Hacker News Reader

Comment by yibg | Hacker News Reader

“ Requires social media platforms to use reasonable age verification methods to verify the ages of account holders and disclose specified policies and provide specified resources, measures and disclaimers.”

Problem here is what is considered “reasonable”? And how to do so without privacy issues.

View on HN

It's also going to lock out people who are well over 16 and just can't get past the verification. Like my dad: a 52 year old man who uses social media profusely, but straight up does not own a device with a working camera on it.

The year that the IRS was requiring ID verification he was prepared to just give up on filing his taxes until I came over to upload everything for him.

The actual text of the bill lays out exactly what is "reasonable"—any website affected by the terms of this bill must offer an anonymous age verification option, with very specific requirements including that they not retain PII after verification is complete:

> A third party conducting age verification pursuant to ss. 501.1736 and 501.1737:

> (a) May not retain personal identifying information used to verify age once the age of an account holder or a person seeking an account has been verified.

https://www.flsenate.gov/Session/Bill/2024/1/BillText/er/PDF

It will be less than a decade until there is news of a massive data breach where one of the affected companies improperly stored PII.

While I don't discount the possibility of a service screwing this up (I've been in the industry long enough to know that they will), the bill at least tries to address this by requiring that there be zero retention of age-identifying PII once the age has been verified.

That's the problem with age verification. As it stands, someone, somewhere, will certainly retain the information. Either because they want to intentionally track users (irrespective of the law saying otherwise), or unintentionally ("Oops, I thought this S3 bucket would be deleted automatically").

And, as always, the law will skew towards appearance of compliance rather than enforcement (GDPR-style), so if this goes through, you'll soon be asked to upload your driver's license to any random website.

Is not the identification that someone is of age potentially defined by this?

Or leaked it without storing it.

That can be addressed by using a three party age verification system, where the three parties are the social media site that wants to know you are above the age limit, the site that you provide proof of your identity and age to, and you.

With a properly designed protocol you can do this in such a way that (1) the social media site gets no information about you other than that you are old enough, and (2) the site your prove your identity and age to only gets whatever documents you provide and does not learn which social media site the proof is for.

That covers data breaches at the social media sites. They never see the PII for age verification.

The way to deal with the possibility of a breach at the site that does see your documents is to use a site that already have copies of those documents, such as a government agency or maybe a bank.

give it 3-5 years, tops. probably not a big player directly, but a 2nd line aggregator or value-add company.

> (a) May not retain personal identifying information used to verify age once the age of an account holder or a person seeking an account has been verified.

That's good for the people being verified. But it means the companies can't retain proof that they did, in fact, verify age. So how do companies accused of this defend themselves, especially if they're in the right? That's a bit scary in a state where the governor used his power to retaliate against the largest employer in the state for expressing their view of a law that affects their employees.

Reply on news.ycombinator.com