The UK’s new age-gating rules are easy to bypass
theverge.com
theverge.com
Censorious governments have always been a thing since the beginning of the internet. Websites (especially non-corporate ones like 4chan or R34) preemptively surrendering to a foreign government that has no jurisdiction over them is what's new.
We have seen the same with the GDPR and now also with the UK Internet Safety Act.
Also, thinking that there might be a risk if you travel to the UK because your random website on the other side of the world does not comply with a specific UK law is rather overestimating your importance and the British authorities.
Jesus Christ, stay away from that country!!
https://www.bbc.com/news/live/c9q7r4wpep0t
TL;DR: UK politician
> She says he was referred to counter-terrorism scheme Prevent three times, but his case was not referred onwards
She also said that regulating the sale of large knives could help reduce stabbings, in the same way strict gun laws helped stop school shootings.
Honestly, in South (and North) America, everyone's carrying a gun. I wish we were talking about knife control instead.
IMO, we need to look at what countries like the UK and China are doing, where civilian gun ownership is almost completely banned.
Many countries, including the US, claim jurisdiction if you are providing services to their citizens. Some claim jurisdiction if someone in that country sees your web page (ie you've now "published" it there).
You've been blissfully unaware, perhaps, but this has been a thing for a long time.
You have probably seen sites having sections of their TOS tailored specifically for Californian users- this is not that different.
I think the UK legislation here is hamfisted and very harmful, but the jurisdiction argument is nothing new.
Reddit shows porn to kids too, as long as they tick the "Show mature (18+) content" box. Same with Telegram, Discord, WhatsApp, Facebook, and the rest.
The only apps that don't seem to turn a blind eye are Instagram, TikTok, YouTube and Snapchat. Epic Games and Roblox also do a great job, both have strong moderation teams and built-in tools to protect younger users. Every company should use them as examples. They've shown it's possible to build huge platforms without ignoring the safety of kids online.
Now that the UK forced these reckless billionaires to update their software to comply with the rules, every government should do the same.
Also I'd question putting Roblox in the child-friendly category. Hindenburg Research characterized the platform as a "Pedophile Hellscape". They obviously have a financial angle as a short-seller, but they point out some issues that seem pretty significant, in my opinion.
> We found Roblox to be an X-rated pedophile hellscape, replete with users attempting to groom our avatars, groups openly trading child pornography, widely accessible sex games, violent content and extremely abusive speech—all of which is open to young children and all while Roblox has cut content moderation spending to appease Wall Street and boost earnings.
> We put together a brief video compilation of Roblox moderation failures
The same game design reskinned wouldn’t be the same game, though.
I respect the Germans for their decision to pass and enforce their laws in Germany, and to have an opinion about how websites are displayed to German IPs, but I also am sensitive to the artistic intent of id software, while questioning the necessity of making the games in the first place. Nazi symbols are problematic for the same reasons that war movies are: even if you’re trying to make an anti-war or anti-Nazi piece, it still portrays the very same imagery and context in order to subvert it or supplant it. It’s somewhat self-defeating, and it’s fodder for fans of the things creators themselves may oppose to rally around and agitate for or against to raise awareness for their ideology and their support of it.
Ironically, id didn’t even start that franchise, though they did popularize the genre and their own place in it with Wolfenstein 3D.
https://en.wikipedia.org/wiki/Wolfenstein
That said, the original stealth based games were loosely based on real events in which Allied forces killed Nazis, so I’m kind of okay with publicizing notable historical instances of Allies defeating Nazis in World War 2 to a point. We’ve probably crossed that point as soon as id made Wolfenstein 3D, if not before that under Muse Software, which curiously disestablished itself after the second game in the franchise before id continued it. I don’t mean to find fault per se but the moment has passed to make these kinds of content in my opinion.
https://www.bbc.com/culture/article/20140710-can-a-film-be-t...
> “There’s no such thing as an anti-war film,” is a quote often attributed to the late French filmmaker François Truffaut.
High school students with phones at school are showing porn to their friends, even younger kids. Some schools have banned phones, but teens aged 12–17 can still access porn sites freely when they get home.
In my opinion, gambling sites and porn sites should always verify age, same goes for shops selling tobacco and alcohol.
I've heard this before, but I've never, not even once, gotten an evidence-based approach to if this is true.
I've only ever gotten morality-based arguments, which, IMO, aren't arguments at all and aren't worth mine, or anyone else's, time.
