Hacker News Reader

Comment by ryandrake | Hacker News Reader

My kid has recently just quit playing Roblox because of the sketchy facial age check process. She said that her and all her friends know not to ever upload a picture of themselves to the Internet (good job, fellow Other Parents!!) so they're either moving on to other games or just downloading stock photos of people from the internet and uploading those (which apparently works).

What a total joke. These companies need to stop normalizing the sharing of personal private photos. It's literally the opposite direction from good Internet hygiene, especially for kids!

View on HN

One aspect of this normalization of photo uploading is that, if a platform allows user-generated content that can splash a modal to kids, a bad actor can do things like say “you need to re-verify or you’ll lose all your in-game currency, go here” and then collect photo identification without even needing to compromise identity verification providers!

I truly fear the harm that will be done before legislators realize what they’ve created. One only hopes that this prevents the EU and US from doing something similar.

I’m sorry to say that a number of US states have instituted age verification laws over the past year

Aka, morality laws mostly.

The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y? Is the harm done significant enough to warrant providing parents with a technical solution for giving them control over which sites their X-aged child signs up, and a solution that like actually works? Obviously pinky-swear "over 13?" checkboxes don't work, so this currently does not exist.

You can work through robustness issues like the one you bring up (photo uploading may not be a good method), we can discuss privacy trade-offs like adults without pretending this is the first time we legitimately need to make a privacy-functionality or privacy-societal need trade-off, etc. Heck, you can come up with various methods where not much privacy needs trading off, something pseudonymous and/or cryptographic and/or legislated OS-level device flags checked on signup and login.

But it makes no sense to jump to the minutiae without addressing the fundamental question.

The real solution, IMO, is a second internet. Domain names will be whitelisted, not blacklisted, and you must submit an application to some body or something.

sounds like an app store

I agree. There were attempts to do something like this with porn sites via the .xxx TLD I believe, but that inverts the problem. Don't force the public to go to a dark alley for their guilty pleasures. Instead, the sites that want to target kids need to be allowlisted. That is much more practical and palatable.

Yeah.. the opposition was just a bad take IMO... "but it will create a virtual red light district" which is EXACTLY what you want online, unlike a physical city, you aren't going to accidentally take a wrong turn, and if you're blocking *.xxx then it's even easier to avoid.

Then require all nudity to be on a .edu, .art or .xxx, problem mostly solved.

> Then require all nudity to be on a .edu, .art or .xxx, problem mostly solved.

Who's doing the requiring here? Sounds like yet another path to censorship dystopia.

In the case of cc-tlds the respective government... In the case of other TLDs ICANN.

edit: .edu provides for educational content, .art for artistic expression, .xxx for explicit content.

Who decides where the art erotica boarder is? There is plenty of content that would straddle that border, I have seen art that could legitimately called pornographic and pornography i would describe as art. Who decides? And then you have prudes Florida Texas red states trying to prevent remove any thing from an .edu and would happily ban the .xxx entirely and would find any .art suspect and probably ban it.

I dont see why phones can't come with a browser that does this. Parents could curate a whitelist like people curate playlists, and share it, and the browser would honor that.

Combined with some blacklisted apps (e.g., all other browsers), this would be a passable opt-in solution. I'm sure there's either a subscription or a small incentive for someone to build this that hopefully isn't "Scam children".

It's not like kids are using PCs, and if they use someone else's phone, that's at least a severely limiting factor.

They do, don’t they? Apple devices have had a robust whitelisting/blacklisting feature for at least a couple of years. I use it to block websites and apps to lessen my phone addiction. I’m sure Android offers similar features

Block -> opt out

Allow -> opt in

And a techie customizing it is v. different than turnkey for parents.

But yeah! Same principle, that's why I'm sure it's been done / will be done.

AOL returns!

It's never been about porn. By marking certain part of the internet "adult-only" you imply that the rest is "family-friendly" and parents can feel less bad about themselves leaving their children with iPads rather than actually parenting them, which is exactly what Big Tech wants for obvious reasons. If I had a child I'd rather have it watch porn than Cocomelon, which has been scientifically developed so that it turns your child's brain into seedless raspberry jam. Yet nobody's talking about the dangers of that, because everyone's occupied with <gasp> titties.

