Age Verification Laws: A Backdoor to Surveillance
eff.org
eff.org
Have a website and want the chance for kids to see it? Advertise in the headers that it's moderated and intended to be a given rating. Various indexers can pick that up. Complaints can be forward to relevant government agencies (E.G. for a US based website the FTC, false advertising), or as usual other agencies for harder crimes.
Parents can mark computer accounts as Child accounts and Browsers configured to follow a set of list filtering rules selected by the parent or current guardian (E.G. schools).
So again. Internet == Unrated Free Zone -- Child Mode == Allow List filtered content.
We don't randomly go around asking Papers Please! to everyone on the street.
I also recall walking a few miles to e.g. the mall, target, walmart, etc. without any adults when I was around 10. I'm not sure I'd characterize public spaces as adult oriented by default.
Only if you look too young (and for the bars it's only for certain beverages), so the affected population is only a small parts of the customers.
Live sex shows are illegal in most places in the US regardless of whether the audience is exclusively adults, so the motivation for these laws is apparently something other than preventing children from seeing them.
At age 8 I was wandering in Munich unattended.
But okay, gotta admit, this is Germany we're talking about, so not many issues with hordes of mentally ill and/or homeless people doing anything from drugs to defecating on the sidewalk right next to big tech's offices [1].
[1] https://www.theguardian.com/commentisfree/2018/aug/18/san-fr...
And this harms people how?
context matters.
I’m sure someone came along later to clean up but this was early morning. My point is let’s not pretend like Germany doesn’t have homelessness and people sleeping rough.
They generally are quite harmless though and not generally any threat to wandering children.
As much as I kind of agree, I want to fight so much for open access to the internet because it was so useful to me as a child, thirsty for information and starving for nourishment.
I will say I think these laws are bonkers. Restrict what companies can do with child data, make it clear an account is a minors, that should be more than sufficient.
As a child of the 80s who benefited greatly from the Internet as a kid (repressive religious parents, and the Internet was a lifeline), I feel extremely conflicted.
On the one hand, I absolutely want to preserve the kind of benefit we received growing up. On the other, the Internet looks nothing like it did when I was a kid.
Porn on the Internet today isn’t like it was either.
This was actually on the front page recently [0], and while I'm no prude, I do think it's worth taking the trends in porn seriously when comparing the old Internet to the current day.
The platforms that are popular today (Pornhub, XHamster etc;) have restrictions on what they will publish, pornhub in particular has cracked down hard on pornography that does not have a chain of custody.
Rape fantasy and domination kinks are more difficult to find than when I was a kid, you don't stumble upon it.
If you are a kid looking for boobs the most likely place you wind up is Pornhub or xhamster too.
The internet when I was a kid was more like efukt except even less moderated.
As for misogyny, it's hard to discuss because everyone has a slightly different definition - even in extreme cases that some people think sex itself is misogyny: https://www.mumsnet.com/talk/am_i_being_unreasonable/5050613...
Suppose you have some content that depicts healthy and loving relationships, but is also sexually explicit. The prudes are going to want that inside the porn filter along with the rest of it, even though it's something that does the opposite of what you're concerned about.
Meanwhile, insert "watch it for the plot" joke, because we all know that kind of content gets produced when the goal is to appeal to the prurient interest without allocating a lot of budget to writers. But that's actually the problem. Age gates and things are friction. Suppose you want to create something good that appeals to a mass audience because it's thoughtful, but it's also sexually explicit. As soon as you put it behind the wall you lose the large majority of the audience, not because they're minors but because they're adults not willing to swipe their ID in order to watch "porn", whether out of the assumption that anything with that tag on the gate is inherently immoral or concern that someone else would assume that if anyone found out they were watching it.
And then the wholesome and salutary stuff doesn't get produced. You'll notice that such content is uncommon, because it's effectively banned in most of the places with even moderate production values. You can't put it on broadcast TV, "porn" is banned wholesale on YouTube, corporations the likes of Disney would generally be skittish about producing it etc. You'll occasionally get something like that on HBO or Netflix but even then the incentive to produce it is lower because they wouldn't be able to license it to as many other places.
Which means the main place it gets created is in places like the old Tumblr before the prudes killed it. But killing Tumblr doesn't get rid of porn, it just lowers the quality of it, where "lower quality" is more rather than less misogynistic and insalubrious.
If people do more extreme things and they enjoy it then why not? As long as it's fully consensual and of adult age it's only great when people get to explore their sexuality.
As they write the laws, and mostly people follow them, no, they will not be thwarted.
This is how I feel, too. Nothing like TikTok or YouTube Shorts existed while I was growing up. I know how dangerous those are to me, I can't imagine how dangerous they could be to children. Mostly because anything I come up would probably be a wild overestimation, but I won't know by how much.
Rather than rotting my brain away with shorts as a child I spent my time trying to find every possible way to game every possible system. That was my idea of fun. Still is, though it's gotten harder and harder for me to find systems that are easy to game, because the types of systems you encounter as an adult tend to have already been gamed to death by everyone else.
Only the quality was worse but that was purely due to technical constraints (no streaming video)
- Kids should be in bed by 8.
- They shouldn't light fires in the back yard.
- They shouldn't run with knives.
If someone tried to use my support for those things as a basis for 24/7 surveillance of bedrooms, back yards and knife drawers, they'd be insane.
The anglosphere is so full of authoritarian people wanting to get into people's lives and even when arguing against surveillance you think there's an agreeable common goal we should all strive to. No. We don't.
The problem is that you don't get it. You think that saying "we all agree on X but it's bad for society" gets you to eventually acknowledge there's a safer way to do X, at least partially.
I'm saying you shouldn't even pretend the first statement is acceptable and that implementation is the problem .
Now, that's very nuanced for some and I'll get the "you're missing the point, he doesn't want surveillance".
No, you're missing it.
I also disagree with you that widespread agreement on norms is some problematic slippery slope. Failure to distinguish between norms and objectivity as you are doing is what leads to widespread norms being enforced absurdly by a tyranny of the majority.
>I also disagree with you that widespread agreement on norms is some problematic slippery slope. Failure to distinguish between norms and objectivity as you are doing is what leads to widespread norms being enforced absurdly by a tyranny of the majority.
Objectivity huh? Tyranny of the majority huh? Why do I have the feeling you're generalizing some specific partisan/personal problem and you'd rather not discuss the specific because it's then less defensible?
I'll call and raise a self-centered tyranny of the anglosphere.
Ironically enough I’ve found Americans to be by far the most resistant to authority, both societal and governmental. Maybe what’s shining through from your comment isn’t how you live in a less authoritarian environment, but that its mores just happen to align with yours so you’re blind to them.
The rest of your paragraph is just nothing. A vague strawman.
This is the attitude that led us to this problem in the first place.
>Would you allow an 8 year old to wander New York City unattended?
They're at much higher risk of being arrested/abducted by the police than they are anything else. This is a uniquely North American neurosis; this happens every day in every other nation. They take the subway to work/school or walk, like everyone else.
Now imagine there was no parent at all...
