Porn sites go dark in France over new age verification rules
rfi.fr
rfi.fr
I don't know the specifics, but seems very reasonable if implemented matches the promise. If it's required also for some non porn sites (social media? gambling maybe), there should be no stigma attached either.
Because it's easy to say "just use that third-party service" but if the cost of that service is well above the profit margin of a porn site, the site cannot really do it.
Then you pass this token to your porn website and they can verify that this token means that you have the required age. But the porn website cannot identify you.
Not sure about the price of such a service, but it would be paid by the public.
> Use an age verification provider that is legally and technically independent of any online platform hosting or providing porn content - https://www.yoti.com/blog/france-age-verification-law-adult-...
So, could be a government website, but likely for-profit companies will try to capture it by any means necessary, the very least a lot of lobbying.
Or for the benefit of the children who have a harder time accessing the porn sites, maybe?
They question the quality of the Zero Knowledge Proofs (something like "it's still new") and raise what I find the more interesting question: "who will be left out?". Not only for porn, that is.
Much of the Secure Boot crap could have been avoided if all devices had been required to have a user-accessible mode that trusted a must-issue signer of last resort, and that signer was broadly available.
E.g. LetsEncrypt for devices
If on the one hand we want to improve security via encryption/verfication, then on the other hand we must remove the governments' and corporations' abilities to abuse it.
> the porn site receives only a yes-or-no confirmation that the user is of legal age
What does the external service receive?
If the law forces down people's throats an intermediary between them and a porn site, then it better also force the intermediary to guarantee anonymity.
Hmm...
> But I asked what is that external provider actually receiving.
Sure, I don't know. What I'm saying is that at least it seems possible to make is reasonably private. That's better than if it was impossible, e.g. putting a backdoor in E2EE "only for the good guys". But then I would be contradicting your statement that "there are always ways", so... well.
No amount of cryptography can protect against this. Now, if the French government issued tokens preemptively to everyone, that would work, but then it becomes trivial for to copy the tokens.
Sure, if you start with convenient assumptions, it's easy to prove your point :-).
Now let's imagine that people don't need a token for each session but to create an account. Suddenly they are not asking for tokens after midnight, and not repeatedly, right?
Let's push it as far as saying that other websites may need verification, e.g. social media. And for the sake of the argument, let's imagine that there are more than one social media. If the token issuer receives 4 requests from the same person, is it for 4 social media? 2 social media and 2 porn sites? Not so clear anymore.
Finally, let's pair it with an "eID" app. So people get the app to use an electronic ID (which is presumably useful for things that are not porn). Let's say that when you install the app, it gets 5 age tokens for you. You may or may not use them, it just creates them. Now the token issuer sees that everybody gets 5 tokens. Difficult to say that they all need to access 5 porn websites, isn't it?
I don't know if age verification is fundamentally a good thing. But "no amount of cryptography can protect against this"... I don't know.
> that would work, but then it becomes trivial for to copy the tokens.
Anyway it is trivial for a child to ask their parent to give them access to porn. The whole idea is that usually, parents won't do it.
Of course, understanding that requires a fair bit of technological knowledge.
I imagine most people, when visiting a porn site for the first time and asked to verify their age, if sent to a process that asks them to upload their ID or show their face on camera will simply refuse to do so - regardless of any assurances as to privacy.
This seems to have happened when Louisiana started requiring age verification - driving people, both children and adults, to sites that don't comply with the law, proxy servers, VPNs or Tor. I doubt it'll be any different in France.
I think the whole point of the "eID" would be that people don't have to do that. Using Zero Knowledge Proof.
In France's case though (from the article):
> Instead, users must verify their age using a credit card or a government-issued ID. This check must be carried out by an external service, not the porn site itself.
The whole question is: is it possible to prove your age to a pornsite without exposing your identity to said pornsite and without telling your government that you use it? And that would be the point of Zero Knowledge Proofs.
Now of course, there are infinitely many poor ways to verify the age.
I'm asking because even oauth would make this kind of attack vector impossible, as the referrer and redirect urls are verified - and I sincerely doubt they're so incompetent not to do something similar in such a context.
There are a lot of verification platforms, so the idea is that the user is asked to be verified and that his proof of identity is reused in live for something else. In the addressbar, user sees "dangerousporn.com" -> "safeidentify.com"
The operator of "dangerousporn.com" starts (manually) an application to a [bank account / crypto exchange "bank.com"], using a fixed residential proxy (Luminati / Oxylabs, etc).
