Hacker News Reader

Comment by egorfine | Hacker News Reader

> or a boolean value "yes this person is over 18"

It would be detrimental to the cause, which is to collect everyone's ID.

Whilst this is OP's point, the reality is the majority of big tech companies have been treating user data like radioactive waste for 10+ years.

Most user data is of minimal economic value, until you leak it, and then suddenly there are millions of euros of fines headed your way.

Better to not hold the data in the first place.

> majority of big tech companies have been treating user data like radioactive waste for 10+ years.

They're collecting more than ever.

PIIs and payment details are radioactive if explicitly collected as such, or just "anonymized" query parameters if not.

This has not been the case at any of my past employers in B2C...

There was a fair amount of scrambling to get GDPR/CCPA compliant, but even that was done largely with a prevailing "ah, this is a defensible thing to store, make sure you can annonymize it or scrub it if needed" vs "stop storing this."

Starting with the ones that are most popular in the US, "Big Tech" usually includes:

- Google - Gmail and Maps contain massive amount of PII, Photos contains all sorts of other sensitive stuff, and they have not treated those aspects of those products like radioactive waste

- Meta - Facebook has a real names required policy even. Not a lot more needs to be said there, I think.

- Amazon - Nothing I've seen about trying to move away from how they need your name/address/payment info and all. If anything, more and more geographic targeting and such.

- Microsoft - Now you need to tie your local Windows install to their cloud services, not moving away from collecting user info. Also moving towards subscriptions which means PII and payment info.

- Apple - cloud accounts + email + payments + subscriptions all here too. Getting into banking-type services, that's leaning into PII...

- Netflix - more and more PII (IP tracking and geolocation combined with things like email and name) to fight account sharing...

Which ones were running away from it, exactly?

> suddenly there are millions of euros of fines headed your way

I'm not sure about that. As I see it, there is no business case for treating PII carefully: security costs money while leaking PII costs nothing and has no repercussions.

you must be living under a rock, mutable user data like usage habits is being collected at increasing levels

I think GP is about PII rather than "mutable user data".

But then why do they want to sniff after everyone?

Storing all that information is cheap nowadays. Any state agency may be happy to get more information about The People.

Whose cause? I think the government already has our IDs, given that they issued them.

The government isn't typically facilitating the check. In order to verify your age, you will be required to hand over your ID to a third party, who's privacy and security practices are likely: "Trust me bro."

Seeing as how these companies get hacked all the time, (https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...) , I don't think it's unreasonable to resist this.

Furthermore, I think many folks have reservations about requiring an ID checkpoint to utilize a computer. Obviously it's not that bad yet, but I don't think it's hyperbolic to state that the landscape is certainly trending in that direction, and it's absolutely not unreasonable to point out that governments and institutions to have a material interest in setting up access controls on who can and can't use the internet (read: participate in society).

Right, I'm not a fan of the ID check or identity/age verification. I'm just trying to understand the conspiracy theory kind of idea that "they're trying to get all our IDs!!!1!!" sentiment.

"The government already has our IDs" is missing the correlation between the ID and the service. They know your face and your name but not what you do on the internet. The website knows what you do on the internet but it isn't tied to your name. It's the tying them together which is the problem.

Which is why the people trying to do it always pull out the misdirect about ZK proofs. Those don't fix anything because a system that actually preserved privacy wouldn't be able to prove that the user is over 18, only that someone is over 18, not necessarily them. And that in turn means you're setting up a rug pull. You roll out a system which is indistinguishable from the perspective of ordinary people from the one that screws them, and then that system can't actually exclude minors so what follows is calls to change it to stop protecting privacy, at which point the people trying to collect everyone's ID will be arguing that you already have to show ID.

It also presumes you would even get a privacy-preserving implementation to begin with, which a pretty credulous assumption given how these things usually go.

It's not possible to prove the user is anything ever. It probably never will be. Likely what will happen instead is that the person in the ID will become personally liable for accounts verified with that ID. Which is even more reason to reject ID verification.

> Likely what will happen instead is that the person in the ID will become personally liable for accounts verified with that ID.

Exactly. Which in turn requires you to have some way of tying those accounts to that ID, which was supposed to be the thing to be prevented.

Governments don't necessarily have the connection between your ID and what you do online, though, and some governments are known to massively buy publicly available data from data brokers to circumvent existing laws. By "some governments" I mean the US government, by the way. That's not a conspiracy either, it's well-documented.

We don't want your static ID, we want where and what you are at this moment in order to better tune the algorithm. Your ID is frozen in time, so at any given moment, big tech knows more about you than the government does. IDs are only good for minimal verification purposes.

Its actually to leak your gov't ID so data brokers can soak it up

QAnon for nerds

Reply on news.ycombinator.com