The only acceptable solution would be for apps and websites to simply include a recommended age. Allowing parents to configure their children’s devices to block services that require users to be older than the specified age or that do not provide an age rating. Once this were established, websites targeting all age groups would have a strong incentive to participate. Otherwise, they would suddenly become invisible to a large portion of their underage users.

That just entertains the false justification for what is ultimately about surveillance and control. There are privacy preserving alternatives to accounts and ID/face scans but no one in power is interested in them because the loss of privacy is the entire point.

That significantly reduces the leaked information: the service doesn't receive any information who you are, and the government doesn't know what service you use. They can collude, but that does not reveal more to them than most current age-verification methods. Children can get another adult to sign their request, but that's a working attack on nearly any age verification (including in-person purchases)

Of course this doesn't replace parenting

Or just correlate the IP.

In the end we do need parents to parent, but websites should help. The easiest way would be for websites to send an HTTP header to the client so that censorware can know to block or allow it accordingly.

That sounds very similar to the suggestion of the original commenter, that you responded to with

>> That just entertains the false justification for what is ultimately about surveillance and control.

Preventing this would be difficult. If there are any behavioral differences between children and adults, that's a signal. And it would mean websites couldn't build experiences tailored to their audiences. Do we really want to try to suppress all behavioral cues that can be used to distinguish children from adults? Is it worth it?

A reasonable compromise is that websites and apps should be able to learn about devices, not people. It should be trivial to figure out whether a visit is from a child-locked device or not, no account needed. Much like clicking on "kids zone," it doesn't mean you know for sure who's really using the device. For example, it could be an parent who turned the child lock on to see what happens, because parents should know these things.

It's another bit that could be used distinguish users, but giving away zero bits of information isn't practical.

I think this means any solution which involves active parent participation is going to get shunned by a vocal subset.

I'm in my mid 30's. When I was very young I remember my Dad semi-regularly having to email or even fax off permission slips to websites aimed at kids before they would create an account for me.

Then we certainly shouldn't be passing laws mandating age verification. If parents want to abdicate their responsibility over their children, it's not the role of government to enshrine that abdication into law and take over the duty of parenting from them.

If regulation is to be had, then it should take the form of mandating websites and services provide privacy preserving tools for parents to use, if they want to use them. If they don't, that's on them. Everyone else needn't suffer because a subset of the population has chosen to offload their responsibility into the government and web services.

  > you’re handing the power to

(This includes giving the option for “everything is allowed” without any kind of verification. You bought it, you own it.)

It would be awesome.

One spot where it's a bit weird is for utility apps that don't have any "mature" content but that obviously isn't intended for kids, so e.g. your tax prep app gets rated as "Ages 4+".

It should indicate notable features that influence the rating, like PEGI includes "online content" "gambling" and so on

<https://en.wikipedia.org/wiki/PEGI>

Fight together with everyone else, or when stage 2 (“full KYC”) is implemented you won’t have any leverage.

Yes, Google also wants to tie back to legal identities to sell ads. I’m not saying they’re doing this in good faith, but proxies like this get messy and dangerous for legal/compliance.

Typo? But it's hard to tell what.

You are just moving the verification point to another gate, it means that no anonymous connections are possible anymore to the entire Internet because we want to allow parents to control their kids.

You want to use your friends Wi-Fi? Now that requires full identification so that we know that its not some kid trying to look at stuff their parents don't allow.

Want to connect your cat toilet to the internet? Well, we will need to either cryptographically identify the device or attach its ID to your real ID because we don't want to allow kids look at stuff their parents did not allow and this might just be a proxy device for some nerdy 14 y/o.

Want to use your old PC? Sorry that's not possible, now all devices that connect to the internet require biometric identification because we can't tell if this is an adult or just some kid using a legacy device to look at stuff their parents don't allow.

I have personally used the parental controls on Android, iOS and ChromeOS and to be honest they are terrible. Issues with syncing changes, the terrible UX for parental access control (iOS...), issues around audit/access logs, issues around prompting the parent for access.

I am honestly shocked that Apple known for its polished experience hasn't been forced by angry parents.

My daughter's school actually advised parents to not enable parental controls on her ChromeBook because it would interfere with the school's education websites but my daughter was caught playing web games in class so we decided to lock her down anyways.

Hilarious to me. The biggest game of whack-a-mole ever. I would love to know if this lockdown was successful (and if so, how it worked).

In my city, there is a district that is so “locked down” that the images from Wikipedia don’t even load. But guess what? Kids still find ways to play games.

Imagine pusing for locked down paper so kids can't pass notes nor make spit-wads and airplanes. Or locked down pens to prevent tic-tac-toe, doodling, lewd drawings, or scrawling graffiti on those old desks.