Once a victim arrives on "safeidentify.com", the user that is on "safeidentify.com" is asked to follow the actions that "bank.com" is asking to do (upload your ID, turn head left, turn head right, up, down).
"safeidentify.com" plays back the recorded video on the KYC platform of "bank.com" using an emulated Webcam.
Difficult ? Yes and no, but manually doable on a case-by-case basis, and you don't need thousands of victims as it is really worth.
but ignoring that: none of what youve written there has been enabled by an identity provider hosted by the state. These scams already exists, today and various "special" users fall victim to them.
but lets ignore that too: these verifications are usually done interactively and cannot simply be played back, as you need to actually react to the actions of the person verifying your identiy
but lets ignore that too: its _highly_ unlikely the service will make users upload IDs and get verified via video etc on every connection. I'm gonna bet this is a one-time action, and after that you'll probably have to simply authenticate via 2-3 factors (username, password, biometric, sms, email, e-pass, certificate etc) - so what you're insinuating (this service makes people numb to such situation) is implausible. Especially in the context this scenario is in: merely verifying >18 yo
yes it's exactly the point, use porn websites as a hook to convince the user to do your actions to verify their "identity"
There are minimal privacy implications; it could also be applied to privacy laws and the like protecting minors; it would be trivial for sites to comply.
Age verification is the most obvious solution but comes with the downside of potentially leaking private adult activity or information.
I suppose my POV is that the benefit here outweighs the good even if imperfect. Porn just isn’t a necessity even if some folks really enjoy it.
I don’t hold that POV strongly, I pretty much formed it while writing this comment. I’m be interested in hearing other perspectives.
You cannot be unaffected by events.
(I know the quote is paraphrased, and specifically talking about philosophy)
The problem with that is that minors will be looking at porn. You're not going to stop a horny 16 year old.
These laws will certainly take care of age gating the decent, well-willing websites. The shady, probably unmonitored, or even niche websites outside of the mainstream, won't.
Aside from the obvious VPN workaround, this will only push curious teenagers towards worse websites.
As for privacy risks, privacy-friendly methods do exist. Yivi (previously dubbed IRMA) is a proof-of-concept that has been running for a while for privacy-friendly verification and data exchange using signed attributes (https://irma.app/docs/what-is-irma/). A signed "user-is-over-18" attribute is all a website would need to verify a user's age, without any other details.
Privacy-friendly age verification won't stop the other risks and problems these law may impose, though.
Lol they won't. dark IDs or just AI altering their IDs, the second france enforces such law there will be some entrepreneur that makes an AI bot that accepts your ID and then changes the DOB and then spits out the video/images for KYC.
Or you have a ID issued by France, and you'll use that.
Besides, heavily depends on how the verification services implement their checks. Whenever I (Spanish resident, Swedish citizen) end up having to do verification checks for some EU/Spanish service, they usually have more or less every type of ID I could have been using available.
I also don’t take it as a good argument that, “some people will break the law and therefore there should be no law.” E.g., “decent, well-willing” people pay taxes but, “shady, probably unmonitored,” people don’t. Yet we don’t say, “there shouldn’t be taxes,” on this basis.
Why do you believe this? I wasn't sure what to believe, and after some casual searches it seems like the percentage who reported ever having used pornography is actually decreasing, but the frequency of viewing pornography has gone up for those who actively view it. But it also seems to differ a lot by country, what I found for Sweden doesn't match what researchers found in Spain, for example, and I'm sure the US would be different too.
It would seem to me like parental controls and supervision of computer/phone use is much higher than when I was growing up. Basically none of our parents understand what this new "interwebs" thing was about today, but every parent today know exactly what it is. None of us kids had any parental controls on our computers AFAIK, but today it seems to be the norm, at least what I can tell from my own circles of acquaintances.
In correlation, no doubt, with how many minors have cell phones that can be used anywhere, with a good expectation of privacy. It's not like how it was when I was a kid, where the average kid had access to maybe the family computer or, if they were lucky, a laptop.
> E.g., “decent, well-willing” people pay taxes but, “shady, probably unmonitored,” people don’t. Yet we don’t say, “there shouldn’t be taxes,” on this basis.