We cannot just act like pornography being harmful is a foregone conclusion. No, we need to prove it. We should not be legislating things, and giving up our privacy and freedom, before even defining a problem.
Intuitively, sure, it makes sense that porn is bad. It depicts sex, and in western puritanical cultures, that's bad. If people are exposed to sex, surely they're at greater risk of teen pregnancy, or STIs, or whatever.
But is this actually the case? In the past 20 years, teen pregnancy has fallen off a cliff. Rates of STIs are lower, too. In areas that teach abstinence-only education, they actually have higher teen pregnancy. Taking a more puritanical approach does not guarantee better outcomes, and based off the real-world statistics, it seems to do the opposite.
In addition, I have zero reason to believe porn addiction is even real. There's a lot of dispute among psychologists, with most not recognizing it as an addiction. The problem here is that an addiction is not a compulsive action. An addiction needs to impair your everyday life. That's the clinical definition of an addiction.
We're not seeing a lot of bad outcomes or impairment from pornography. It is exceedingly rare that someone who is consuming pornography is doing it to a degree where it negatively affects their lives. Sure, it's possible, but for the vast, vast majority of people this just does not appear to be the case.
Now, to get ahead of the curve because I've already had this conversation a hundred times - no, I am not addicted to pornography and I very rarely consume it. I have a happy and healthy sex life. I just reject the idea that it's harmful with no evidence provided, and I reject moral arguments in general.
What I mean by porn addiction:
In 2025, the average person watches around 6 hours per week of pornography. That's from recent industry and survey data. In 2005, the average was roughly 1.7 hours. So porn is clearly becoming more addictive.
Sex work has exploded online, especially with webcams and platforms like OnlyFans. In 2020 there were over a million sex workers. Now, there are over 4 million. And that doesn't include the many who are pushed into cam work just to survive.
This isn't just about kids spending money to watch their crush undress on a porn site. It's also about the workers, many of whom are exploited because the demand keeps growing.
This industry needs regulation, not to censor it, but to make it safe for everyone.
You're right - I haven't, because these people barely exist in the US. I've never seen them, I've never seen anyone who's seen them.
Also, sex work and pornography can't lazily be compared like that. No "demand" for sex work makes people become sex workers. People become sex workers because they enjoy it, or because they're fine with the outcome in exchange for the money.
The actual "harm" done by being a sex worker varies based on each person's moral beliefs. Some people don't care about that kind of stuff, so they're fine doing it. And, especially if you do solo work, there's very little real risk. There's only social risk, which again, is a different thing aligned with morality.
In terms of actual, real, tangible harm - what is the harm of sitting in front of a webcam and stroking it? Nothing. The answer is nothing. This is moral plight bullshit. I understand you don't like it and you think it's the downfall of the nuclear family or some other equally stupid bullshit - but the reality is nobody actually cares what you think. We care about outcomes.
And, right now, I'm not seeing the outcomes which align with this being compared to fucking tabacco. And I used to smoke.
> People become sex workers because they enjoy it
Ignorant.
No, I don't actually. Why not? Two major reasons:
1. You cannot naively equate things for free. You cannot claim porn is like narcotics without proving that first. I simply do not need to prove narcotics are good to show porn is fine.
2. When it comes to rights, we never, ever, take an approach of "it's bad until it's proven good". Ever. For example, I need not prove every single potential piece of speech is okay to advocate free speech. We take the inverse approach - all speech is fine, until it's not and we can prove it's not. I don't need to ask permission first. For example, yelling "fire!" in a theater isn't okay, but we reach that conclusion by proving it's bad - NOT by proving everything around it is good. Does that make sense? It's a sort of innocent until proven guilty approach.
We do not restrict rights without first proving doing so will be good. You are, implicitly, granted a right to do whatever - EXCEPT the stuff we've taken the time to blacklist.
So, if something is bad, that's something you need to prove if we want to restrict that right. I don't need to prove it's good, I implicitly have the right. For example, in practice, there's a lot of bad stuff I can do that I have the right to do. I have the right to watch a scary movie that will keep me up at night. I don't need to prove anything is good, and we don't need to write a law like "scary movies are good". YOU would need to prove they're bad, and then write a law like "scary movies are bad, no more scary movies".
> because these people barely exist in the US. I've never seen them, I've never seen anyone who's seen them
Well, that's not what I said, it appears you're trying to be dishonest.