On the other hand, child kidnapping by strangers isn't really a common thing. The vast majority of kids going "missing" just did something like going over to play with the neighbour's kids without telling their parents, and the remainder is taken by their own family. Of the roughly 800.000 kids going missing each year, only 100 or so are genuinely abducted by a stranger.
So no, a child being more likely to be abducted by a cop than by a stranger isn't as strange of a claim as it may initially seem.
I'd often see train conductors asking why I was alone and then going "ok, fine" though they would keep an eye on me usually.
Also, what could possibly lead to that happening? Someone upset they were noisy? Or just that they dared show up at all?
BTW I am a junkie myself, but I do not engage in such behaviors at all. And by "junkie" when referring to myself, I mean that I have an addictive personality, but I do take opiates ("only") for my mental and physical problems. I was never a safety hazard for anyone, including myself (there were times when I was, but had nothing to do with drugs). I do it at home (and before going out, too, due to its positive effects on my mobility and pain), and it makes me more emotionally stable. It sucks though, because when people think of opiates, what they picture is homeless people being unconscious on the streets with a needle coming out of their arm. No one could ever tell me that I was ever on opiates and this includes a lot of doctors. For one, it affects me differently (just like any other psychiatric medications and other drugs).
Anyways, yeah, junkies are an issue in LA and it pisses me off that my girlfriend has to always pay a lot of attention because one never knows what they might do. They are also loud, they create conflicts, and so forth.
And even further: The culture that doesn't want to fix the aforementioned problem with their culture.
No. Eg Australia is also full of helicopter parents.
And even Germany has moved a lot in that direction in recent decades, even if they ain't nearly as bad as the US.
Now admittedly many of these things are unevenly enforced, but society absolutely does a lot in the physical world to make it appropriate for children.
> Long term, smoking rates have fallen 73% among adults, from 42.6% in 1965 to 11.6% in 2022.
> Long term, smoking rates have fallen 86% among youth, from 36.4% in 1997 to 3.8% in 2021.
I'd say that's better off, not just in childhood but with long term effects.
You're taking the metaphor a bit too literally.
Or maybe the metaphor is flawed?
GP says that public spaces are adult-only by default, the parent rightly points out this is nonsense: public spaces are Safe for Work (and for kids) by default, and you have to prove you're an adult to access the adult-only spaces. Which is exactly what laws like this are trying to do by analogy to the physical world.
It's not OP that's interpreting the metaphor too literally, the public-spaces metaphor is literally the main justification for these laws and GP doesn't understand how public spaces work.
The internet does have user agents, and for children the user agents are controlled by adults (and if the child has the cooperation of an adult, you already can't enforce age verification). So now you don't need anyone to prove their age in a way that has privacy implications and chilling effects because you can have the child's user agent notify the site that the user isn't an adult, rather than needing each adult having to prove who is. Which doesn't require any form of identification because it's just a flag the adult sets on the child's device. Therefore anything that does require identification is unnecessary and malicious.
Most adults would be put off by that as well, I’m not sure if this is indicative of public spaces.
That said, I agree that public spaces cannot possibly be adult only by default, as children have to traverse them.
I grew up in a household where no effort was made to hide adult materials. Oh, the horrors--that don't actually exist. There is exactly zero overlap between my father's kinks (I was the one that had to go through his stuff when he died, I know what they are) and my own.
As for the billboard--there's sometimes been a prostitute ad on a billboard here. "Full" nudity with strategically placed text. Of course it pretends they are dancers but few people are actually mislead. (Despite a fair amount of misunderstanding prostitution is *not* legal in Las Vegas. It's banned by state law in the two most populous counties, local choice otherwise. However, there's pretty much a truce between the outcall escorts and the police--they don't do other wrongs, the cops don't try to catch them.)
This is exactly the opposite of the way public spaces actually work, and the way that public spaces actually work is the very justification for laws like this in the first place! You've just taken their exact rationale and imagined a world that would lead that metaphor to the opposite conclusion.
In most of the real-life US, you can't put porn on a billboard, you can't sell it in a supermarket, and you can't wear it on a shirt. You can't go out naked in public, and you can't engage in public sexual activity.
If you do want to buy porn or go into a strip club, you have to show ID and go into a distinctly-not-public space behind closed doors, often without street-facing windows lest people in the public space be able to see inside.
The fact that this is how public spaces work is why these laws are written the way that they are—by analogy to real public spaces vs real adults-only spaces.
In most of Europe (spoiler: overgeneralization incoming) nobody would have an issue with a child walking alone through a city, going into a bar and ordering a coke. Nobody is going to stop them from taking public transit to a book store, and nothing is legally or physically preventing them from looking at a couple pages in the latest playboy issue in the magazine rack. Though the clerk might interfere out of his own judgement, and depending on the country they might check your age before selling it. You will however be asked for ID before being allowed in a strip club, brothel or casino, or before being sold a DVD of some action movie.
The action movie too? I’ve never seen that happen, and I’m certain I rented a whole bunch of age inappropriate DVD’s (or was it VCR’s?) back in the day. Maybe we were required to be ID’ed and the teenager behind the counter just gave zero fucks?
One time my parents got me in. They had made a deal with the owner that I'd be shielded by a parent from seeing anything in the store on my way to the small corner of "age appropriate" VHSs, so that I could pick out what I wanted and then I'd have to leave the store while my parents went to rent it, coz from the cashier's counter I'd see too much.
Of course today I understand but back then I was just like "WTF!, why not!?"
Funny to think about now. It was a tiny corner I could see and a huuuuuge store I wasn't allowed in.
I still have not watched Johnny Pneumonic.
As a gay man, I am profoundly uncomfortable with the idea of one or more private companies having a durable record of the content I look at, for what I would hope are obvious historical reasons. Additionally, age-gate laws will inevitably be used for oppressive purposes - remember, a substantial number of conservatives view ANY mention of the mere existence of LGBT people or families as inherently pornographic, sexual, or obscene, and those people would absolutely seek to have all LGBT content age-gated. Hell, even without such laws we see this in libraries and schools. The harm that would be averted from age verification online is not proportional to the evils it would give rise to, plain and simple.
The only form of age verification I would ever be OK with would be on the same basis as being carded in RL - something like, at a corner store I could buy a tag with an ID number on it that would count as proof of age for as long as I had it, for online purposes. The clerk would verify my age and then give me a tag in a sealed box with a random number, thus preserving my anonymity from both angles: the clerk would not know what number he sold me, and the state would not know who bought the number, only that the retailer averred that I had had my age verified.
Yeah, but the bar bouncer doesn't keep a registry of a million different customers and profit from selling my info.
I wonder if there could be some sort of NFC/USB Yubikey thingy that resides in your government-issued ID that responds with TRUE if the person is considered an adult. Ideally, it would just leak your nationality (the "is_adult=true" response would be digitally signed by your government at ID-issuing time).
In Europe, my ex and our two teen daughters could go out in the late evening and feel comfortable socializing in places that would be unthinkable in the US.
In general, US culture seems to stratify people by ages in all sorts of ways, official and just cultural. It doesn't feel as socially healthy to me. We are all better for having a wide variety of friends and family around us.