The better comparison would be with another vice. I don't particularly care about marijuana, but given the choice, is it better as a society to give people legal, certified, safe weed choices, or should it be relegated to street dealers that might cut their product with other stuff?
Sure, but this law will drastically reduce the amount of time the average 16-yo looks at porn. Also, if you are going to engage in a vice, then it is healthier if you have to exert some effort or run some risk (if only the risk of trying to access porn and failing) to do it rather than being able to do it perfectly safely from the convenience of your home -- and it is healthier if there is a delay between the impulse to look at porn and when you actually start looking.
I guess the devil is in the details. I think you're talking about this from the context of USA, where I think a minor is up to 18, while a minor is up to 15. Then what constitutes of "porn" is also very different, I'm sure pictures of topless women could be considered porn in some places, while not in others.
So by some folks definition, a lot of content on current social media would be considered porn, and by others, a lot of content on porn sites wouldn't be considered porn.
What's lacking in these discussions are almost always: Not being specific enough about used terms and also providing enough context to understand the specifics and where those come from.
Without hormones driving people to it it’s uninteresting. After hormones kick in there’s upsides and downsides to porn, but those hormones are pushing a drug like effect and thus addiction either way.
This is a delusional worldview.
Banning pornography nationwide, limiting video game time etc, therefore inevitably results in kids dying. So you need to demonstrate the benefits outweigh that tangible harm.
If so, you are deluded and quite honestly disturbed. I mean this with pity, you should seek counselling.
Mean, the median is irrelevant here for hopefully obvious reasons.
> you are deluded
You keep saying that word, but facts are facts. If your argument is it’s better for more kids to die, that’s fucked up. Alternatively you could be ignoring reality, but there’s no third option here.
Also, there’s significant questions around porn and early sexual activity with evidence in both directions. Unsurprisingly, people be complicated.
Just as an example the “explosion” of access to internet porn would, if the often stated theory of significant impact be correct, presumably have had population level impacts on when people first had sex but 1997 to 2007 showed ~zero changes. “The proportion of high school students who were sexually active has remained steady since 1997” https://pmc.ncbi.nlm.nih.gov/articles/PMC3064497/
Obviously being a survey the data is suspect but it is still a meaningful datapoint here. Political arguments don’t need to consist with reality but science does.
The system they have seems reasonable, though? Verifier doesn't know site; site doesn't know user. Not going to be perfect, but is quite good.
>This system, referred to as “double anonymity”, means the porn site receives only a yes-or-no confirmation that the user is of legal age. The age-check provider knows who the user is, but not which sites they visit.
So is there an issue here if the external service disposes of the card details immediately following confirmation? I'm not exactly sure how this would/could work though.
What minors are exposed to, and educated about, is the parents primary responsibility to deal with.
Minors will somehow get access to porn and nudies, age verification will not stop them.
And yes extreme types were already thing then too. Bukkake, gangbangs, all my friends in school saw these things. I'm pretty sure most of them have never done those practices in their lives. They're all pretty boring family men now. And they are respectful to women. Society is doing fine.
Yes and no. We're sharing this responsibility in half with the government, due to public education requirement.
The moment a kid starts attending an educational institution - which can be as early as 1yo (daycare) or 3 yo(kindergarten), and usually no later than 7yo (where mandatory education usually kicks in), the parents lose control over what their kids "are exposed to, and educated about". But the problem isn't the educational institutions either (though they sometimes contribute).
The problem is other kids.
Minors will get access to porn and nudes in their teenage years, and there's fuck parents and teachers can do about it. There's always going to be a kid that somehow gets their hand on this stuff and bring it to the school. It takes just one for it to spread like wildfire.
To those who think a good parent should be able to protect their teens from exposure to porn: first demonstrate how one can stop a preschooler from contracting acute Paw Patrol or Frozen infection within first two weeks of kindergarten, and then we can talk.
I see similar arguments for food, drugs, safety, social media, etc. Patents aren’t super heros with infinite time to purify across all these dimensions.
Good parenting combined with societal guardrails lead to the best chance outcomes.
The ISP verifies your age when you buy internet access. The clerk verifies your age when you buy wine.
The clerk doesn't follow you home and make sure you don't give your kid wine. And, symmetrically, the ISP doesn't make sure you don't allow your kids access to porn. Once the transaction is done, it's in the parent's hands.
