The reason is that this whole push for age verification is nothing to do with actually stopping kids seeing the content. If it was then this kind of solution would be being legislated for. It’s just about making everyone identifiable.
The reason that mainstream politicians are pushing is because the public wants something done to protect their kids.
Are there likely to be bad actors pushing for it for nefarious reasons as well? Sure. Are the 'solutions' inadequate and often tech- and privacy-illiterate? Absolutely. Is the entire impulse to demand that government 'fix' this issue wrong? Maybe.
But the idea that this is all a smoke-screen from top to bottom needs to die. Not just because it's wrong, but because it's also unhelpful. If you wade into the debate saying "It's all a lie, this was never about the kids!" you're easily dismissed as a nut and an absolutist who doesn't appreciate that real people want their real kids to be protected.
If school demands the kids have a variety of devices to do their work, and they have no idea how to lock those down to exclude (for example) social media services that we know have been designed to be as addictive as possible, can you not see why they might want someone to intervene?
(edit: Beyond that there are also tons of bad reasons, I'm not going to try and justify them. There are a lot of bad parents and just in general people who are not firing on all cylinders out there. And many of them absolutely love a government regulation to be brought in for just about anything.
We can and should argue with these people and point out why they're wrong. But saying it's "nothing to do with actually stopping kids seeing the content" fails here too.)
But coming at it from the angle that "It was never about protecting kids!" is itself incorrect and unhelpful to the debate.
If you want to reject the nefarious actors you have to separate them from the other goals that are reasonable and sorely needed. If you treat it as a whole package, you'll fail because those other goals are too important not to try to achieve, and the package is going to get passed. If you separate them, we can advocate for the pretty sensible California-style law where it's a flag on your user account that root can change, instead of the utterly insane New-York-style law where you have to scan your face every time you open your phone.
For private schools, the parents are more involved in the first place, but I would expect them to also have guidance for parents to help the less tech savvy among them.
Yet when it comes to internet/social media technology, it's suddenly a parenting failure if they don't pre-vet every platform and website and device before allowing their kids to use it.
As a society, we collectively protect kids from stuff they aren't ready to handle. We don't let them gamble, or buy alcohol, cigarettes, or porn. For the most part, everyone buys in to this and parents can pretty much count on it. Are there exceptions, sure but they create scandals and consequences when they are discovered.
But social media and content platforms didn't feel that they had any social obligations. They did not honor this societal convention to keep inappropriate content away from kids. And the top people at these companies actually don't let their own kids use the platforms, they know how harmful they are and they know about all the addictive hooks and dark patterns of engagement that are baked into them.
Note that this design does the exact opposite of giving parents control to protect their own children - rather it puts the ultimate decision making ability into the hands of corporate attorneys! For example, we can easily imagine a "Facebook4Kidz" site that does the bare legal minimum to avoid liability for addicting kids to dopamine drips, and no more. Client side software based around RTA headers would allow parents to choose to filter things like that out, whereas when the server is making the decision its anything goes as long as the corporate attorneys have given it the green light.
But also, does the California law actually prohibit Faceboot from locking your account and requesting "extra documentation" including government IDs and whatnot? That would be news in its own right.
What's more likely a global conspiracy to get age verification passed to allow these unnamed groups to identify everyone for some unknown purpose or politicians just not understanding tech?
The way people try to pretend that there can't be any organic desire for these proposals is so bizarre and is a major cause for all these proposed solutions being so technically dubious. Refusal to recognize the problem means you won't be part of solving the problem.
Citizens that want these laws are unthinking drones who don't want to raise their children, and instead want legislators to do it for them.
Politicians that want these laws are the people who, ideally, want to track your every move online for a multitude of reasons, not least of which are censoring speech and controlling narratives.