You said there's people who "spend all their money" on porn and that daughters are increasingly becoming sex workers. I said this is rare, which is true.
What you're trying to do is say porn is bad by appealing to a worst case scenario. It's a common argumentative tactic people who don't really know how to argue use.
For example, cars are bad because people fly through windshields and paint the freeway with their brains. This is true, and does happen, but without a qualifier for how often it happens, it's worthless. This statement says absolutely nothing about how good or bad cars are.
But, to be clear, even if it did, that alone would not be enough to sacrifice any and all privacy and security. See, the problem here is you're making multiple levels of arguments, of which you cannot even justify the lowest level.
Making the argument that porn is bad is one argument, making the argument that this means we should sacrifice privacy or security is another argument, and a much more difficult one. You haven't even proved the more fundamental argument, so certainly you're a long way away from proving the more stringent one.
I've also had a kid in a London school for the last 9 years, so I'm in the parent whatsapp groups etc, and talk to parents about what should be done.
For a politician, getting parents to agree to "Should we protect kids from harmful material on the internet?" is an easy statement to make, and an easy one for parents to answer. The next steps are the hard ones, which is why enforcement of this legislation was delayed over and over again. This was first legally mandated in 2017! Then delayed, abandoned, delayed, reintroduced, etc. Why? Because getting the implementation right is very hard, and I do not think that this current system will be effective at stopping much harm to consumers of pornography, but I do think it will lead to terrible privacy breaches.
AFAIK, the UK forced the big porn tech giants to hide explicit images and videos from the public unless users verify their age. Twitter, Telegram, WhatsApp, Reddit and other companies failed to do that. These US businesses turned a blind eye to porn just to make more money.
I think what the UK is doing is a step in the right direction. It's about holding the billionaires behind these apps accountable for what they show to kids. It won't fix everything, but it will force the big players to change their software. And that's the first step toward making things better.
In my opinion, this should be a universal law: want to gamble, watch porn, smoke or buy alcohol? Show your ID. Simple as that.
> I do not think that this current system will be effective at stopping much harm to consumers of pornography, but I do think it will lead to terrible privacy breaches.
You mean the system that verifies age could get hacked and expose all the IDs people uploaded? Yeah, that's the risk. But we already hand over ID for flights, banks, hotels, etc. The real issue isn't showing ID, it's trusting the people behind these porn sites, which we know cannot be trusted.
Until just now, no, they had not forced them. They had repeatedly delayed and denied, just trying to win electoral points.
I think you underestimate how easy these regulations will be to get around. I was once a teenage boy with some tech-nous. This would have been a walk in the park then, and kids these days know a lot more than I did back then, not to mention all the bad-actors that will happily help them. It isn't as simple as "oh no, so IDs will be leaked".
Also, if you think you can understand the depth of the people behind the porn sites, you're in for a new awakening. Of course, you can't trust them- but if you could, then there would be new porn sites the next day that you could not. Which sites will implement these changes? Which ones will not? The answer to this is half the battle being faced ..
Maybe the solution is for governments to set up a simple age verification service, an official site where you pay $1 (refundable) to prove you're over 18. Then they could offer APIs that any website can plug into to verify users. Kind of like how barcodes work.
To avoid privacy issues, the verification site should only store a hash of the email, no images, no credit card info, nothing else. Just enough to confirm the person passed the check. A digital proof-of-age system without tracking or storing sensitive data.
If you’re unwilling to accept this, then you must be extremely careful when you travel internationally or turn off access to that country altogether.
This is true for every country on Earth. This is the price of doing business internationally.
Agreed, and I like to point out the same when talking of Apple and Co. not liking EU laws. This however, is very different.
It's more akin to me publishing a book in my own country, then another country's book importers importing that book and me getting in trouble for putting into print ideas that are not allowed there.
Remember, I'm not the one importing the book (the ISP in the case of a website), nor did I ask for it to be done.
I think it'd be difficult to argue against that unless someone else was a proxy middleman during the delivery of the book (VPN).
It’s not my analogy, I’m just running with it ;)
But to run with it more: connecting to the website is analogous to an order. Like a person ordering a book or a patron ordering a drink at a bar. The bartender must ask for ID if they suspect the person is not of age.
If a book was illegal in a location then I think it could be argued that delivering it to the location could be akin to smuggling contraband. So I don’t think your reasoning gets you off criminal liability.