Some kind of KYC rules so that the older kids at school cannot pass their broader understanding of the world and cussing vocabulary down to the impressionable younger kids. Age restrictions on the trail to the woods, where kids somehow always knew about that stash of dirty magazines...

It really is surprising given Apple's reputation for UX and safety.

https://www.youtube.com/watch?v=5kpHaYze8kI&t=90

> We are being Forced to Buy Chromebooks [...] The school sent a list of requirements for the specs and functionality

> You are just moving the verification point to another gate

Yeah, the gate being the decision of legal entities of age, aka. adults.

> You want to use your friends, Wi-Fi?

That would still do whatever your parent decided for you.

> Want to connect your can toilet to the internet?

Whether the toilet can connect to the network, is the decision of the network administrator, and toilets don't contain UAs, so that wouldn't even have software on them, where you could configure such behaviour.

It might be true for some middle class helicopter parents that have iPhones and time to manage and keep it under strict control but there are non-middle class kids out there who just use whatever device they can get their hands on and their parens neither have time nor ability to control that.

There is only a "depreciation" model if you don't unlock your bootloader - and even then, a seven year support cycle makes it very easy to obtain cheap, old, fully supported phones, if that's your jam.

That's fair. I also think most kids won't know how to unlock a bootloader (and if Google has its way, that won't be an option anyway).

> a seven year support cycle makes it very easy to obtain cheap, old, fully supported phones, if that's your jam.

Is that iphone support? I think only the biggest flagships get 7 years of official support (and can maybe run 2-3 more years before app version itself out, without external intervention). From what I saw, most budget phones are lucky to get 5 years of support, and will break down well before than anyways.

The idea that a kid gets an expensive device that can't buy by itself and the parents have control or what device the kid gets is a very middle-class assumption. Life isn't that perfect for most people.

Let's use another analog: Kids want sweets and parents either agree to buy that and no longer bother with their diet, or saves money to go to the candy store. Yet if a kid gets too unhealthy we (IMO, rightfully) have CPS sent to their house to investigate their home life.

Kids were never meant to be a convenience. And parents talked about here aren't rich enough to delegate their parenting off to someone else. Take a few hours to research what you give to your kid and monitor what they might get outside of your vision.

There's plenty of overworked, stressed or ignorant parents who really wish they could care or they don't at all.

"should have enough digital literacy" doesn't survive reality check - reportedly 12-26% adults in the UK (% depending on the country) is reported to have very poor/lack of basic literacy skills. 25% approximately are functionally illiterate.

Reportedly (I'm not an American), 36 million of US adults are functionally illiterate; 43% cannot read a simple job application; 41% of low-income households lack digital literacy skills.

Those are only two prominent examples. More developed countries (especially in Europe) will fare better, many countries will fare much worse.

I think your heart is in the right place but the reality stays in disagreement.

The sad fact is many kids are already falling under the cracks. Failing to mind their kids internet usage is just one way, and having companies sneak in to try and fix this patch won't suddenly lead to success.

The needle won't be moved in terms of progress, but privacy will take a near fatal blow. I fail to see why we should accept such measures when this is just yet another bald face power grab by greedy corporations. I might have been more accommodating if this was in good faith, but we've been past the BOTD for at least 7 years now.

Like, less than $100. Nowadays they have $20 ones that are locked to pay as you go monthly purchases, which is definitely worse than the old tracfone days but about the same price if you had to top up every month anyway. That's ignoring used phones.

Even poor kids get christmas money sometimes.

No technical measure can fix stupid.

1. https://pmc.ncbi.nlm.nih.gov/articles/PMC6124998/

If you are depending on the police to keep your kid from doing drugs, you have failed as a parent. I promise you, your kid can locate drugs better than the cops can arrest low level dealers.

You as a parent need to teach your kid how to behave (mostly through things like teaching ethics and morals) not by running a safe prison until your kid is 18.

And yes, I am a parent of multiple kids.

Drugs, alcohol, teen pregnancy and now social media has become societal issue as enough parents failed to control their kids actions or development.

And in addition, such an approach, will not lead to a child magically becoming an adult all of a sudden when they turn 18.

The fundamental point is that the Internet is not a daycare. All of these attempts to put the burden on sites boil down to changing this dynamic, recasting the Internet as if it should be appropriate to use as a daycare. Today it's big tech and porn. Tomorrow it's any writing that the the religious reich dislikes. Monday it's technical sites as they can help kids bypass restrictions. Tuesday it's international sites being blocked at the ISP-level because they don't bother with any of this crap.