The difference is that parent's aren't very keen to give their kids alcohol... usually. Although it is explicitly legal in a lot of places. But for the internet, they are very keen so it's normalized and nobody cares.
Honestly the older I get, the less I can strongly care about this. For better or worse, porn is a relatively mainstream topic. If we can't have discussions about why porn taste is so potentially devastating to leak, we don't deserve privacy.
Besides, it's not like "leaking" of this information would lead to a public index of who is watching what. And maybe it should, I'm no longer sure.
I'd venture to guess the exposure to social media is far more harmful than porn, but I could be out to lunch as to how much kids are looking at porn??
A category where there has to be no violence, no degradation, decent representation of sexualities/races/body types, no incest etc etc…
Basically give enough to teenagers that they’re satisfied enough with it without having to look elsewhere and be exposed to the worse stuff.
Doesn’t sound entirely like a bad idea
In Germany, the drinking age for beer and similar lower alcohol drinks is 16 instead of 18, and it has a big impact in preventing teenagers from binge drinking vodka and such.
In the Netherlands, beer and wine are readily available in every supermarket, but you really need to get out of your way to get harder alcohol at designated dispensaries or liquor stores manned by a clerk.
Similarly, the laws on drugs make a significant distinction between softer drugs like weed (not legalised despite stereotypes, but tolerated) and harder drugs like heroin. There was a massive heroin addiction epidemic in the 70s, and such methods were remarkably effective in combating that.
It's not just about addiction or mental health, it's a whole different ballgame. These things carry big real-world physical risks, potentially deadly. Minors literally have different brain chemistries as they develop, and drugs can cause long-lasting effects unlike in adults.
Even gambling is not age-gated as strictly, with massive potential negative impacts to your livelyhood.
For the rest of things that might cause some psychological harm (maybe, hard to verify), like movies or videogames, we just have recommendations and some light barriers. Elevating porn to the top category is therefore quite a significant move, it is not the same.
So isn't speech! Not everyone need privileges to talk about human rights or democracy. China's doing fine with neither(officially).
By the way, unofficially and anecdotally, coastal Chinese prostitution as well as porn seem to be getting bigger and more wicked faster. I wonder which comes first: puritanism, or erosion of industrial base. This whole slow movement could be just a symptom than culprit.
I mean, when you go to an ISP to purchase an internet plan, they're going to ask you for ID and they're going to verify your age. It is then the parents responsibility to monitor that. If parents choose to turn around and grant their kids free access, then fair's fair.
Just think about alcohol and tobacco. The clerk is going to ask for your ID in the store, sure. But they're not gonna follow you home and make sure you don't slip your kid a cig or a bottle. That's not their responsibility, their transaction is done. And, actually, in a lot of places this is explicitly allowed. I think in most US states minors can drink under adult supervision.
So, if we want to solve this, we need to aim at the parents and convincing them (as well as giving them more tools) to do this reasonably. These identity solutions are a tool, but IMO, a rather blunt and unnecessary tool.
The ones that don't ... will have the nasty stuff.
If there is no need: Never
Most criminal laws are state laws, so you'll find at least[0] 50 different versions of any given crime. In some states, there is strict liability for an adult having sex with a minor (usually called something like sexual abuse of a minor; formerly often called statutory rape). In other states, the examples you gave would be valid defenses[1].
Laws requiring age verification have their own intent requirements. The Texas age verification law only applies when sites "knowingly and intentionally" distribute pornography[2] and imposes civil liability for sites that do so and fail to require either "digital identification" or use a commercial age verification service. There doesn't seem to be any specific requirement that they not make mistakes; it would probably default to negligence if it ended up in court.
[0] Some US territory is not inside any state, and there are federal laws that come into play when an act crosses state lines.
[1] Here's a statute from Alaska to that effect: https://www.akleg.gov/basis/statutes.asp#11.41.445
[2] https://capitol.texas.gov/tlodocs/88R/billtext/html/HB01181H...
IIRC the state of Texas was pushing for much worse, but basically the 'victim' was going to end up getting dragged through the mud and probably be forced to admit to all sorts of fraud and felonies involved in forgery, fraud secondary to forgery, and whatever other crimes are involved when you engage in crime with falsified government ID etc so they settled to avoid her having to testify.