Internet came out of military and academia and had a flat namespace. No consideraton whatsoever was given to the idea of a 'social model' for it. This was discussed way back in late '90s in a yahoo group that has since disappeared: social models for communication networks.
The widespread proliferation of attire bearing so-called "ahegao" faces demonstrates otherwise.
Yes as long as they know to observe traffic and know how to use the subway.
Almost all child adductions are parental kidnappings. This "will nobody think of the children..." neurosis is just that, a neurosis.
I do agree with the basic concept, though--kids being snatched by strangers is very rare.
I would hope that the answer is yes.
This kind of reasoning (not to pick on the commenter above) is troubling. People blame cellphones and social media. But what are they going to do once they put down their cellphones, if not go out? Should they stare at the walls?
Interacting with strangers is a valuable experience. If we do not encourage children to interact with strangers, should we be surprised when they do not want to participate in civic activities as an adult?
I know you meant this as a rhetorical question but honestly, the answer should be yes.
And if the city is too dangerous for kids to live in it now, then fix that.
Likewise for the internet. Kids are going to use it, we should make sure it’s designed around that.
That doesn’t mean we need surveillance like this though.
I grew up on the uncensored internet, and it was fine, but I would not conflate the internet with a public space. From my experience the actions and content of the internet are very different from the real world.
No, but that just means NYC is a crappy place. I regularly see 8yr olds wandering Tokyo alone.
Many people do, in fact, do this:
https://reason.com/2021/06/11/free-range-kids-second-edition...
Sure, why shouldn't 8 year olds wander a city unattended, and eg use public transport?
I cycled to school way younger than that. And so did many people in the past.
You might be surprised, but back in the day before overprotective parents, “free range kids” were a thing. I was riding my bike all over the city (albeit not New York) with friends and just told to be home by 8:00 with no cell phones. I was 10-11 years old.
Even in Atlanta where my wife grew up she was riding the public bus at 12 with her younger brother going to the mall.
This is a disgusting worldview. The fact that an 8-year-old can NOT walk NYC unattended is a disgrace. This is what civilized countries actually look like: https://youtu.be/IkVvXVDs5aI That American children cannot reasonably do the same any longer is a FAILURE of the public trust.
Web != internet.
This is common in Japan.
Incorrect. Slippery slope is an informal fallacy, which applies to arguments based on evidence not logical relations under certainty. But it is a component of the slippery slope fallacy that the implicit premise (that the precondition that is the subject of the argument is likely to lead to the result that is the endpoint of the slippery slope) is inadequately justified, not merely that a slope from the precondition to the endpoint is presented.
Almost anything is possible, but even in this case it was never inevitable or inherently true that age verification for X meant age verification for Y. Which means the value - if any - for a slippery slope argument is "consider the possibilities X might open up"
That said, I understand where the EFF is coming from. Data collection and "sharing" is rampant these days. Any meaningful form of age verification opens up the potential for abuse. What I don't understand is their failure to address how to handle restricted goods.
Wrt. privacy, the real issue is that the small step helps the big step not just symbolically. ID-based age-verification, even when used for good reasons, gives the state and government access to its people’s history of age-restricted content. If this government decides to, say, prosecute anyone who viewed/bought/consumed (inane) X, it’s far easier vs. a government that doesn’t have age-verification. Both governments face major opposition, but the latter government’s opposition is more effective, because the former’s has already shared their history.
One thing the article doesn’t state but implies, that I don’t agree with, is: the slippery slope is still a fallacy, when a government first decides to age-gate reasonable X (e.g. porn) then unreasonable Y (e.g. history books). Because said government will receive almost as much opposition and people doing work-arounds for Y, as if they went straight to age-gating Y; although not exactly as much, I generally assume (and hope) the difference doesn't outweigh the benefits of "stepping towards the middle". In the article, X is porn, and Y is facial cream, dating apps, and diet pills. But these things arguably should be age-gated; and even the article’s talking points are not that these are OK for children, but that gating them gives the government data on more people (which is a real slippery-slope, not a fallacy, as explained in the above paragraph), specifically people who don’t watch porn (perhaps some of the readers don’t mind porn viewers being monitored because they aren’t one of them). If states were to actually start age-gating history books, I guarantee there would be serious opposition, including from people who are completely fine with age-gating porn.
It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation.
Nobody is actually interested in promoting that though, the anti-big-tech crowd just wants verification no matter what, and the pro-privacy crowd just wants something to get angry about. Nobody is looking for a reasonable compromise here.
Minors don't seem to have much of a problem, though?
There are ways to do this which are less bad, but there is no way to do it "in a fully privacy-preserving way" without also making it fully ineffective, because if there is no way to prove who someone is then there is no way to catch anyone providing false age verification as a service to minors. But if there a way to prove that, you've demonstrated the existence of a privacy failure because you could then use the same mechanism to determine what someone is looking at.
The only way to actually solve it is to make the credential non-unique, i.e. issue the same one to everybody so they're fully indistinguishable. That does solve the privacy problem, but then you have the "who is telling the kids the secret password" problem.
A blind signature could be used to have the ID checking party sign the credential without seeing it.
Option 1: Bob gets a credential that can be traced back to Bob; privacy fail.
Option 2: Bob gets a credential that cannot be traced back to Bob, shares it with everyone; defeats the system.
Notice also the tradeoff you're forcing for no benefit. If Bob has a unique blinded signature, even if the signer doesn't know the unblinded value, the verifier would and so Bob has to get a new signature for each use or the verifiers could correlate one use with another. But needing a new signature for each use creates a timing attack because now you can see that every time "someone" presents a signature to use a particular service, Bob had just requested a new signature.
In this context blinded signatures have only costs and no benefits over universal shared passwords.
Let C be an age check service.
A first stab at this would be something like this:
1. W gives you a token T
2. You show T and proof of identity/age to C
3. C signs T
4. You return the signed T to W
5. W checks the signature and sees it is from C
C had to see the token to sign it, so at that point C and W both know T, and so that enables that matching up.
A blind signature addresses that by allowing C to sign with C needing to receive a copy of the token.
The way a blind signature works is that when you get the token, T, from W you apply a transformation to it which produces T'. It is T' that you send to C to sign for you. That gives you T' and a signature for T'. The signature algorithm and the blinding transformation are chosen so that they have this property:
• Given a document D, a blinded document D' produced by applying a blinding transformation do D, and a signature S' of the blinded document D', if you know the blinding transformation you can compute from D' and S' a signature S for D that will verify with the same key that produced S'.
The blinding transformation involves a random number that you pick. Even if C and W get together and compare lists of tokens they have seen they won't see any matches because W only saw unblinded tokens and C only saw blinded tokens and without knowing the random number used for that particular blinding they can't tell which unblinded token matches which blinded token.
They might try to match based on timing. If there isn't enough volume of people verifying they might be able to figure something out so care would definitely be needed especially at the start.
The timing attack is worse than that.
Suppose Bob has a pseudonymous account with the service. So he signs into his account, NotBob99, which is not supposed to be associated with Bob. Or even just uses a device with the same cookie or device fingerprint. On a dozen separate occasions.