Even if everything you said was true and there was a global conspiracy among the politicians, the tech crowd consistently denies and demeans these organic desires. We could cut the legs out from under these politicians if we listened to these people's concerns, considered actual solutions like OP did at the top of this thread, and turned these people into allies against those politicians. But instead we deny the actual desire to protect children and accuse them of either having ulterior motives or being sheep, turning them into permanent enemies thereby empowering those (hypothetically) conspiratorial politicians.
But there is a global conspiracy, a synchronised effort among western leaders to implement near identical solutions to this engineered "problem", the responsibility remains squarely on the shoulders of parents, I say this as a parent.
Thank you for proving my point by doing the exact thing I said tech people do. Do you think that if you demean and deride enough people, the problem will go away?
>the problem will go away?
...
It's more worrying to me that you think you can fix us.
I mean I cannot believe I have to post these, but here we go:
https://www.politico.com/news/2025/09/13/california-advances...
https://www.yahoo.com/news/articles/reddit-user-uncovers-beh...
But more importantly even if that connection is true, your argument relies on the current proposals of age verification being the only way to satisfy the organic desire for protecting kids from the unfettered internet. OP gave an example that could be a compromise position that addresses the need and isn't authoritarian. Why can't you support that effort?
The way it stands now. this issue is being used by people in power to advanced an authoritarian agenda. Its really clear to see, if you only have the will to look.
Which brings us right back to what I said here[1]. We don't have to agree on the motivations behind this push. Even if you believe this is all an authoritarian conspiracy, that conspiracy could be undermined by proposals like OP's, but instead people make enemies out of these potential allies which just further empowers the people who you consider to be authoritarians. It's a failure of basic political coalition building.
Taking away freedoms, for any reason, is not the answer. They make us less secure [0] and promote bad actors to make things worse.
[0]: https://news.clemson.edu/the-safer-you-feel-the-less-safely-...
But you're ignoring my point that your dialog is actively counterproductive when you don't engage with the root of the problem.
Nowhere in here did I advocate for "taking away freedoms" or for the age verification policies as discussed in this article. The only aspect of this issue that I have argued is that there is a real organic demand from people who want help in preventing children from having unfettered access to the internet.
The reason you see me as "misguided" is because you are refusing to actually listen to what I'm saying. And then you magnify the divide with your rhetoric implying I'm out to take away your freedom. Maybe you don't look at me as an enemy, but your rhetoric and behavior is actively repellent when it could instead be welcoming as you claim to sympathetic to the only issue I have actually advocated for here.
The root of the problem is child safety on the internet.
>I dont think the problem is solved by id verification. This is the position I have been arguing all along
I have advocated for child safety, but nowhere in any of these comments have I advocated for id verification. If you have been "arguing all along" against id verification, then you must be equating all childhood internet safety advocates with those advocating for id verification.
>Im not seeing how my position is getting in the way of what you are talking about.
The equating of childhood safety on the internet with id verification is getting in the way. There exists compromises like the one OP suggested in the top comment in this thread that satisfy both my desire for childhood safety and your desire to prevent id verification. But instead of seeking that path of coalition building and compromise, you're actively repelling childhood safety advocates by misrepresenting their opinions and then calling them "misguided". You're making it clear that you won't be my ally when it comes to protecting kids on the internet because you're so worried about a policy for which I'm not advocating.
We've been running essentially a social experiment on our kids for the past two decades and it has not gone well. Social media has had a toxic impact on kids. CSAM and child abuse are rampant, and most "privacy services" like disposable email and VPNs are the primary source. These are facts, whether you like them or not. There are, in fact, kids dying, school shootings, grooming, etc. which are all the direct result of our failure to regulate social media companies. Section 230 being the primary problem.
OS-level age verification is likely the best route, as private information can remain on a device in your control, and a browser then just needs to attest to websites whether or not the user should be allowed access, without conveying more detail. Obviously anyone with a Linux box will have ways around it, anything based in your own device will be exploitable in some way, but generally effective for the average child.