By the way, this is all academic. These laws won’t be enforced. It’s all nonsense. There’ll be some public knuckle wraps for the big providers, but that’ll be it.
If you’re a business that falls foul of the laws, you should still adhere to them. But if you’re a small, self hosted site, nothing will happen. The uk police have no resource for something like this and so unless you’re completely egregious, I think it’s not worth worrying about.
Agree with the point that it's mostly to extort larger firms who do in fact operate businesses there.
Reddit shows porn to kids too, as long as they tick the "Show mature (18+) content" box. Same with Telegram, Discord, WhatsApp, Facebook, and the rest. The only apps that don't seem to turn a blind eye are Instagram and Snapchat. Epic Games and Roblox also do a great job, both have strong moderation teams and built-in tools to protect younger users. Every company should use them as examples. They’ve shown it's possible to build huge platforms without ignoring the safety of kids online.
What does this have to do with enabling parental controls? You can define an allow list of websites to visit and disallow installing new applications. A billionaire turning a blind eye wouldn’t affect that, except in ways that would be very obvious to the parents like resetting the control settings.
You're shifting responsibility to parents instead of asking billionaires to check kids' ages before letting them access porn sites, just like other businesses ask for ID when someone tries to buy alcohol or tobacco.
Telling parents to fix the problem isn't the answer, that's what governments are for: to regulate billionaires and hold them accountable.
Your points above are valid and real concerns, in addition to liveliness. There is work further to be done and improvements to be made. But it seems to me that they are solvable problems.
These datasets are getting granular, monolid vs non, 12+ different ethnicity sub groups and so forth.
Do you not think that with enough data it’s solvable?
But they now have a reason to require age and ID checks to buy VPN. Then ban payments to VPNs that don't follow said regulation.
You'll see.
Also UK had law for years that can land you in prison for not providing decryption keys for data that you supposedly encrypyted. It's not actively used, but it's there.
So nope, there plenty of UK politicians from both parties that will happily push something that will invade your privacy. And really no one who push against it.
It is actively used, it's just most people fold and hand over the data [0][1][2].
[0] https://www.bbc.co.uk/news/uk-england-11479831 [1] https://www.pinsentmasons.com/out-law/news/court-of-appeal-o... [2] https://news.sophos.com/en-us/2017/09/27/campaigner-who-refu...
Most parents don't want their kids looking at porn. While there are steps they can take to prevent it, they require some technical knowledge and are generally easy to get around. The easy availability of this content is what has changed. You used to have to go to a seedy bookstore, "adult" movie theatre, or video rental business to get it, and they wouldn't let kids in. Also you had to pay for it, and most kids don't have any money.
They're already using the "online safety act" to silence people online.
They're super scared because a great many people have had enough. Crimes numbers, including rapes, are through the roof in the UK. And they want to silence anyone who wants to talk about criminality on the ultra rise.
The UK is on a very dark path. It's the country in the world with the most millionaires fleeing the country: mainstream media brainwash the people saying it's supposedly for tax reasons these millionaires are leaving.
But I live in a country where many millionaires and families have family offices and trusts and the tune is very different.
People are scared of what's going on. Both criminality and religious extremism are rising at a more than alarming rate. And not only is the government doing nothing about it, they're going after those denouncing the crimes.
People are now stabbed to death for their watch in London. A few days ago:
https://www.lbc.co.uk/crime/three-arrested-man-stabbed-death...
Leftists refuse to see it. They'll rationalize that that man was a capitalist oppressor for wearing a Rolex and that he provoked these people by wearing a $10 K watch. That he's the reason these killers were broke and forced to act evil. That they shouldn't get much jail time because now they'll surely be nice members of a high-trust society.
These people are precisely those who brought the Online Safety Act. But it's Orwellian and Orwellian talk: for what the Online Safety Act is really used for is to silence talk about crimes.
I'm in the EU: in a few years leftists shall probably have put a system in place where police shall come and knock on my door for my posts on HN.
> “People are scared of what's going on. Both criminality and religious extremism are rising at a more than alarming rate.”
Crime is down and has been going down for 10 years. For “religious extremism” I’ll just read “I don’t like brown people”, because extremism is only really growing due to white supremacy groups.
> “they're going after those denouncing the crimes.”
No, they are not, they are going after those fomenting violence (literal riots). In one case leading to white supremacists trying to burn down a hotel with refugees in it.