Is he unmasked the first time? Maybe not, there could have been thousands of people requesting a signature at that time, although you have immediately narrowed it down by 99.999% from hundreds of millions. Is he unmasked the second time? Pretty good chance of that, because you can exclude anyone who didn't request a signature the first time. Even if it isn't fully unique yet, the number of candidates can now be counted on one hand. Has he been unmasked by the twelfth time? Almost certainly.
It's also not clear what the fancy cryptography is supposed to be buying you over the alternative. If you use blinded signatures, you have a timing attack, but Bob can still share the signatures unless the timing attack is being actively exploited, which it obviously isn't supposed to be as if it was it would only prove the signature scheme ineffective.
Now suppose you just have secret "is over 18" and "is over 21" passwords, changed on the same interval as the signatures would expire. The passwords aren't unique, everyone in the eligible age group gets the same one (and services that are 18+ request the 18+ password even from people over 21), so you can't correlate them with an individual and each person only has to request the password once per change interval (e.g. 30 days) rather than once per use. What advantage do blinded signatures have over this?
However, you could come close. Sell a simple USB device that generates codes. It can only be purchased in person by showing ID--but the ID is not recorded. Down the road it can only be traced to the device, not to the purchaser. But you would no doubt see them for sale by unscrupulous individuals reselling them.
You don't need hardware. You don't need cryptography. You show your ID and you get a password. The password is the same for everyone so it can't be correlated with anyone.
Will people share the password? Of course, and they would also share the signatures or devices or whatever else, because you can't prevent that while also preserving privacy.
Yeah, it seems like it would not be as much of a problem if you were able to have assurances that your data isn't being held onto. If I give my ID to a bouncer at a strip club, he isn't able to scan it and put it into a digital file. He just looks at it*, goes "yep this guy is of age", and gives it back. If we ensured a similar data flow for the Internet, then it wouldn't be nearly as much of a privacy issue.
*These days I doubt I would even get carded as well. Getting older and all that. IDK how you could implement a similar check for the Internet though.
What are some implementation(s)?
Different implementations vary in effectiveness. Anyone can give a minor access to their device, or a minor can steal their device. So in order to prevent access then, you'd need something like constant face monitoring (via a local model, possible to do anonymously, but expensive and fallible), or legal threats (impossible to do anonymously, because you must track the adult who gave their kid access; and many people are dumb with technology even when it matters, so you either have to fine or jail many people or selectively enforce).
The easiest implementation I can think, which I'd recommend, is to make locked-down kid devices, require ID or even just a credit card (18+) to purchase a normal device, put the burden on adults to not share their device with kids, and only police merchants (for selling normal devices without ID) and websites (for serving adult content without blocking kid devices). Like what we do with alcohol, except not even trying to police people for sharing, because it would be ineffective and messy. Like alcohol, many kids will get access anyways, although less than now.
I like this approach because, IMO importantly, kids who don't try to see adult content will be far less likely to, and parents who try to restrict their kids from adult content will be far more successful. I don't think you can stop determined kids with neglectful parents without drawbacks.
Rhetorical arguments are more important than ever in the age of AI, because AI is our attempt to simulate that. Probabilistic AI mimics rhetoric (inexpertly). It uses past knowledge to predict future behavior (rather, just the next token) based on probability.
To be clear - I'm not arguing that logical argument aren't important; I am a logical person, and prefer logical arguments to rhetorical ones. I prefer the certainty. I still recognize the need for rhetoric. Not everything is certain, and you have to make decisions based on probabilities and unknowns.
Here’s the beginning of the rabbit hole you need to go down to understand why so many former debaters not only hate the activity but specifically cite it as an example of post-modern neo Marxism:
Like, think of the worst guy you know. Now think of what that guy thinks about the state of the world, in as concrete detail as you can. That's probably a pretty good reason in itself not to think that, because if you think like that for too long, you risk becoming that guy yourself.
This feels like it should work far less often than it actually does.
Also, neither deductive nor informal fallacies mean that the conclusion of an argument is wrong, in any case, so the conclusion of an argument being right does not disprove (or even provide strong counterevidence) that the argument contained a fallacy. Fallacies are about whether and to what degree a conclusion is supported by the reasoning (and evidence, in the case of informal fallacies) offered to support it, not about whether or not it is true.
That isn't a fallacy at all, it's just an argument that requires you to establish its premises, like all sound arguments. People call it a fallacy as a pejorative when they want to dismiss the legitimate concern and shut down the debate even in the cases where the premise is correct.
Grease down your self, and you'll slide for a lifetime
No personal information is shared.
While I do not aggree with pervasive age restrictions, this is a nice technical solution to privacy preserving age verification
There’s a video halfway down this page showing the process in Apple Wallet: https://learn.wallet.apple/id/ (notice “Age Over 21”)
With an eID card, if it's just saying "yes, this person is old enough" then any teen can swipe a device with an eID card and start using it.
You'd know the state they're a legal resident of as they use state-specific keys used for signatures.
If the request allows checking arbitrary ages like Apple's, then you can get their age with a handful of requests. If one has to verify every visit, then you can get exact birthdate eventually.
If the one verifying has to pass data to the verifier site or the request to the verifier has any site/app/company-specific IDs (again, Apple), then you're leaking what you're visiting to the verifier.
And not to beat a dead horse, but as long as there are jurisdictions that don't require age verification in the world, children can easily use a free VPN or proxy to avoid checks altogether at which point, one has to ask, why do it at all?
It seems like this line of thinking would lead you to ask the same question of literally any law, wouldn't it?
Laws often don't rely on being 100%. Even though there is a law saying people need to wear a seat belt, they can just not wear it! So what's the point, &c, &c?
If you use a VPN to visit a porn site to bypass age verification, you haven't broken the law as it applies to sites, not users. There will be no measurable impact on underage people visiting since the barriers to VPNs/proxies are almost nil while still costing money to enforce on non-tech savvy adults - an overall detriment to society.
Laws that are unenforceable and don't benefit society are bad laws.
They won't be able to visit porn sites in their own jurisdiction -- let us call it jurisdiction J -- because those sites have to perform age verification, but they will be able to visit porn sites in other jurisdictions, since they can send traffic that appears to originate in those jurisdictions. Those porn sites are not in J and so don't have to enforce J's rules.
When I think about this situation, though, it just seems like it would lead lawmakers to require VPN sites to perform age verification.
If you assume a sensible rate limit, that entering the check is voluntary (and unlikely to fail), and that people age monotonically, then it's going to require a lot of cooperation from the victim to get more than a couple of bits of entropy.
I wouldn't trust Apple here regardless, since they are not the state and have their own separate interests.
The correct flow for preserving anonymity is: the requesting party issues a challenge token to the user -- the token header describes the type of request (>=18yo?) and the token body is completely random(). The user then takes this token and has the challenge verified (signed) on their side, the signed token is then returned to the requester.
This way the state never knows the identity of the challenge issuer.
() Note that this scheme requires good faith on the part of the challenge issuer that the token body is actually random, although it would seem that a simple DH-key mechanism would patch this vulnerability.
https://apnews.com/article/utah-app-store-age-verification-7...
