Hacker News Reader

Comment by lolinder | Hacker News Reader

The actual text of the bill lays out exactly what is "reasonable"—any website affected by the terms of this bill must offer an anonymous age verification option, with very specific requirements including that they not retain PII after verification is complete:

> A third party conducting age verification pursuant to ss. 501.1736 and 501.1737:

> (a) May not retain personal identifying information used to verify age once the age of an account holder or a person seeking an account has been verified.

https://www.flsenate.gov/Session/Bill/2024/1/BillText/er/PDF

View on HN

It will be less than a decade until there is news of a massive data breach where one of the affected companies improperly stored PII.

While I don't discount the possibility of a service screwing this up (I've been in the industry long enough to know that they will), the bill at least tries to address this by requiring that there be zero retention of age-identifying PII once the age has been verified.

That's the problem with age verification. As it stands, someone, somewhere, will certainly retain the information. Either because they want to intentionally track users (irrespective of the law saying otherwise), or unintentionally ("Oops, I thought this S3 bucket would be deleted automatically").

And, as always, the law will skew towards appearance of compliance rather than enforcement (GDPR-style), so if this goes through, you'll soon be asked to upload your driver's license to any random website.

Is not the identification that someone is of age potentially defined by this?

That can be addressed by using a three party age verification system, where the three parties are the social media site that wants to know you are above the age limit, the site that you provide proof of your identity and age to, and you.

With a properly designed protocol you can do this in such a way that (1) the social media site gets no information about you other than that you are old enough, and (2) the site your prove your identity and age to only gets whatever documents you provide and does not learn which social media site the proof is for.

That covers data breaches at the social media sites. They never see the PII for age verification.

The way to deal with the possibility of a breach at the site that does see your documents is to use a site that already have copies of those documents, such as a government agency or maybe a bank.

give it 3-5 years, tops. probably not a big player directly, but a 2nd line aggregator or value-add company.

Or leaked it without storing it.

> (a) May not retain personal identifying information used to verify age once the age of an account holder or a person seeking an account has been verified.

That's good for the people being verified. But it means the companies can't retain proof that they did, in fact, verify age. So how do companies accused of this defend themselves, especially if they're in the right? That's a bit scary in a state where the governor used his power to retaliate against the largest employer in the state for expressing their view of a law that affects their employees.

Reply on news.ycombinator.com