Crime happens. It doesn’t mean one crime is a symptom of a wider problem. And breaking news: crime is committed by white people too. RE: the Rolex watch crime — I walk through East London with a Patek Philippe on my arm and have zero concerns, I’m not scared, nor do I live in fear. Nobody I know in the UK is scared or living in fear — that’s just agenda driven rhetoric.
Maybe get off twitter and/or the far-right manosphere and try changing your news sources for something more balanced.
Which route do you take? Just asking for, er, a friend…
https://www.statista.com/statistics/288256/violent-crimes-in...
https://www.ons.gov.uk/peoplepopulationandcommunity/crimeand...
There’s a note: “Trends in police recorded violence with and without injury should be interpreted with caution, as improvements to recording practices have had a substantial impact on the recording of violent crime over the last 10 years. For further information, see Section 19: Data sources and quality”
So, if your stats are a mirror of the ONS then they’re not telling a complete story.
The ONS states: “Crime against individuals and households has generally decreased over the last 10 years with some notable exceptions, such as sexual assault”
But it also states: “Trends in police recorded sexual offences should be interpreted with caution as improvements in recording practices and increased reporting by victims have contributed to increases in recent years. For further information, see Section 19: Data sources and quality.”
There’s no way the OP’s original statement holds up: “Both criminality and religious extremism are rising at a more than alarming rate”
I notice he’s now edited to “criminality and rapes” — he has an agenda. It’s utterly tiresome hearing people outside the UK trying to tell us how scared we are, when it’s complete bullshit.
The ONS states that crime is generally down. That’s all I claimed. The OP has been editing away to make his point seem less racist are more pertinent to these follow up replies, which is utterly tedious.
This whole forum seems to have had a lurch into extremism over the past year or so. Either that or these people have been lurking in threads I wasn’t looking at before. I find it crazy that people are downvoting my response which cited facts and pushed back against blatant misinformation and veiled racism. We live in a crazy world where people think this rhetoric is reasonable and ok.
If anything, having spent quite a bit of time walking through the only areas of East London recently that slightly unnerved me when I first moved to the UK in 2000, they're now mostly solidly gentrified...
In a city of 10 million people crime is bound to happen, but I’ve never felt unsafe in London. No more than any other major city I’ve been to. And the same with the UK as a whole.
Nonsense.
What other forms of extremism do you believe is growing? Compared to, say, 2007? Where we had hate preachers at Finsbury Park mosque that led to 7/7 and the ‘shoe bomber’
It's a portmanteau of ECHELON [0] and Elon Musk. I've never cared for him, and especially not now that he is advancing fascist ideology.
To counter your point, it would depend on how you define extremism. If you want to define extremism as acts of violence then I can understand.
However there are plenty of fundamentalist/extremist views within the UK which exist regardless of what the right wing does.
I don't need to, the government already has widened the definition to include white supremacists and has a list of proscribed groups. This allows Prevent (the de-radicalisation programme that was originally set-up for Islamist terrorists and potential terrorists) to work on de-radicalising white supremacists too and for MI5 to focus some of its energy on preventing extremism and violence in the UK.
> However there are plenty of fundamentalist/extremist views within the UK which exist regardless of what the right wing does.
I am certainly not saying "right wing bad". I'm saying "far-right white supremacy bad". And probably "far-right bad" in general, just like I'd say "far-left bad". Extremism, in general, requires you to move away from compromise. Whether it's far-left or far-right, in my judgement it will always lead to conflict.
It's a bit odd to focus on the anti-government protests and call them terrorists, when they were out protesting because the government failed to adequately protect them from an actual terrorist.
He isn't a migrant. He was born in Wales. He's British. 100%. This is exactly the kind of language that starts the wheel of hatred rolling.
Nobody knew anything about him when the riots were fomented by the white supremacist lunatics. They just made it up because it fit their narrative and allowed them to go after brown people. They invented a muslim sounding name and claimed he was an asylum seeker. None of which was true.
> The UK government initially refused to release information about the perpetrator
They didn't "refuse". It's normal practice for the police to not release the details of an alleged perpetrator.
> which caused speculation and confusion about the attack.
Speculation is not a good enough reason to try burning down a hotel with refugees in in. I'm sorry, but there is no defence for the violence and hatred that was stirred and fomented by the white supremacist lunatics (and by Musk et al).