> If I had a child I'd rather have it watch porn than Cocomelon

As a parent that regularly fears who my children will encounter in the world, I’m glad there’s an “if” at the beginning of this sentence.

Don't worry, most likely your children will come across the normal sorts of bad people - cheating partners, bullying peers, abusive bosses, rude customers, lying beggars, maybe robbers and thieves. It's fortunately unlikely they'll meet a guy who is outspoken about his opinion that scientifically capturing people's attention to get them addicted to screens is morally much worse than showing them "penis into vagina episode 74786". We don't want their innocent minds to be poisoned with ideas that question the status quo.

Honestly if internet porn were "penis into vagina episode 74786" I'd have no problem with my kids who are old enough to desire it, to watch it. The problem is that all internet porn I've seen demonstrates undesirable behaviours and attitudes towards sex and towards their partners. Hitting, degradation, homosexuality, sex between family members, harmful body modifications, verbal abuse, etc, are on the front page of every porn site I've looked at. I honestly do not understand how this is supposed to be stimulating.

I have no problem with my kids watching a couple progress from kissing to foreplay to passion, if those kids already have the hormonal desires to experience these acts. But contemporary websites teach that violence is an integral part of sex - and I do not want my children learning this.

If your child wants to watch porn, he/she will be able to get it.

> The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y?

This is only an interesting question if we can prevent it. We couldn't prevent minors from smoking, and that was in a world where you had to physically walk into a store to buy cigarettes. The internet is even more anonymous, remote-controlled, and wild-west. What makes us think we can actually effectively age gate the Internet, where even Nobody Knows You're A Dog (1993)[1].

1: https://en.wikipedia.org/wiki/On_the_Internet,_nobody_knows_...

> We couldn't prevent minors from smoking,

Smoking rates among minors have plummeted and continue to decline.

That's not really a good example because the war on underage smoking has been a resounding success.

Yeah we didn't stop every single minor everywhere from ever smoking at any time, but the decline was dramatic.

I'd argue that the reduction of underage smoking has much more to do with things like social acceptability and education about the dangers of smoking, and not about physical controls on the distribution of and access to cigarettes. There also appears to be a recent trend of younger people not drinking alcohol to the extent that my generation and Boomers did, which is wonderful, but probably has nothing to do with physical access to beer.

This is the right way to reduce childhood social media use: Make it socially disgusting, and make it widely known to be dangerous.

Have you met a horny teenager? The war on porn will not be a resounding success.

But we can do age verification that's as strict as buying cigarettes and sacrifice next to no privacy.

https://news.ycombinator.com/item?id=46447282 That should be good enough for anyone, unless their real motive is to force everyone to upload their IDs.

> The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y?

I suspect if you ask Hacker News commenters if we should put up any obstacles to accessing social media sites for anyone, a lot of people will tell you yes. The details don't matter. Bashing "social media" is popular here and anything that makes it harder for other people to use is viewed as a good thing.

What I've found to be more enlightening is to ask people if they'd be willing to accept the same limitations on Hacker News: Would they submit to ID review to prove they aren't a minor just to comment here? Or upvote? Or even access the algorithmic feed of user-generated content and comments? There's a lot of insistence that Hacker News would get an exception or doesn't count as social media under their ideal law, but in practice a site this large with user-generated content would likely need to adhere to the same laws.

So a better question might be: Would you be willing to submit to ID verification for the sites you participate in, as a fundamentally good thing for protecting minors from bad content on the internet?

This is a good opportunity to link to the recent archive of Hacker News, for when this happens: https://news.ycombinator.com/item?id=46435308

> The details don't matter.

The details very much DO matter.

You can look at all manner of posts here on HN that explain exactly how you should do age verification without uploading IDs or giving central authority to some untrustworthy entity.

The fact that neither the governments proposing these laws nor the social media sites want to implement them those ways tells you that what these entities want isn't "verification" but "control".

And, yes, most of us object to that.