It can also force pressure on the sites to more carefully filter minors to both avoid other jurisdictions following suite and criminal charges if continuing access to found to be granted French children.
> Another impossible to enforce law made by people who don't know what they're doing.
A law doesn't have to be 100% inescapable to be effective. In fact, this is an extremely enforceable law, and it is you who fail to see the application, either through ignorance or arrogance.
But it would be up to the parents to do this.
Wow - that is crazy for a country a 5th the population of the US.
> In this section we dive deeper into the Top 20 Countries by order of highest traffic.
With France ranked #2, which makes it seem like it's total traffic, not per capita.
I'm not a fan of these types of laws in the first place but, if we're going to have them, punishing distribution but not consumption will do nothing. On the other hand punishing consumption via law is just silly enough to most people (for now at least) that we end up with this law which only makes it inconvenient for adults to access porn.
I'm not so sure. Say you want to prevent children from accessing social media. Would you fine a child for that? Put them in jail?
On the other hand, it's pretty easy to ask Meta to verify the age. There are not a gazillion social medias out there: force them all to verify the age, and most children won't have access to them anymore.
The comparison to social media is a bit rough because the laws and focus there are around preventing children from creating accounts where their data is mined to be sold, the feeds are tailored to them, and their identities are publicly shared. The same laws do not actually attempt to prevent children without an account from viewing vacation photos. What applies in preventing account creation for social media does not necessarily apply to preventing content consumption itself in other cases.
I don't have a definitive opinion on Zero Knowledge Proof for social media access, but it seems like it may make it harder for children to access social media (the EFF is not really into those ZKPs, so apparently there are downsides too).
If you want to prevent most teens from consuming porn on the internet then they're the ones you have to somehow convince the risk isn't worth it. If you're not willing to do that in a meaningful way (which most, reasonably, aren't) then no amount of technobabble or pages of law are going to put a dent in their porn consumption.
First, I can't really consume content on Facebook or TikTok because I don't have an account. So I believe that your statement is not entirely correct.
Second, for social media there is the network effect. If suddenly most kids can't access them anymore, then they lose value for them. You'd need most of them to work around the check. Porn you can find in torrent, but a social media account you can't.
Again, I totally understand the issue with the check: who will be left out? What if adults get disconnected because they don't have a way to verify their age? Not sure that it would be a big issue for TikTok, but it would be a problem for WhatsApp (assuming that one would want age verification for WhatsApp).
> This system, referred to as “double anonymity”, means the porn site receives only a yes-or-no confirmation that the user is of legal age. The age-check provider knows who the user is, but not which sites they visit.
Seems like a reasonable solution.
The only remainig problem (provider knowing that you watch some porn even if not - exactly what kind) could be solved by requiring some other websites to verify age too. For example horror movies or liveleak videos.
If you verify using say, bank credentials, though, then those adults can't do the same since they risk losing money. Minimum balance checks are also necessary so it's not a "nothing to lose" situation.
Important to set incentives right when doing bans like this. Historically, it's been implemented very badly wherever it's been tried.
Of course an outright ban is also not a problem IMO, but many differ on that.
As far as I understand, the implementation would let the porn website verify you're above 18, and the payment processor would only know that you interacted with a age verification service to verify your age, but not specifically what website is asking you to verify your age. That would seem good enough in terms of privacy, unless I'm missing something?
Not perfect, nothing ever is nor ever will be. Also never try to block teens, that is a foolish losing battle.
[1] - https://www.rtalabel.org/index.php?content=howtofaq#single
Like in a location app on your phone generating (Lat Long) pairs. The app developer could just provide an inference engine running on a 3p trusted server to which an app developer has write only rights, e.g. a retrieval engine based on location — but cannot read. The user's app has read only rights — say get map tiles based on location.
Its just that this is not the universe we live in sadly...(Maybe the EU will become that)
Why the absolute focus on demand side and none on the supply side?
I guess the issue is they just want to stop young people from seeing porn? That's it? That's all society is concerned about, regarding porn?
But well distributing material via sneakernet is entirely possible and relatively cheap and easy. So after certain age they will get their hands on it.
And well, most will go to some other place that does not follow regulations. There is plenty of them and more will pop up.
If that ruling worked, they can extend it.