What happened with those children is tragic. Truly. But that doesn't give a free hand to white supremacist lynch mobs.
> It's a bit odd to focus on the anti-government protests and call them terrorists, when they were out protesting because the government failed to adequately protect them from an actual terrorist.
That's a fucked up sentence. He committed a crime, not an act of terrorism. A horrific crime, yes, but what came after was not an "anti-government protest". It was a riot where people were actually trying to murder immigrants based on no information other than what they had made up themselves. I mean, a mosque was attacked the following day and the perpetrator is a Christian (or at least his family is). That's not a protest, that's pure extremist hatred.
You're not helping.
This is far-right propaganda.
https://www.macrotrends.net/global-metrics/countries/gbr/uni...
Crime is “generally down” in the past 10 years according to the ONS, so I wouldn’t expect the ranking to have changed much (in the subsequent 5 years).
[1] https://www.economist.com/content-assets/images/20250726_EPC...
[2] https://www.economist.com/content-assets/images/20250726_BRC...
> “People are scared of what's going on. Both criminality and religious extremism are rising at a more than alarming rate.”
He then edited the comment once I called him out on its veiled racism and once he'd seen the thread following from that (the discussion around ONS statistics where I highlight that crime is generally down, just not sexual offences). He then changed his comment to:
> "They're super scared because a great many people have had enough. Crimes numbers, including rapes, are through the roof in the UK"
I realise that @vidarh replied to the updated text. But there are a couple of points:
1. If you go to the Office for National Statistics Crime in England and Wales report [1], you'll see the following comment:
"Trends in police recorded sexual offences should be interpreted with caution as improvements in recording practices and increased reporting by victims have contributed to increases in recent years. For further information, see Section 19: Data sources and quality."
So, an increase in the numbers doesn't necessarily mean actual an increase. It would also explain why the percentage of solved (sexual) crimes is decreasing.
2. Even if there was an actual increase, that doesn't change the fact that crime is down overall (which counters the original statement by @TacticalCoder)
3. It also doesn't invalidate @vidarh's link which shows crime in the UK is low compared to other nations. So, if some areas have increased, then the overall picture is still relatively good for the UK. It certainly doesn't fit what @TacticalCoder originally wrote: "criminality and religious extremism are rising at a more than alarming rate".
Editing the comment from the one that was called-out to a whole new statement, that maps onto the one crime stat that is actually going in the wrong direction (but might not be due to changes in how its measured), is extremely disingenuous.
[1] https://www.ons.gov.uk/peoplepopulationandcommunity/crimeand...
What you will see, however, is that the reports have dramatically increased. See figure 3. Combined with relatively static reported rates of rapes, this is good - it means a large proportion now do get reported.
But given the number of reports have drastically increased relative to the rate of crimes as reported in the crime survey, it is not surprising that charge rates have fallen, as it's at least plausible that a number of incidents that are now reported that wouldn't have been before are those incidents with insufficent evidence. (That doesn't mean it's not problematic that the charge rates have dropped, of course)
What is clear, is that there is no evidence for the contention in the comment I replied to. It's a common far-right talking point used to sow fear. I'm not suggesting that commenter who posted it are intentionally pushing far-right talking points - I know plenty of people on the left who have been tricked into repeating this as well. But they are unambiguously talking points that are being abused by the UK far-right to push a narrative of a collapsing society that does not match reality.
[1] https://www.ons.gov.uk/peoplepopulationandcommunity/crimeand...
You see, this bill was passed in 2023, under a Conservative government; then a Labour government was elected in 2024, before the bill came into force.
A nice little time bomb, set by the outgoing government - impractical and illiberal, but labelled all over with 'children' and 'cyber-bullying' and 'violent pornography'
So if the Labour government keeps the legislation, they look like heavy-handed censors silencing LGBT voices and local hobby/community forums, yet if they repeal the legislation you can criticise them for wanting children to have access to violent porn.
A Labour politician who thought this was shitty legislation, but who didn't think going on record as a pro-pornography voice would help his or her re-election prospects, might be entirely happy for age checks to be easy to bypass.
The last Labour government (1997-2010) passed the counter terrorism act and had multiple public arguments about how long suspects could be detained without being charged or released in their future legislative attempts - see "prolonged detention" in this: https://www.jrrt.org.uk/wp-content/uploads/2019/06/Rules_of_.... They similarly passed the Regulation of Investigatory Powers Act, which amongst other things includes compelled key disclosure (or compelled decrypt). They also had the national identity register planned as part of ID cards.