[Citation Needed] As I understand it, the debate on whether social media is responsible for actual harms in kids is still open and ongoing. Social media has been found to do both harm and good for kids, and for some kids the good outweighs the harms [0]. Scientists are hoping to get some verification from the actual social experiments that we're conducting in the UK and Australia on this.
Mandating OS-level age verification effectively means not allowing kids access to OSS platforms, a step way too far in my opinion. For instance, we would have to outlaw Steam Decks for kids.
[0] https://pmc.ncbi.nlm.nih.gov/articles/PMC12165459/ "Social media and technological advancements’ impact on adolescent mental health is complex. It can be both a risk factor and a valuable support system. Excessive and problematic use has been linked to increased rates of MDD, anxiety, and mood dysregulation, while also exacerbating symptoms of ADHD, bipolar disorder, and BDD. Simultaneously, digital platforms provide opportunities for social connection, peer support, and mental health management, particularly for individuals with ASD and those seeking online mental health communities. The challenge is finding a balance. Although social media offers benefits, it also poses risks like addiction, negative social comparison, cyberbullying, and impulsive online behaviors"
This is entirely false scare tactic nonsense, and you really need to look at where you sourced that idea and no longer use them as a reference point. There isn't even a concept of a method of doing this that would make that true, and certainly not in any of the implementations being considered in the US. The federal bill is called the Parents Decide Act, if it gives you some idea where the goal in decisionmaking is supposed to be.
We have not just woefully bad parental controls, but in the name of privacy, modern platforms make it exceptionally hard to implement parental controls. What is being pushed here is largely a mandate that a system for parents to control what their kids can reach needs to exist and Internet companies need to support it.
(Steam is, FWIW, probably one of the best actors in this regard already, Steam Family is incredibly nuanced in the features and tools it gives parents. I have a lot of gripes about Steam but this is not a place they will have difficulty complying with the law. Heck, Steam is better at parental controls than Nintendo and Disney).
The Parents Decide Act (PDA) goes considerably farther than superficially similar sounding laws like California's.
The California law requires that an OS allow the parent or guarding to associate an age or birthdate with the account when setting up a child's account on a device that will primarily be used for the child. It does not require any verification of the age information that the parent provides.
The PDA requires that the birthdate be provided for anyone who has an account on the device, and leaves much of the details up to the Federal Trade Commission to work out in the first 180 days after is passed. The wording of the list of things the Commission is to do suggests that the OS is supposed to actually verify age information, rather than just accept whatever a parent enters when setting up the child's device and account, and that it also has to verify that it will require the birthdate of the parent and verify that.
the conclusion from that discussion was that kids should not be allowed Steam Decks because that would provide them a way of getting around age certification.
Indeed. For example, the strongest evidence for harm shows that negative mental health is correlated with increasing social media use, but it's an important question of whether using social media more causes mental health problems, or mental health problems mean more social media use (or both, which would suggest a spiraling effect is important to look out for and prevent).
The best route is better parental controls, that are not enabled by default. Locking down the OS like ransomware until the user submits to age verification is the wrong approach, and what Apple did in the UK needs to be highly illegal.
So I'm not necessarily arguing for age controls here, but purely on a technical level what do you think of schemes like Verifiable Credentials, which delegate verification to third parties that have already established your identity?
In theory you can set up a system that works like this:
1. User goes to restricted site and sets up an account
2. Site forwards them on to a verification service with a request "IsOver18?"
3. User selects their bank from a dropdown on the broker site
4. Broker forwards them to the bank, with a request "IsOver18?"
5. User logs in and selects "Sure, prove I am over 18 to this request"
6. Bank sends a signed response to the broker "Yep"
7. Broker verifies and sends its own signed response to the site "Yep"
8. The site tags the account as "Over 18 Status verified"
In this situation, the restricted site doesn't get anything other than a boolean answer from the broker. The broker can link a request to a given bank but doesn't get anything that gives away your identity. The bank knows your identity and that it has approved a request, but not necessarily where the request came from.
