy, cry about it". The internet is an interstate "thing" where we can't even 100% say who is where so this kind of regulation absolutely violates federalist principles.

> The internet is an interstate "thing" where we can't even 100% say who is where so this kind of regulation absolutely violates federalist principles.

California regulation has affected people outside of the state since long before the internet. If that's enough to toss out federalist principles and to handcuff a state beyond constitutional justification, then federalism is quite weak.

Your argument seems to be that federalism should be ignored here in order to protect the integrity of federalism. I'm not understanding how that works.

BTW, I very much disagree with California's direction here. I moved out of the state after growing up and living there for 37 years because of this kind of policy making. But as a federalist I value their independence more than their correctness.

> It's a violation of the principles of federalism

Quite the opposite. This is exactly the definition of federalism.

This impacts the entire world. Commerce clause is applicable here.

There is a tension between a State government's right to regulate activity within the state, and the Federal government's right to regulate activity between States.

Here the key question regarding interstate commerce should be about who must comply with this law (if it becomes law). California wants it to be "businesses" with a "nexus" in California, but that seems like rather expansive. But finding a more limited way to specify "California businesses" that isn't also de-fanged is very difficult in today's world.

Still, now, suppose that Texas or Florida had conflicting laws? Then what?

reading the bill it seems fairly pro-privacy and generally contains things I'd imagine most folks want like limitations on collection childrens data, notifications if you're use is being monitored and controls over how childrens information is stored

Is it correct to say that even my personal blog is covered by this?

Here's who it applies to directly from the bill[1]:

    A business that provides an online service, product, or feature likely to be accessed by children.

Child is being defined as[1]:

    "Child" or "children," unless otherwise specified, means a consumer or consumers who is are under 18 years of age.

Meaning all websites, including your blog. No one will be capable of making a bullet-proof argument their site is unlikely to be accessed by a child.

[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

> "A business that provides an online service, product, or feature likely to be accessed by children"

This seems stupidly vague.

As with many of these types of laws in California, I suspect they are deliberately vague.

If people/businesses have to guess at what's compliant, then they will often choose the most restrictive form of compliance out of an abundance of legal caution.

Possibly even unconstitutionally vague.[0] If a law requires someone to accurately predict the future actions of large numbers of people they've never met, then that seems (to my non-expert understanding) like an unreasonable burden on citizens.

[0] https://en.wikipedia.org/wiki/Vagueness_doctrine

Frankly put, and regardless of your personal views on the subject - if the California Pro-2nd Amendment folks haven't been able to get anywhere with this "Vagueness Doctrine", then neither will website operators.

You should also quote the following section:

  (4) “Likely to be accessed by children” means it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children:
    (A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.).
    (B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.
    (C) An online service, product, or feature with advertisements marketed to children.
    (D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).
    (E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.
    (F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.

I can't speak for the GP poster, but my own personal blog meets none of these criteria.

I didn't quote it because I provided the direct link to the original bill, and felt it would be too messy to quote directly.

None-the-less, the above applies to all websites unless you want to chance being a test case (and no one does). Child is defined as anyone from 0-18 years old, which is an incredibly broad category.

Ever once talk about music on your blog? Talk about food? Cars? Games? Math? School? Clothing? Programming? TV Shows? Upcoming movies? Flying airplanes?

All of these things are of interest to folks 18 and under too... you don't have to have a blog about Blue's Clues to fall under this deliberately vague, ultra-wide net.

It's very unclear to me which specific paragraph A-E would be triggered by the act of publishing writing about food or music on a personal blog. Perhaps if I kept detailed metrics about my users and discovered a significant number were children, it would be different, but I certainly don't do that. Based on that data, I'm pretty comfortable not changing any piece of my own personal website in response to this legislation.

Don't get me wrong, this looks like a garbage law and I truly hope every California resident is writing or calling their elected representatives to complain about it in specific and excruciating detail, but acting like every nerd's low traffic weblog is putting them at risk of civil action from the State of California strikes me as somewhat hyperbolic and misleading.

C, D, and E are killers.

    (C) An online service, product, or feature with advertisements marketed to children.