For fairness/balance, the tory government passed multiple acts. Online Safety Act was one, but the Investigatory Powers Act another - this did some relatively mundane things like call security service hacking "equipment interference" and say they were legally allowed to do it, but it was the act used on Apple to mandate technical capability to access iCloud e2e (act written by Tories, but TCN probably by Labour home office I would guess based on timing).
1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message.
2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18": true}, public key information, and signature of returned message.
3) Client returns original message with message received from identity authority to the site. Site verifies that id's and requested data match in both messages, original message authenticity via HMAC and signature of message from identity authority using public key cryptography.
User hasn't revealed any PII data besides "is_over_18" value to the site and identity authority doesn't know which site user is accessing.
Requirements: User registers and verifies identity at identity authority. Site trusts identity authority.
Limitations: Site could, behind the scenes, send the generated ID to the identity authority, informing it which site was accessed using this ID.
Also authority could also do it. Nothing stops them from that.
Create a service that generates a random token and then gives it to anyone who is over 18. Any service with any employee who is over 18 can get the token and then compare it to the one submitted by the client. Everyone uses the same token across every service and the token is only available to someone over 18.
The security isn't any worse than having user or service-specific tokens and the privacy is significantly better.
The second problem is universally intractable. If you have the cooperation of someone over 18, the service will let you in and has no way of knowing that the person using it is a different person.
Now realise the UK doesn't have a government issued national ID. Not to mention if it did this would mean everyone re-requesting it on their 18th birthday...
If you want the token between when you turn 18 and when you next renew your ID then show your ID to any adult at any government office or anywhere else and have them give it to you, or get it from your parents.
How? The token isn't specific to any user or service. The only information the ID provider gets is that you requested the token and the only thing the service verifying your age gets is the same token shared by everyone over 18.
But someone could share this token publicly and then everyone could have it.
How is this any different than using any other way of doing it? It's always the case that someone can provide their ID and let someone else use it.
If someone uploads shared token publicly, it's hard to identify who did it and anyone can use it until you rotate the token for everybody.
This was the thing your proposal was supposed to do:
> User hasn't revealed any PII data besides "is_over_18" value to the site and identity authority doesn't know which site user is accessing.
If you have that, someone sets up a service that uses their ID (or a set of IDs from any data breach) to provide tokens to anyone.
If the tokens can be mapped back to the IDs, the alleged privacy protection is fake. If they can't, you don't know whose ID is being used to generate tokens for third parties.
Your choices are "no real privacy protection" or "you don't know who is sharing tokens" and the first one is unacceptable, at which point you might as well use the simpler system.
Same ID also cannot be registered more than once at the same identity authority.
Identity authority doesn't provide tokens, but signs (nonce + requested age data) requests that user gets from a service he's trying to access. User needs to be logged in to do that.
If user shares identity authority credentials, that would show in suspicious auth pattern (e.g. accessing from multiple locations at the same time) to identity authority and account should be blocked and require the whole KYC process again.
There is an issue of someone with stolen ID registering at identity authority where true owner of ID hasn't registered and passing KYC process. This could me mitigated by, for example, limiting at which identity authorities a citizen of a specific country can register, limiting the number of concurrent registrations at identity authorities concurrently (for example an ID can be registered at max one identity authority globally at a time. You would need to close account at current identity authority to open it at another) and/or stricter KYC verification (like in person).
Again, even if someone succeeds in registering with stolen ID, sharing of the credentials still needs to be limited in order to avoid getting blocked.
In short, it all depends on identity authorities doing a good job at KYC verifications process.
I haven't looked into it very much, but at a glance it doesn't sound terrible. Here's the basic flow[3]:
- The User initiates an age verification process by enrolling with an Attestation Provider (AP), which collects the necessary evidence from authentic sources or trusted 3rd party private data sources.
- The AP generates a Proof of Age attestation and issues it to the Age Verification App Instance (AVI) of the User.
- The AVI presents the attestation to a Relying Party (RP) when attempting to access age-restricted services.
- The RP checks the validity of the attestation, referencing the trusted list to confirm the AP's authorisation.
So it uses an app on a mobile device as a proxy of sorts. They're also working on incorporating zero-knowledge proofs[4].
[1]: https://digital-strategy.ec.europa.eu/en/news/commission-mak...