Why would we want to keep minors safe from "harmful chemicals" but not adults? If skin cream products with Vitamin A or alpha hydroxy acids are harmful, and I'm entirely unconvinced they are (at reasonable concentrations), lets just get rid of them.
My understanding is they’re harmful if misused.
Is this about the chance about being inadvertedly misused to the point they’re harmful.
I dunno, by all means, don’t sell them to kids, but should we really forbid a 15 year old unless they can show some form of ID? They’re not any more likely to do something dumb with it than an 18 year old.
The reason "we", scratch that, the reason the state allows adults to drink and smoke is because adults have been known to fight back, sometimes quite effectively, when they feel like something is been "taken away" from them. The obvious example here is the rise of bootlegging during prohibition; all that did was empower the organized criminal class, rather than get the nation to realize the awesome benefits of being a sober working stiff. That's why contemporary Western states disincentivize harmful goods by taxation, and gradual, rather than total, prohibition.
Consuming liquor and tobacco are also traditional communal activities, dating from before the total enclosure of industrial civilization upon people's personal lives. Meaning, people would actually be inclined to fight for the right to carry on like they're used to. This is one of the greatest motivators ever; very much not the case with the more novel intoxicating substances, even where those might actually be less harmful than good old alcohol and nicotine.
I'm all for creating an environment that encourages people to make optimal choices about their own lives. Generally, we do not live in an environment that even makes that possible. Case in point, why would one be driven to apply the toxic skin creams in question, if they did not have toxic beauty standards imposed on them in the first place? How do "we protect the children" from those, when all over the world conformance with Adobe Photoshop's idea of the human form can directly determine the social market value of a human being?
The answer is, we have no idea - we're not even asking ourselves the questions that make sense, because "protecting the children" is a moral scam. A just society would protect the inexperienced and the powerless, regardless of age - and, conversely, acknowledge the personhood and autonomy of all citizens in accordance with their demonstrated degree of self-awareness, rather than determine their human rights by some involuntary biological marker. I don't know how that society would work in practice, I'm only here to remind you that instead we live in another kind of society - one that is based on the non-consensual extraction of human resources. Such a society has no incentive to "protect" most of anyone. All it needs is to raise obedient children into dependent adults. (It also needs a stable population of scapegoats - "juvenile delinquents" growing into "hardened criminals", who are to be blamed for all dysfunction.)
Minors are an oppressed minority. They are subjected to extensive brainwashing, and deprivations of liberty that society claims are "for their own good". These rather serve the preservation of power structures, which start with the oppressor's drive to forget their formerly oppressed status. Thus, the purpose of age verification can only ever be the violation of privacy and autonomy of all market participants; it will do absolutely nothing to prevent kids from emulating the harmful and unmoderated behaviors of the adults around them.
Which is also the same reason adults are allowed to do all these other things, like buying toxic skin creams.
My point is that fighting to get one's unhealthy "toys" back doesn't require any more maturity, self-reflection, or responsible decision-making, than that of a literal toddler. But neither does embodying a "rational economic agent", the very thing notionally expected of well-adjusted adults! This is a compound effect, eventually resulting in the present grossly miscalibrated governance model, where homegrown "growth hackers" run circles around the legislators.
Generously, "think of the children" can be seen as an escape hatch: reverting to some sort of universally shared value to prompt people to reflect on their present choices. Not very effectively, though: "Well I'm building a better future for my children, by selling all of this poison here to your children, what?" And, like one of the parent posters said, consumers don't just stop needing protection once they reach the age of majority. Clearly, we need better consumers.
Don't worry, they still can poison the water you use:
https://www.cbsnews.com/news/supreme-court-epa-san-francisco...
If they contain known substances that cause cancer or birth defects*. There are plenty of substances that can harm you that aren't subject to requiring P65 warnings.
However, there’s also been a rise in reports in kids damaging their skin by using these products in the first place or using them wrongly (vitamin A and AHA are amazing but they are very tricky to handle and can easily lead to chemical burns / retinol burns …).
I don’t think there’s any good reason to let kids handle those on their own. And stuff like retinol is starting to get regulated for “everyone” anyway.
Lately, a new law just passed to force porn websites to check the age of visitors. I would have been fine with an authentication going through France Connect:
- the gov knows which website you went to, just like your DNS provider would, but it doesn't which content - and the website knows which content you've watched but not who's watching.
Best of both worlds!
But no, we have to send a copy of our ID card to the website, which is INSANE because the website knows WHO you are and WHAT you're watching.
Going further, how might this effect folks having “freedom is more important than safety” beliefs, given they reside in areas more likely to deny civil liberties-ish rights in the name of family values-ish rights, when this starts to really hit them where it hurts? Everything they do or say online becomes traceable to them, for a notoriously vocal-on-social media set.
If only this hadn't come out of the blue, maybe there'd be someone out there, right now, who could make it so that your identity traveled with you everywhere across the internet, an authentic digital fingerprint and passport so invisible that you can't even see or access it to keep people from having to prove themselves over and over and over again.
What a solution in search of a problem that would have been!
/s/s
Right?
All of a sudden, the internet is incapable of tracking me with that much fidelity. They don't know how old I am. Discord knows how old I am. I never told them my birthday.
This gets a big "hrrrrrrr. Durrrrrrr." From me.
Having an account that's at least 5 years old, assuming a legal age of 13 for registration on most services, should be enough.
Some services already do it this way. Others offer to scan and analyze your face or ID. Leisure Suit Larry 1 used 1960s trivia for age verification.
Given the list of states and awareness of some notable tech companies that operate out of them, it sounds like someone is doing a little competitive market making with the help of their legislators.
parents should be able to access a (password protected) setting in any browser that can exclude some types of websites (like porn).
governments should be free to go after any website not respecting that setting.
but forcing the age-verification onto websites is just moronic.
You want a mandated block of government code in every browser?
having a checkbox that corresponds to info passed with the HTTP requests is hardly something that requires a library or more than a few lines of code
Legal age verification in the browser means legislated code. Not line by line, necessarily, but state code in the browser.
You really see a world where such a law is passed and such browsers aren’t outlawed?
The other way to limit access to such browsers is penalties for users of those browsers. But that feels even less likely. Even if such a law were on the books, how would it be enforced? Either someone would have to report someone using an "illegal" browser or perhaps some method of fingerprinting that is somehow tied back to the actual user. Both of these seem far-fetched to me.
So perhaps such browsers would be outlawed, but I'm not sure it would practically do much.
So why are you for it if the solution isn't valid?
The data already exists, it's what bars use to scan IDs with handheld readers IIRC.
Sorta, yeah.
But the reason that works is because there's a human guarding the door that can assert that the hand presenting the ID is attached to a face that looks just like the one on the ID.
Otherwise a very smart 17 year old would just get their hands on the UUID or whatever for literally any ID that belongs to somebody that's 18+. Within _hours_ of this type of system going into effect, you'd have the age/id version of bugmenot.com
You rarely need anything approaching %100 compliance in order to have an effective policy, so if anything you're advocating for its effectiveness when you suggest the only people that would be in violation are the rare precocious kid.