> You can look at all manner of posts here on HN that explain exactly how you should do age verification without uploading IDs or giving central authority to some untrustworthy entity.

That's not how ID verification works. The ID verification requirements are about associating the person logging in with the specific ID.

So kids borrow their parents' ID while they're not looking, complete the registration process that reveals nothing, then they're good forever.

Or in the scenario where nothing at all is revealed about the ID and there is no central authority managing rate limiting, all it takes is for a single ID to be compromised and then everyone can use it to authenticate everywhere forever.

That's why all of the age verification proposals are basically ID verification proposals. All of these anonymous crypto suggestions wouldn't satisfy those requirements.

> Would you be willing to submit to ID verification for the sites you participate in, as a fundamentally good thing for protecting minors from bad content on the internet?

The friction would be sufficient to give up. Arguably no loss to me and certainly none to the internet.

This is what has happened already, I am not giving my id to some shitty online provider. If I lose more sites so be it.

> Would you be willing to submit to ID verification for the sites you participate

I would not. Because there are better options out there if the objective is purely age verification that's as rigorous as the status quo for buying alcohol or cigarettes.

Here's one option: https://news.ycombinator.com/item?id=46447282 that I proposed. It is by no means the best or only one.

I would rather parenting be the responsibility of parents and I resent the selfish individuals who wilfully burden others with the various costs associated with their demands for safety from their own choices over taking responsibility for themselves. No impact to others is too great for those who insist anything they don’t wish to be exposed to is dealt with at the societal level.

If an at risk child’s parent is unwilling to do what they believe is the right thing by their child then they have failed the child and need to get a grip - confiscate the device or change the wifi password or sleep with the router under your pillow if you have to it’s really not that hard.

Can we actually prevent children under 16 from buying beer?

Is there actually a difference between transactions between humans in meatspace (getting a government ID, then using it at a store) and age estimation algorithms?

EFF explains a few differences between showing your ID in person and verifying your age online [1]. With respect to transmission, storage, and sharing of user data by the verifier/website, the risks of age estimation overlap with those of age verification.

[1] https://www.eff.org/deeplinks/2025/12/why-isnt-online-age-ve...

If they are persistent enough, no. But then everyone knows it's not going to stop every child in every situation. It sets a president for what society thinks is a sensible limit though, and society raises children not just individual families or parents.

Do we want kids becoming alcoholics? Do we want them turning up drunk to school and disrupting classes? Do we want to give parents trying to do the right thing some backup? So they know that when their kid is alone they can expect that other adults set a similar example.

Sure, you can't stop a kid determined to consume alcohol. But I think the societal norm is an overall good thing.

The same should be applied to the online space, kids spend more and more time there. Porn, social media, gambling etc. should be just a much of a concern as alcohol.

We can't prevent all children from getting beer, but we can prevent most of them without compromising any adult's privacy. And everyone is ok with that state of affairs and the trade-offs. No one's calling for internet-connected beer cans that make you take a selfie before you can open them.

https://news.ycombinator.com/item?id=46447282

> we can prevent most of them without compromising any adult's privacy

But we don't. Even with in person age/ID checks the clerk will often enter some of that data into the store's system and then who knows what happens with it.

> the clerk will often enter some of that data into the store's system

I've only seen them enter the date of birth. No identifying information. If they record the ID itself I'd recommend going to a different store. Or ideally, writing your legislators to have the practice banned.

Depending on the size of the town, date of birth could be used to severely narrow down and target a specific person.

If one suspects a partner of buying alcohol and could convince or coerse the clerk, or even just peek in the book, and see the partner's date of birth written there, then that is good enough proof for many people and many purposes.

We should end carding for alcohol for everyone because domestic abuse exists?

That's a ridiculous conclusion. Identifying a single problem with an implementation is not a reason to abandon the implementation completely.

It seems to be what you're saying. Otherwise I don't know what the point of your previous comment was.

Nice job of sidestepping the "fundamental question" of whether that can be done and what damage it would do. You do not get to answer the question as you posed it in a vacuum.

It's not a "robustness issue". Nobody has proposed anything that works at all.