Also your solution requires a bank account, not something everyone has. Many do, but not all. Also the bank may not know "which" site you are visiting, but it does now know you are visiting sites which require age verification and how often.
How? What personal data?
The broker doesn't get anything other than "Site X wants to verify over 18, the user selected forward to Bank Y" and "Bank Y responds with TRUE"
> Also your solution requires a bank account, not something everyone has
True. Banks are only one example of an already trusted identity provider in this situation. But I get that there are gaps.
> Also the bank may not know "which" site you are visiting, but it does now know you are visiting sites which require age verification and how often.
Verification need only happen once per site, when setting up an account. This does introduce the possibility of a secondary market for approved accounts though, sure.
But restricted-site.com doesn't trust everyoneisover18.com's key, it only trusts realbroker.com's key, so the response isn't accepted. If it is found to trust fake brokers like that it gets in trouble with the law.
Doesn't work. The response won't be signed by real-broker.com.
The permission request/response itself goes direct from the server at restricted-site.com to the server at real-broker.com over TLS, so you can't MITM it, it's not controlled by the client and you won't be able to just pass out a cached response.
Your malicious client plugin could potentially forward the client session details to you, so you could operate the broker page, then log in to your bank's portal and approve that request, but I don't think that's going to scale very well and I imagine your bank is likely going to rate limit you.
But sure, you could subvert it on a small scale, just as you can borrow someone else's driving license to register in 'normal' systems already. You could also register an account, validate it and then sell the login details, regardless of what proof of age scheme you use.
The point is the scheme is no worse at validation than asking for ID and it protects user privacy by keeping all ID details away from individual websites, which is the more important part IMHO.
My cellphone provider will be pleased be paid to deliver all those 2FA text messages. Who's sending them? How are they getting paid? Maybe I'm actually my own phone company, so I get paid for delivering them to myself.
Your bank, like they have 2FA for every other access to your account. 2FA also doesn't need to be via SMS, and even when it is that's dirt cheap. Rate limits can be a couple of approvals per hour with daily limits of a small handful. Or a leaky-bucket style algortihm where you can do a few at a time, but you only get one more per hour. Whatever way it's done it precludes your large-scale automation attempt.
I tire of this now. We've entirely wandered off from "Here's a way to prove age without the privacy implications, that works just as well as handing over scans of ID"
So if you have an actual point, please make it.
We are pre-supposing for the sake of this thread that proving you are over 18 is desirable, but that giving your ID to unknown third parties is not.
That being the case, having a rate-limit on site approvals would appear to be a relatively reasonable tradeoff to stop the system being exploited for gain by third parties like the commenter upthread.
If you don't want any of that in the first place, cool, but I'm not making an argument for it here, just saying that a system that meets these two requirements is possible.
The entire impetus for these bills is for Facebook (the sponsor of these bills) to escape liability for how they're currently harming kids. Facebook's only goal here is to be receiving headers that say the user is over 18, so they can continue business as usual under the assertion that any users must be adults.
That being said, the antiregulatory wonks are not all working for Facebook, and some are indeed manifestly just always opposed to any regulation at all no matter what harm is occurring.
Bear in mind the alternative: Things like Discord collecting personal data to do verification at the website level. A push for a simple "user is over 18" header is incredibly preferable from a privacy standpoint and parents being able to control and monitor it themselves.
FWIW I personally would be supportive of legislation where the data flow went the proper way of server->client, for the user-agent to decide. Consider: Any website over a certain size must publish an appropriate set of well known tags asserting whether its content is suitable for kids of certain ages, has social aspects, the type of content, etc. Any device preloaded with an operating system over a certain marketshare must include parental control software that uses tags, as an option in the set up flow. The parental control software "fails closed" and doesn't display websites without tags. The long tails of the open web, bespoke devices, new OSes, etc remain completely unaffected.