On the internet, one smart 17 year old sets up im-old.lol and then every kid everywhere has a one-click age verification bypass and the service is run by an anon on a server outside the jurisdiction.
Sarcastically, yes :).
It's a reference to the "you must be over 18/21 to enter this porn/alcohol site" banners. Even a "smart" 17 year old will figure the banner out.
Operator: "let me take a look sir. It's probably a bug. It's definitely not the censorship metrics opaquely changing behind the scenes, sir."
Moving the verification to sites also isn't going you any good, as the site owners could just move to more liberal countries.
One of the biggest problems that grows with each generation, is how do you get the youth to actually engage in constructive development of real skills? How do you get them to be interested in something that will be useful for society down the line? Quietly looking the other way while a statistical minority breaks some of the safety-rails of society basically solves that problem. Breaking the rules is cool. You're basically exploiting the rebellious nature of the youth to trick them into learning useful skillsets. So long as the hurdles to circumvent the rules remain reasonably involved to overcome, and the secret intention remains unspoken, you basically double up the rewards of the rules.
I mean it’s not that I disagree with you, but this is what you are saying!!!
Agree.
> parents should be able to access a (password protected) setting in any browser that can exclude some types of websites (like porn).
How would this work? Who's going to set up the taxonomy / classification tree for every domain/site on the internet just so a guardian can say "yes to drugs, no to porn, no to news, no to weapons..."?
Or if that's not the implementation, how would an arbitrary site signal to the browser what the age limit is? Once you move beyond a binary "require parent consent for $domain" flag, you're quickly approaching traditional parental control software.
I know I'm not the only one one this site that made a bit of spare $ back in the day helping kids at school go _around_ overbearing parental controls.
> I shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description ["hard-core pornography"], and perhaps I could never succeed in intelligibly doing so. But I know it when I see it, and the motion picture involved in this case is not that.
Pornhub knows they do not want to have trouble so they will respect the browser setting and not serve minors. There could be an institution that can receive complains about websites not using this API and those wbsites can be blocked from the country and fined if possible until they implement the API.
We need all mobile and desktop OSes to make it easy for parents to setup accounts for their children, the church could also educated the people instead of just complaining.
It is not perfect, soem clever kid can find a way to reset the BIOS/UEFI and install Ubuntu with a fake age on his PC , but most parents can feel safe and we would not have to show our ID card to Pornhub or even Steam because some game shows nipples and nipples are more dangerous in USA then nazi propaganda.
How about don’t give your children devices until they’re old enough for them. The kids of the rich are already mostly device free. Attention spans and eye contact shouldn’t be a privilege.
I had access to a computer since 14, my bother since 10, we are both OK.
My solution is to protect us the normal people from the extremists that want the government to protect their children, this solution is making the parent responsible if their children get access to bad websites or apps. But as I said is not 100% perfect.
But I agree that you should not give your child a device and at teh same time demand the government to do your job for you.
This isn't really an answer, but the same problem exists with current age verification laws. I think the main difference with traditional parental control software is that the burden would be on the site maintainer to accurately report the appropriateness of their content. If not, they would be legally liable. Of course this introduces the problem that foreign entities not subject to the law are effectively exempt from the requirement.
This doesn't solve the case for entities not subject to this law. They can just label their content as totally safe and not have to worry about penalties.
"have" is a bit ambiguous here. I assume you actually mean "have the government require"?
in other words, if I develop a browser, I could be fined or thrown in jail for not implementing your "default to blocking anything unlabeled" strategy?
since implementing a browser is a vast undertaking, what about if I maintained a fork of Chromium or Firefox that simply disabled that check?
we had this exact same debate 20ish years ago [0] except it was about the specter of TV piracy and file-sharing. the proposed solution was the same, though - require software that could be used for piracy to incorporate a specific check, and make it illegal to distribute software without that check. it was a terrible idea then, and remains a terrible idea now.
We already have CDA/230
What would reddit.com do?
> If not, they would be legally liable.
We already have CDA/230.
> Of course this introduces the problem that foreign entities not subject to the law are effectively exempt from the requirement.
And so this whole endeavor was just defeated with free trial to any of the _many_ VPN services out there. Even a genuinely incurious person will eventually trip over a free/cheap VPN offer just browsing youtube.
if it's illegal to show porn to minors, all a website should have to do to comply with the law is to send a header saying "this is porn" and leave it up to the browser to decide whether or not the human using the browser can see it or not.
2) Look at my earlier post--you don't even need to compel it. Just make browsers in censored mode not able to access sites without classification. You have a kid site, you'll comply. Your subject matter is either not for kids or is something kids aren't going to be interested in, you can ignore it.
I would think adblock lists are a pretty good example of similar efforts (that is, people classifying large amounts of random sites), so I don't think that would be impossible.
Such things don't need to be perfect, either - just good enough.
(I don't agree with age verification efforts or even parental control software; just pointing out it's not impossible)
Ok, what bucket(s) does reddit fall into?
> Such things don't need to be perfect, either - just good enough.
I think we disagree about how "good" this effort will be given that it's a supremely subjective task. Your porn is my sexual education and wellness material...
And if it's going to be down to individual parents to make the most appropriate choice for their kids, this whole thing is just regular parenting but with extra steps.
Well probably various. What is your point?
> it's a supremely subjective task
Yes, but this is beside my point. It can be good enough to meet people's subjective needs. All I meant was, solutions like this don't need to perfectly categorize every single site on the Internet to be good enough to be useful, for those who think such things are useful.
Make a standard set of tags and a yes/maybe/no response to them. (Maybe is for a website that has user content that permits such stuff.)
I do agree it would be defeated in many cases, though. Tech-ignorant parents aren't going to be very good at stopping tech-savvy kids.
Benefits:
1. Orwellian abuse: No creepy-ass super-abuseable government panopticon knowing every goddamn service you've ever made an account on, with the ability to arbitrarily revoke them and/or block new ones.
2. Costs: The majority of the costs of creating and maintaining the system fall upon the people who actually use it and want it to exist, rather than a bunch of other adults across the globe.
3. Parent focus: Most enforcement exists in a physical realm where parents/guardians at least have a chance of understanding, monitoring, and managing it. "Little Timmy is using Daddy's phone" can be determined instantly at a glance.
4. Exceptions: If the child has some health-class homework and can't access the right Wikipedia pages anymore, the parent can easily grant exceptions and revoke them.
5. If someone's religion says that unclad ankles are smut, then their church can create their own site-rating-site and adherents configure their family's devices to it.
It's about the only place it might have the intended effect anyway, and has the advantage of not enabling mass surveillance.
As always, parenting starts and stops with the parent. The internet should be open and if the child sees something that upsets them (or makes them question one of their assumptions), it's the parent's responsibility to cultivate an environment where the child feels comfortable talking about it with them.
I hate the breakfast club and think it’s one of the examples of movies which idolized anti-intellectualism and basically celebrates bullying nerdy types. Sadly ironic of a password choices from my “nerdy” family.
If the rainbow tables didn’t work, I’d have rootkitted/RATed the computer.