Let the industry be innovative and find solutions themselves to stay compliant.
It is not regulators responsibility to solve problems.
The question is what role porn has.
Regardless, my comment was more aimed at how we regulate than the effects of porn.
I explicitly mention that I do not assume this is related to porn.
I merely say that we did not turn out fine.
Of course it's a lot easier for those in power to divert attention to a moral panic like porn instead of acknowledging that our economic system and core values are making people depressed and hopeless to the point that they're becoming incapable of performing the one thing they've been optimizing for over millions of years of evolution - reproducing.
Something indicates that the feeling of equality (which most easily can be achieved with actual equality) would be more beneficial.
But then again, this would likely require taxing - something in particular Americans loathe for some reason (hint: decades of aggressive propaganda)
2017 — but links to a bunch of studies.
https://www.bbc.co.uk/future/article/20170926-is-porn-harmfu...
> Watching porn has been linked to a multitude of problems for individuals and wider society – but for every study maligning it, another clears its name. Often, evidence is mixed, and the research methods and sample sizes of studies have their limitations.
> Will the future of ever-more immersive porn may bring with it more risks? It’s too early to say.
> The question of cause and effect comes up a lot with research into porn: does porn attract more people with sexually aggressive tendencies, those who are in unhappy relationships, those with smaller reward systems in their brain and those with sexual addiction – or does it cause these things? It’s a tricky area to research – but until the answers are more definitive, the evidence so far suggests that the likelihood that porn has a negative effect very much depends on the individual consuming it.
—
yes, the ideal would be to not infringe on the liberties of anyone who doesn’t suffer from negative effects of it.
but we don’t live in a perfect world where there’s infinite resources :shrugs: so… apparently the trade off is age verification.
that’s the sacrifice we make as a society. we sacrifice some “rights” for the greater good, and the right to watch porn without having to do an age verification check is a bit of a first world privileged one if you ask me.
(i say that as someone who consumes a lot of porn and is personally dreading the upcoming uk age checks. but what’s good for society is not what i want most of the time)
no phones back then to stream full videos in the playground or on the school bus or in lessons or at work in the toilets or on a bus to work etc etc. needed a laptop or a porn mag or your parents being out to use the computer.
there was been a significant shift towards SEO based production as well around 10/15 years ago. which meant more “stepdad and stepdaughter” [0] or “stepbrother and stepsister” videos. there’s the more hardcore stuff i.e. where a woman is being slapped, thrown around, choked and generally treated pretty nastily. that used to be “niche” stuff, now it’s fairly mainstream [1]
i don’t remember seeing either of those ^ classes of porn when i was 13.
[0]: there was a brief period where it was “dad and daughter” filling up all the feeds on every site and the sites quickly noped the fuck outta that and forced video name changes (whether it was regulatory or not i dunno)
[1]: https://www.bbc.co.uk/news/technology-56640178
—
> A veteran porn star said in a recent documentary about porn that, in the 1990s, it constituted “making love on a bed,” and having “lovey dovey sex”. But in 2010, researchers analysed more than 300 porn scenes and found that 88% contained physical aggression. Most of the perpetrators were male, and their targets female, and the latter’s most common response to aggression was to show pleasure or respond neutrally.
https://www.bbc.co.uk/future/article/20170926-is-porn-harmfu...
Basically a cleaner society.
For example, a malicious inspector could open the site and pass any verifications in place while a minor is in the room, notice that the site did not prevent the minor from seeing the content, and fine the site.
Conversely, the site could claim they have found some fancy data analysis method to prevent access to minors in the wild while simply implementing some "we believe you are minor" page to be randomly generated once in a while, and claim in court that they have done their best and at most a small handful of children are getting around their complex protections.
In law making the is a concept of standards VS. Rules - look it up.
"you can not serve explicit erotica material to people under the age of 18" is very much a rule. It is super easy to asses whether you do it.
The law should not mandate how to comply.
Law makers do not care if you refrain from pressing the speeder or drive an under powered car.
I have never had flashbacks from watching porn, but there are things I saw, even on broadcast TV, that still send shivers down my spine.
I am disappointed to see fellow Europeans developing American-style "sex is bad, violence is entertaining" social customs.
Article 227-24 also covers violent videos of that ilk.
I still would not lump pornography with gore and promotion of terrorism, but it is an improvement.