Run ads on your site? Dead...

    (D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).

Have some element on you site that is similar to any other site that might target children? Dead...

    (E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.

This literally covers anything in the world you might talk about. Remember, "Child" is defined as someone 18 or younger... which is a huge and broad category that encompasses all interests and topics.

Take a look at Michael Dominick's SE blog: https://dominickm.com/

The home page alone violates all of the above.

Lastly, "Business" is not defined here, which is odd since these consumer protection laws always define explicitly who they apply to.

I have extensive experience with P65 and ADA compliance - so vague laws like this one really scare me. The only saving grace here is there is no Citizen Enforcement provision - ie. the AG has to bring suit. Which also means voluntary compliance will be low until the AG makes an example of a few unlucky website operators...

> An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.

So if you write an extremely technical blog that happens to include a cartoon avatar, is your blog directed at children? Example: everything on this blog https://gankra.github.io/blah/deinitialize-me-maybe/

I'm not an content segmentation expert, but this does not look like it's child-related content at all. The legislation clauses may seem fuzzy but if this were my blog I wouldn't be worried.

> does not look like it's child-related content at all

If you're defining "child" to mean 5 year olds, I completely agree. But I'm almost certain that there are 17 year olds out there who are world-class Rust programmers who are reading that blog.

Ever seen a kid post a question to Stack Overflow because they're learning programming and have a question, and they make the mistake of mentioning their age?

"Sorry kid. We're deleting your question and banning you."

Yeah, maybe. I certainly hope that, given how great Gankra's writing is, the business that is running their blog does not end up fined many thousands of dollars due to some stupid California law.

I think it's unclear from the text of this bill whether your own personal blog continues to meet none of these criteria if you become a schoolyard meme and children flock to your site of their own volition.

You're going to fall under (B), if nothing else.

Kids are curious. They go places to see what's there. Kids visit your blog, whether you intend for them to or not. (They may not come back for a second visit, but a number have come for a first...)

It's very unclear to me who, exactly, is going to be able to determine that significant numbers of children are accessing my website if I'm not tracking any sort of analytics beyond hits/day. Even taking into account section (D), it's hard to imagine the California AG, even if acting in bad faith, is going to be able to find a blog that is "substantially similar" to mine which has analytics data pointing to traffic showing those sorts of demographics.

Also, to be clear, I'm not trying to be pedantic or split hairs here, I'm trying to explain my own actual thought process in reading the law and considering my own risk/exposure. As I mentioned in a reply to a sibling comment, this law looks genuinely awful, but I'm not going to lose any sleep over the likelihood of getting sued by the state of California for a personal website where I mainly make a half-assed effort to write about the nerdiest shit possible (i.e. computer programming and board games that are best played with the aid of a spreadsheet).

I’m not personally a business, so a plain reading of the line you posted pretty clearly wouldn’t cover my blog if I had one.

Also of note is "Business" is not defined here, which is odd since these types of laws always do.

Deliberately vague...

Does your personal blog collect information about users? If so, then maybe?

and, do you have settings that limit such collection that you have enabled by default?

Personal information like IP address, that is used to enforce troll bans?

Only if you have a nexus in California.

If you are collecting and storing personal identifying information about users (who may happen to be under 18) then yes.

> I don't want them to store my data unless using it to provide a service

Isn't providing a server you can access "providing a service"?

I guess you never consume content that is considered adult. I suspect those who do will feel differently about the issue.

I guess you never consume content that is considered adult.

This law doesn't appear to cover content, just what information you are supposed to collect about your users.

I guess I made a leap in assuming that if a site assumed for data collection purposes, that a person was a minor, they'd have trouble justifying showing adult content to that person. Looking back on the article, I see I read something into it that was not there. Ironically, I posted another comment pointing out that a poster had missed something in the article. Guess I better remove the mote from my eye before I post more such comments!

Does this include collecting or displaying their real name? Is that considered PII as it pertains to this law? I ask because if I run a forum it will be difficult to force people to use fake names unless I generate names for them. Some people would be upset if I force them to use a randomly generated name, though some would be happy to be anonymous.

Reply on news.ycombinator.com