[2]: https://news.ycombinator.com/item?id=44561797
[3]: https://ageverification.dev/Technical%20Specification/archit...
[4]: https://ageverification.dev/Technical%20Specification/archit...
https://support.apple.com/en-gw/guide/apple-business-connect...
> When you integrate with Verify with Wallet on the Web, you disclose the identity information your website requests and for how long. Your website then receives permission to request only the specific data required to address your use case. This prevents users from having to overshare their identity information. Neither the state issuing authority nor Apple can see when and where a user shares their ID.
Google is doing something:
https://developer.chrome.com/blog/digital-credentials-cross-...
> The Digital Credentials (DC) API, allowing Chrome users on Android to present digital credentials from a wallet app on the same device, is already in an origin trial. We are now extending this origin trial to support cross-device digital credentials presentation. With the cross-device capability, users can now scan a QR code displayed on desktop Chrome to establish a connection to securely present credentials from their Android phone.
Web standard for Digital Credentials: https://w3c-fedid.github.io/digital-credentials/
if there's one thing the internet doesn't have a shortage of it's bootleg streaming sites
This might be stupidest advice I've ever heard. If parents aren't willing to block or control access to porn sites, there's even less chance of them blocking or controlling VPN usage. But if nothing else, it does show up this law for the nonsense that it is.
There's a plethora of free VPN services operating outside the reach of UK authorities.
My sons friend circle all figured out how to use free VPN's at around 8-9 to bypass bans on gaming servers.
We can debate all day, but I feel very sad to be in the technology sector in the UK right now.
Why? I feel more sad for the citizens the government is trying to surveil upon 1984 style.
Far simpler, if you're a teen that wants to get around the block, to just have an older looking friend do the video selfie.
I am not sure what will be easier.
Governments never seem to learn.
There's also non-bank pre-pay cash cards such as Henry I think one's called, so parent loads it up with pocket money or whatever and I think gets more control/oversight than actual banks probably offer even on dedicated children's accounts.
Revolut also offers accounts from age 6.
Parents would get notifications, but I suspect most parents won't be technically inclined enough to have an issue with a well argued child pointing out they need that VPN to access a game server or region locked content that their parents don't object to.
That said, I'd suspect most kids looking to circumvent these blocks will just install a free VPN.
Got her a debit card as soon as they were available for minors.
The point is that this kind of control will drastically reduce under 18s consuming content that they shouldn't. We don't need the all of society's controls to be flawless.
And that is before you consider that what you're ultimately doing, even if your blocking strategies were successful, is steering kids towards the darker markets where illegal and actually harmful content isn't removed and that don't care about your ID laws.
- Benjamin Franklin
If you were old enough to pass for 18 yeah a newstand might sell you a magazine. Most would not if you were clearly younger. And you needed to pay for it. Most kids (especially young kids) don't have any money.
And then you had one magazine. Still photos. And it didn't show anything but naked bodies. No real sex, the hardcore stuff was only in adult bookstores.
It was virtually impossible, pre-internet, for an average kid to find a way to spend hours and hours looking at an endless stream of hardcore porn.
But I'm afraid they're only there to satisfy the puritans. The average shitty content that you 'consume' will still be fine.
The US is always against regulations when they don't benefit their companies, whether it's social media, AI, porn, tobacco, or weapons.
The EU and Asia are doing a great job protecting their people from harmful US goods and services. On the other hand, South America and Africa are poor continents with little power to negotiate.
We went from being up in arms to complete acceptance of this as the norm shockingly fast. Well under a year.
I live in a European country now that prides itself on "individual freedom", and basically can not visit outdoor public places. When I suggest an establishment ban smoking on their terrace, they find it unthinkable. This was the very reaction people in the UK had, _until it got passed in law and everyone was fine with it_
We don't, but we do need them to be at least close to best-effort. This is a nonsense law, implemented in a nonsense way. Clearly nobody cared whether it worked or not, and there's either an anterior motive or it was something the current government (whose idea it was not) couldn't back out of without being labelled "pedo-loving scum!".
Unfortunately, I can't let your examples go without comment either. Age restrictions on the sale of tobacco caused a dive in the numbers of children smoking since those shops absolutely stopped selling to children when the penalties came in. I know, I was one of them and none of my friends could get cigs from shops anymore. As for the height restriction bypass; we're not in Looney Tunes, that's not a thing.