But to answer your "fundamental question", no. Age gating is dumb. Giving parents total control is also dumb.

> should we actually prevent minors below the age of X from accessing social media site Y?

Who's 'we'? The parents? The government? Device manufacturers? Answers should differ wildly depending on who is doing the enforcement.

i call this slipstreaming, it can even occur during the signup yeah, once the bouncing around to many domains / uploading photos is psychologically normalized havoc can ensue. this is the greater evil.

I'm optimistic actually. I think "Gen Alpha" is gonna be alright and sufficiently wary of Internet sharing and privacy. Unlike the previous few generations, esp. Milleneals and to a somewhat lesser extent Gen Z and Boomers, who have massively over-shared and are now reaping some of the horrible harvest that comes from that oversharing. Today's teens and tweens seem to finally be getting the message.

I also actually think AI might be a savior here. The ability to fake realistic 18+ year old selfies might help put the nail in the coffin of these idiotic "share a photo with the Internet" verification methods.

I otherwise agree with what you're saying, but I think the ratio of conscientious people has fluctuated over time across all generations. It has more to do with what year it is than how old they are.

> I truly fear the harm that will be done before legislators realize what they’ve created.

Not defending the legislation as I overwhelmingly disagree with it, but if I recall, I don't think any of the age verification legislation specifies a specific implementation of how to verify age.

Requiring photos, or photo ID, or any other number of methods being employed, were all decided on by the various private companies. All the legislators did is tell everyone "you must verify age." The fault here is on Roblox as much as it is on the legislature and they should equally share blame.

How would you suggest they verify age? I am not aware of a good way to do it from a privacy and security perspective.

You can take a look at what Switzerland is about to do:

https://www.homburger.ch/de/insights/swiss-voters-approve-ne...!

Would be very tough to implement in the US, as proposing any sort of "national ID" is pretty much a nonstarter, at least up to this point.

States could do it, and maybe agree on some protocols so that things like privacy-preserving "age verification" could be done.

Maybe the feds could push it like they did with speed limits: make federal funding contingent upon adopting e-ID. Would still get a lot of pushback.

The problem with e-ID is its focused on identity verification, not just age verification and that's where the problem lies.

We still need the ability to be psuedoanonymous online. We should be able to verify age without divulging any identifying information to the service requesting age verification.

An e-ID registry could work on a sort of public/private key system so long as the services requesting informatino from the registry only receives a yes or no of "is this person old enough" and no further information.

If an e-ID can vouch you are citizen number #3223423, it should be able to use the same crypto to vouch that your birth date predates a threshold, without revealing anything else. It's more a question of requirements gathering & UX (and political will).

It's a problem for you and me, but a feature for those pushing for it.

I'm obviously not going to show my id to Zuckerberg's website or any porn sites, casinos because I don't trust those bastards. They're also not the police, so they lack the proper autoritah to request my an id.

I think the point of the comment you are answering to is that in Switzerland, they are building a system where you can prove your age without telling who you are to the website, and without telling which website you visit to your government.

The government might not know which website exactly, but the fact that you are looking to verify your age is in itself a datum that you might not want the government to know. "Palata was either looking at porn or buying drugs in January 2026" is probably not something you want the government to know, even if the specifics are obscure.

Unless your e-ID app automatically requests 20 age verification tokens for everybody, whether they use them or not.

How are you going to farm the UUID for each user? Or are the IDs sequential?

> Once issued, the e-ID will be stored in a secure digital wallet application on the user’s smartphone or other compatible device.

That sounds like Apple & Google-blessed Android only, open source gadgets and non-Microsoft desktops not supported. Estonia at least used smart cards where a reader can be plugged into just about anything.

It doesn't have to be exclusively digital. You can be psuedoanonymous using some form of key as verification. To get a key, you have to present your ID in person at, for example, the social security office or local DOL.

All the key does is attest that "this person is over X years old" with no other identifying information associated with it.

I think blending in person & digital together is going to be the best way forward. Like going to the store and buying alcohol. I have little privacy risk from the cashier glancing at my ID for a second to check my birth date.