Yes, that means not buying a smartphone and give it to your 3 year old.
I think, slowly, the world is starting to realize this.
Agreed.
>I think, slowly, the world is starting to realize this.
Unlikely. You'd be surprised at the proportion of parents that want to outsource parenting to the govt.
I am someone who would probably not own a smart phone if it wasn't such a pain to not have one.
I can see with the kids in my extended family how even by 12, not having a smart phone is going to damage your social life. It was awkward enough for me at that age with rotary phones. I couldn't do that to my kid if I had one.
We have put ourselves in a really bad spot. Even if a parent wants to do what is best for the kid, I have no idea what that is. To pretend there is some simple and obvious answer here is completely divorced from reality.
If the only porn requires this, then the third party has a record of every single person who wants to view porn.
And the precision of one year is way too low.
1. Me from sharing my credentials with everyone by publicly publishing them.
2. The third party from connecting with any service providers requiring verification to share info?
Responsibility really is the only fix here. I know we love technical solutions to problems but either porn is illegal for everyone or it isn't.
When they stopped blaming crashes on "pilot error" they were able to properly investigate the causes of crashes and prevent more crashes.
"Pilot error" is a suitable explanation if you are a mechanic investigating the crash. You determined that the plane moved the wrong way because the ailerons moved the wrong way because the pilot told them to move that way. It's not a suitable explanation for a final report because you need to find out why the pilot told them to move that way.
Codeless Code 224
The German constitution actually provides for a "right to informational self-determination", i.e. any individual has the right to decide what happens with their personal information, including what websites they visit.
We also have a standard governmen-issued ID. In combination that makes it possible for private companies to offer web-based age verification, that check you ID-number against a government-provided service, verifying the age but not providing additional information. And because of the privacy laws, it would be a criminal offense to store the identity of the person being verified or for that information to be connected with the website you visit.
The website in turn gets a legal record that they verified the age of the person, but not necessarily the actual identity of the person.
Ideally, in the end each party only gets a piece of the total picture but by confirming to each other that the piece they have checks out, you can confirm your age to a porn site without any single party being able to piece the entire picture together.
A child could borrow an adult's card, but then the items would be shipped to that adult's address which could make it hard for the child to get them without that adult noticing, and the purchase should show up on the next credit card statement further increasing the chances the adult will notice if the child is surreptitiously using the adult's credit card.
Maybe even require the listing on the credit card statement to have a prominent annotation stating that there were purchases of age restricted products that month.
This wouldn't stop all such purchases, but it should make it harder and it should make it easier for parents to find out that it is happening.
One party to the debate claiming that the solution (age verification) to the problem (kids accessing adult content) is imperfect, is worthless.
We know what the position of the EFF or FSF is on the matter, they prioritize online privacy over kid safety, got it. But if the message is going to be that the solution has a problem and there is no more contributions, then the implicit proposal is that there needs to be no solution and the initial problem is ignored.
If the opposition to current age verification take this naive approach of denouncing age verification and offering no solutions, they will be kept at the sidelines while the adults vote in the senate for these solutions. Newsflash, you lost the debate, if you want back in, you are going to need more than this.
The privacy of attackers is a risk to kid safety.
The privacy of messages sent is a risk to kid safety (law enforcement should be able to access them)
The privacy of chilren activity is a risk to their safety (Parents should be able to view what their children do.)
However, I know of no children who independently acquired and maintain a device with a connection to the internet. Are you entirely sure we need a governmental edict to allow parents to monitor and influence what their kids see and do online?
Should law enforcement be able to access messages sent to my kid? I'm going to have to say no to this one.
In the same way that parents can control what kids do with their devices, so can governments and they do, all the time. Through regulation they control what software companies like Google or Apple approve for kids, and they can control or subpoena data from kid apps.
>Should law enforcement be able to access messages sent to my kid? I'm going to have to say no to this one.
100% should, and 100% does, you are misinformed on what is and what should be. Thankfully you are not in charge of this decisions.
The discussion is about what the government should be allowed to do to protect kids.
> >Should law enforcement be able to access messages sent to my kid? I'm going to have to say no to this one.
> 100% should, and 100% does, you are misinformed on what is and what should be. Thankfully you are not in charge of this decisions.
Every major messaging platform is E2EE by default.
And we don't even have to speculate anymore what they are because the plan is out in the open. So when someone shows up with what is ostensibly a non-problem in the real world but the solution to which happens to be the legal tool they need for this other less popular worse thing they've loudly said they want I think it's normal and intellectually honest for that to be the analysis. "The EFF doesn't care about child safety" is exactly what they wanted you to say to dismiss any reasoned opposition.
How about recognizing the inevitable conflict between two priorities: kid safety and online privacy? Simple thing really.
Again, you don't need to do this, but you will be ignored and put in a kiddy table while the adults talk in the senate and in school boards.
Most schools have deep inspecting firewalls btw. Go tell them that it's an invasion onto kid's privacy, and that you should be able to speak with them without their parents or guardians snooping. See how they look at ya
And note that I haven't noticed anyone objecting to any client-side filtering approaches--I've even suggested one. We are objecting to mandated server-side verification because we know it's a camel's nose.
That being said if I a parent at such a school I would assist my child in every way possible to make sure that their own browsing is exempted or shielded from such systems because I do think it's a violation of their privacy and that's my right as a parent but I digress.
If that same philosophy requires everyone to be subject to such a monitoring and filtering system by law then that's where I take issue. Because having teacher's credentials by virtue of being an adult isn't enough. I'm still being monitored and identified.
Do you really not see the difference between an opt-in filtering system controlled by the responsible party for specific children and a global mandatory filtering system controlled by literally the worst human beings alive? That have an explicitly adversarial relationship to you and control the global definition of child appropriate to suit their agenda?
And the reality is as always it's focusing on the wrong "threat". Like the vast majority of sexual abuse is by trusted people in the kid's life, not by anything on the web. The real threats on the web are social media and chat rooms, not the "naughty" stuff.
Or look at the perennial attempts to allow governments to block "child sexual abuse images"--since it's always done with hashes there's no verification that that's all they're doing. Think China wouldn't block images of tank man in Tienanmen Square?
In meatspace there are rules of how close those can be from schools and churches (of any denomination).
When the CDA's porn provisions were struck down, the sort of industry argument was that they'd use the PICS site ratings and the content could be blocked in proxy/client side. This made a lot of sense in the context of the V-chip mandates of the 90's. AFAIK browsers stopped supporting this a long time back.
No method of age verification is entirely actuate. It seem a hardline stance that we can't think up a process that would allow for a reasonable level of accuracy with privacy. It could literally be drawing a usb token from a bucket full of them after a human at the DMV visually checks your license.
[1]: https://www.independent.co.uk/news/uk/home-news/porn-passes-...
I should be able to prove to iPhone apps that I am 18+ (only a binary yes/no with no metadata) by the apps making a local API call to iOS, which checks this information with the unexpired drivers license on device.
What if you're borth on March 1st and it's currently February 29, 18 years later?
We can do better with zero-knowledge-proof-based schemes, which also allow securely decoupling issuance/certification from online verification.
E.g. https://linc.cnil.fr/en/demonstration-privacy-preserving-age...
Where's the stuff that isn't a smoke screen?
Pornhub publishes insights on their blog where they include an age/gender/country breakdown of their viewers. That data must come from somewhere, likely google analytics or something like it, which means that there is a thriving surveillance market whether there is age verification or not.
The surveillance is already happening, there isn't any need to backdoor it because it's already there.
People think google is a search company, but it's not. People think Facebook is a social media company, but it's not.
They are privatized intelligence companies, intelligence as in the I in CIA. And rather than that intelligence being used to, said charitably, make America a safer place, that intelligence is being leveraged to make rich people richer and less regulated.
Not enough of a spotlight is on privatized intelligence functions. It's no wonder it feels like corporations have more power than the government, they have access to mini privatized CIAs, with arguably much less oversight.
Data brokers. But that data isn't exactly accurate. Relatively over the large population yes. Accurate for identifying indivdual users: no.
Maybe we can even protect adults from being exploited online one of these days too (obviously not in the current US administration, but some day).
Texas' law, H.B. 1181, requires people visiting porn websites to prove their age by either uploading government-issued identification or a "commercially reasonable method" such as bank information. More than a dozen other states have passed similar bills, though they are all on hold pending what the Supreme Court decides.
That said, as a parent to teenagers, I don't know that I believe that age verification is such a terrible idea. The reality is that there's a lot of fucked up porn out there and blocking it effectively across all networks and every device is non-trivial. I understand this is a minority viewpoint on HN.
Of course I have absolutely no interest in uploading scans of my drivers license to porn sites so I don't know what the right answer is. I'm sure there's some cryptographic scheme whereby a 3rd party could verify my identity without knowing for what purpose and then the porn sites could validate that verification without disclosing who or what I'm doing. I dunno.
I agree with you. I’m very pro-privacy/anti-surveillance and pro-freedom, so I’m entirely against the invasive ID-based systems, but the problem you highlight is pretty real and has to be addressed somehow, and I’m just not sure what the solution is.
As a parent of very young children, I’d hope that we’ve already figured this out by the time my children are teenagers.
Also, I doubt your viewpoint is actually a minority viewpoint here—it’s more likely those with your viewpoint just won’t post it here.
The solution is client-side filtering/blocking software on the machines you own. And if your response is "but that's hard", that should increase your confidence that server-side filtering and verification are unacceptable. If even tech-savvy people can't get verification working on a local device-- which has the full, correct context who is using it and what should be blocked-- then certainly it's not going to get any better by mandating a solution at scale on the public Internet, where there is much less context about the individual user, credentials can be mocked, proxies can be used, and so on.
Which is one reason that the EFF is trying to lay down their argument that the technology won't work.
Would you be okay uploading your ID to online gambling sites?
> When I go to pornhub I have to click a button that days I’m 18.
if you were in Texas, it'd be not reachable at all [0]. this is due to a bill [1] that would have required Pornhub to use the more intrusive age-verification options. it also allows for significant fines for non-compliance. if a 16 year old kid used their 19 year old brother's ID to get through the verification, Pornhub could potentially be liable for up to $250k. and the broadest reading of that bill would mean that quarter-million fine applies every time a minor bypassed the age-verification check.
0: https://www.texastribune.org/2024/03/14/texas-pornhub-5th-ci...
1: https://capitol.texas.gov/tlodocs/88R/billtext/html/HB01181F...
no, that's not accurate. quoting from the bill:
> A civil penalty imposed under this section for a violation of Section 129B.002 or 129B.003 may be in an amount equal to not more than the total, if applicable, of:
> (1) $10,000 per day that the entity operates an Internet website in violation of the age verification requirements of this chapter;
> (2) $10,000 per instance when the entity retains identifying information in violation of Section 129B.002(b); and
> (3) if, because of the entity's violation of the age verification requirements of this chapter, one or more minors accesses sexual material harmful to minors, an additional amount of not more than $250,000.
if they don't have a system for age verification, the possible fine is $10k per day. run a website for a year, and then the Texas AG gets around to filing a suit against you? that's a possible 3.65 million fine.
the possible $250k is on top of that, if minors access porn on such a website.
crucially, the law says the age-verification system used must be "reasonable" which gives prosecutors a significant amount of leeway. does your porn site use Honest Achmed's Age Verification Service? if that is easy to bypass, there's nothing stopping them from arguing in court that you may have implemented age-verification, but you didn't comply with the law because you didn't use a reasonable verification service.
Louisiana, AFAIK Does not require age verification, but all of our traffic goes to Dallas, so we get lumped in with Texas.
Of course this raises questions as to what is the point of requiring verification that doesn't actually verify anything, but that's an entirely separate problem.
To be clear: I'm strongly against any laws that require uploading government ID to sketchy websites, but at least 2 out of the 3 examples listed are not this.
Like what public interest is served by having a date of birth entry or a checkbox for 'verifying' age?
To me it serves no public interest as it's functionally useless and it will only serve as a thin end of a wedge to normalize more egregious requirements.
if you did check the other two, you'd notice that they're much more restrictive.
from the NY bill, apologies for the all-caps but it's in the original [0]:
> "IDENTITY VERIFICATION" SHALL MEAN THE USE OF AN ON-DEMAND SELF-PHOTOGRAPH TO VERIFY THE OWNERSHIP OF A PERSON'S GOVERNMENT-ISSUED IDENTIFICATION;
> "LICENSE VERIFICATION" SHALL MEAN THE USE OF TECHNOLOGY TO VERIFY A PERSON'S GOVERNMENT-ISSUED IDENTIFICATION;
and the one in WA [1]:
> For the purposes of this section, proof of legal age includes any of the following officially issued identification that shows the purchaser's age and bears the purchaser's signature and photograph:
0: https://www.nysenate.gov/legislation/bills/2025/A3323
1 (PDF): https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bills/Se...
2/3 examples being heavily exaggerated is a pretty bad look for the author (even though I agree with the article sentiment in general).
If we trust the legislative to have a modicum of common sense and don't try to invent a technical solution to a non-technical problem, then a warning "what you're going to see is not for the younger audiences" might be a reasonable compromise.
And it's a shame we live in a world where the former doesn't sound completely nuts.
Either you believe the state is out to get you, or you believe that kids shouldn't access porn.
Free software maxis will tell you that age laws are surveillance and that child pornography is an excuse to have subpoena mechanisms.
And in fact, the Internet is not anonymous or private, as there are multiple ways to track and surveil members of the general public.
IMO the next step in the Internet's evolution needs to be the authenticated internet. An Authenticated Internet pretty much removes all the security issues, since every connection is authenticated. And authentication doesn't necessarily mean you're not anonymous.
Right now the Internet has become the worst of both worlds - not private, not anonymous, and all the problems associated with that (insecure, spoonable, etc).
That's what the EFF has wrong: the Internet is already a backdoor to surveillance. They're trying to stick their finger in the dyke. But what needs to happen is to rebuild the whole thing.
You can't block technology though. Government or not. People find a way.