But that would require the government to set up the system that lets you present your ID and get a key. They haven't done that, so it's not valid to blame businesses for not using it.

> with no other identifying information associated with it

Not possible, the key itself becomes identifying information similar to how an IP address + timestamp is identifying information even though their is no information abut you stored in the IP address or timestamp.

  > I have little privacy risk from the cashier glancing at my ID for a second to check my birth date.

Imagine your abusive ex is looking for you. She could go to a few alcohol vendors in the area and tell them "Respectful cashier, I suspect that my husband is reverting back to being an alcoholic. If you see the birthdate 1971-06-21 then please phone me after he leaves".

To which the vender replies "Why on earth would I check if someone over the age of 50 might be under the age of 18 (or 21 in some parts of the world)".

Well, I did have many more recent exes in my early twenties than I do in my fifties.

But also the mechanics of the check might be important. For instance, I always go to take the baby out of the back seat when I park, even though I have not driven a baby in years. Because I do not want to ever risk leaving a baby unattended in a car. The store policy might be to check every ID, even in seemingly obvious cases.

A digital ID, like someone said below. But people (in the UK at least) go mental about that, despite the government already having all the information anyway. Creating a easy way to securely share that information with a 3rd party for online verification is apparently the work of the devil.

In the real world you turn up in person with a passport, or maybe use snail mail as a way to verify an address which is hard to fake.

Online we have to pretend it is still the internet of the 90s where it's all just chill people having a fun time using their handle...

Making it easier tends to lead to something being required more often so people are right to be wary about that.

Every once in a while, eBay emails me out of the blue and asks me to update my personal details, with a link to a web page.

I always assumed they were phishing scams, but I looked closer at one, and it is a real link too a real page on their site. It's like they're training people to fall for phishing scams. One of them even displayed the name of a variable, instead of my user name.

I have had two banks (Lloyds and Barclays) phone me and ask for personal details to verify me over the phone. Again, training people to fall for scams.

Then there are all the links that go to other sites to track clicks or because they have a separate domain for some reason. Again, training people to fall for phishing.

My kids also know that as far as the internet is concerned, their date of birth is 1 January 1970.

By an amazing coincidence, that's also my date of birth, as well as my kids'.

I wondered for a while why I got so many ads targeted towards seniors when I made my facebook account as a kid. Then I remembered my birth year was set to 1905. I guess I should let the Guinness World Records know that their listing for oldest man in the world is inaccurate.

> These companies need to stop normalizing the sharing of personal private photos. It's literally the opposite direction from good Internet hygiene, especially for kids!

While I agree with you entirely, it's important to remember that these companies want to mis-educate the masses (and especially children) against their own interest. It's not just unfortunate that they're normalising uploading a photo just to play a videogame: it's an intentional choice to de-normalise privacy and normalise deeper and more in-grained online stalking.

Most of these companies don't even want to add age gates. They get in the way of their normal predatory marketing schemes, the little bits of extra data isn't worth it.

Stupid laws are forcing these companies to implement something. In most countries, there is no privacy-preserving way to verify that you're old enough digitally, so when these companies are forced to get something good enough going, they're going to go with the cheapest offer they can legally get away with.

Governments know this. They want certain websites to disappear entirely, and for certain platforms to just stop existing. Both sides are using weaponised incompetence to blame the other and users end up losing regardless of whose fault it is.

But I also don't want the alternative, that I have to ID myself. Anonymous and pseudonymous access is the best solution.

The EU tries to introduce age verification, simultaneously it currently talks about sharing police data with the US for the Visa waiver program.

If this verification data is collected and normalised, we will constantly have to fight how much data that is required for auth and it can just be legislated.

The funniest case I've seen was somebody fooling one of these tools using Gmod by playing with the face sliders of those stock Half-Life characters.

There seems to be a big movement (UK specifically) from governments using age gateing as an excuse to increase surveillance and online tracking. I don't know where Roblox is based or it's policies, but it's likely they are just implementing what the government has forced them to do.

We need to push back against governments that try and restrict the freedom of the internet and educate them on better regulations. Why can sites not dictate the content they provide, then let device providers provide optional parental controls.

Governments forcing companies to upload your passport/ID, upload pictures/videos of your face, is dangerous and we are going to see a huge increase of fraud and privacy breaches, all while reducing our freedoms and rights online.

IMO it should not be hard for large services like Roblox and Instagram to get together with device makers to come up with a sensible solution.

When you create a new profile on Netflix you mark it as "kids" and voila. Devices should have kid profiles with lots of sane defaults. The parent profiles have a thorough monitoring and governance features that are dead simple to use.

As always it's not perfect but it will go a long way. Just getting a majority of parents on sane defaults will help unknot the broader coordination problems.

I see lots of claims about governments using age gating to "track" people, but no evidence. Your last point about uploading ID documents to random online services (which i agree is a privacy risk) would be solved with a government digital ID.

That is never going to happen it seems, as -- in the UK at least -- people go crazy whenever it is mentioned. Despite "the government" having the ability to track whatever they wanted already, should they care to.

Age gating discussions always devolve into some fantasy land were people are arguing for children to have access to porn and other inappropriate material, and happily construct some straw man where age gates lead to censorship for everyone.

If your government wanted to censor the internet they can do it without age gates. As a parent I am happy to have society agree on some basic rules around what children can do online, as there are rules on what children can do in the real world.

Yes, I know all the come back arguments about how it is my responsibility as a parent. Don't worry, I will be responsible for what my children do online when they are older. But in the end a society raises children, and society should agree a limit on what children can be exposed to online.

Having to manage my kids online accounts have been a nightmare. So many different rules, with arbitrary age limits on things that go completely against my own rules for what my kids can do at different ages, with weird methods for linking or verifying or sharing/transferring purchases. I have gotten so frustrated trying to get accounts set up so we can play together.

My favourite is Youtube.

I can get Youtube Family so my kids don't get ads.

But if your kids are under 13, they can't be added to a family account on YT - so they MUST watch the ads.

Can someone explain the logic here?

> She said that her and all her friends know not to ever upload a picture of themselves to the Internet (good job, fellow Other Parents!!)

it's a video game, it's an aesthetic experience, if uploading a photo of yourself doesn't feel good, it's valid to say, it's a bad game or whatever.

but by some more objective criteria, this photo upload thing that you are saying doesn't really matter. they are uploading photos of themselves to the Internet all the time (what do you think Apple Photos is). of course, with kids, i can understand the challenges of making nuanced guidelines, but by that measure, it's simpler to just say, playing roblox is kind of a waste of time, or suggesting better games to play, rather than making it about some feel-good nonsense i'm-a-savvy-Internet-user rule. it's what this whole article is about, providing real answers, but who under 18 years old is going to read the whole thing?

> they are uploading photos of themselves to the Internet all the time

I worried about this at first, too. But I also check, like a good parent. And to my surprise my kid already learned on her own how to mask/blur faces and even details about the inside of her room when sharing photos. And her friends do, too. They are surprisingly savvy about Internet privacy and risks for their age--certainly more cognizant of the dangers than my generation was growing up with the Wild West Internet.

I think the way Roblox is doing right now separating the users in age groups just makes it easier for predators to find victim.

Governments and corporations are never interested in protecting children - they don't vote, and they don't have money. So making it "easier for predators to find victims" is not a failure of the policy.

People who do care about their children or children in general do vote though. Not that politicians care that much about what their voters want once elected.

I was getting a haircut last week and chatting about our kids with the stylist, who said (basically): "I just started letting my 7 year old on Roblox. I know its full of pedophiles. I told him to come to me or his older brother if anyone tries to talk to him."

If the million reports of Mark Zuckerberg enabling pedophiles and scam artists haven't made it clear, the executives of these tech companies just don't care. They will sell children into sexual slavery if it improves next quarter's numbers.

The drip-feed of mindless brain-rot, micro-payments, and cyber-bullying should be much higher up the list of reasons for not letting a 7 year old use Roblox (and YouTube and FaceBook and…)

Reply on news.ycombinator.com