We also need to remember the context here, lest we carry water for big tech's continued abuse. The main reason the surveillance industry is reaching for age verification (ie identity verification) is that harm to children is so far the only regulatory cause of action that has been found to stick. Big tech wants this, so they can continue on with business as usual abusing adults' psyche and personal information. Where what we actually need is to stop their abuse for adults as well - eg data privacy, anti-trust regulation to open up their services to competing clients, and at this point probably straight up regulation of purposely-addictive "algorithmic" feeds.

I've said before and I'll say again that this approach (strict age gating) also is going to produce a slew of really vulnerable 18 year olds. If I were a sports gambling site, I'd be salivating at getting a fresh crop of 18 year old boys each year who have had zero opportunity to learn how to navigate the Internet and who are legally on the hook for everything they do.

OnlyFans, likewise, is going to work out great! Now the 17 year old girls turning 18 won't have access to things like the social media of former OF performers or access to any communities where sex workers discuss the downsides of their job or how to stay safe.

Have to protect the children, don't you know. That way they can be perfectly pure and innocent when they turn 18 and are ready to be exploited. Like fattening up cattle.

This ties into your comment because as a kid approaches adulthood, as a parent you also want to loosen those restrictions so that they can develop these skills - gradually while under your supervision. Whereas the corporate attorneys will just say that they're strictly off limits, right up until it's then open season as you're pointing out.

And you want them to learn in a situation where the stakes are lower: at 18, someone can put themselves into a ton of debt or put nudes in the wrong place and just nuke their life in a way that they can't fix for a decade and everyone shrugs and is like 'you're a grown up!'

Think of all the kids who back in the day got scammed out of their Neopoints, or lost all of their in game currency in GTA, etc. That's a way, way better way to learn about account security and who to trust than their first experience with scammers involving real money.

Is the problem that we're exploiting kids, or is the problem that we're exploiting people? We're not going to be able to protect kids from exploitation in a society/culture that explicitly condones exploitation. If we think exploiting people is fine, actually, as long as they're over 18, then your kids will never be safe, because they will grow up.

Even setting aside the obvious examples I listed, binge drinking used to be a huge problem amongst college aged kids. Who's to say that the Internet/social media wouldn't be similar? How many kids are going to flunk out of school because they can't stop watching digital crack and now mom and dad aren't around to stop them? And unlike binge drinking, your body won't eventually revolt against you, and with the addiction consultants The Machine employs, there will always be new content. People grow out of binge drinking because eventually it grows stale and hangovers when you're 35 are far worse than ones when you're 21, but that's not true of social media use.

To tie this to other issues, we're already seeing issues with relationship and family formation amongst young people. I'm not sure flash banging them with addictive content when they're in their prime years is the call. If all it took for the Internet to be healthy was holding off until adulthood, we'd expect people who were adults when they started to have a healthy relationship with social media. They very much do not.

YouTube doesn't, the parent does.

> no anonymous connections are possible anymore to the entire Internet

Adults would not be blocked if I understand the GP comment. It's an age recommendation and it's up to the parent's to control it for their kids.

> we want to allow parents to control their kids.

Yes. Google, YouTube, AI in general will never be a replacement for parenting and they should drop the charade now.

Because the devices they're given by their parents should be administered by their parents. The minors wouldn't have administrative control over their devices at all.

> You want to use your friends Wi-Fi? Now that requires full identification so that we know that its not some kid

The device wouldn't care how the connection to the internet is made. It ultimately obeys the parents' settings.

The Wi-Fi doesn't need to care either way.

> You are just moving the verification point to another gate, it means that no anonymous connections are possible anymore to the entire Internet because we want to allow parents to control their kids.

Not at all. This wouldn't affect people without parental controls on their device at all. They'd be able to have anonymous connections as they do now.

The only difference from the server-side is adding some special path /.well-known/parental-info.json or an HTTP header to responses that would indicate what's on the page from a parental perspective, so the device can make a decision whether to display based on its parental settings.

Because the parent is there to parent them?

Somehow I (and presumably almost everyone here) grew up with unfettered access to the Internet until now. Your kid isn't my kid, and someone relying on a computer to parent their children shouldn't ruin computers for everyone.

That's the thing. You don't.

It's the parents job to monitor how their children use the Internet.

That's the crux of the issue - the state (pick one) wants to be "the parent".

The whole problem with the regulation we have right now is that it assumes the Internet is for kids, and everything for adults must be hidden. When we really just should declare the whole Internet as 18+ and the sites for kids should be the specially marked exceptions.

The argument could be made for banning social media but the whole internet I don’t think it’s the correct approach

Also, Encarta was a thing. Expensive though.

Some states would legislate wikipedia onto the "Adults only" web though because they don't like what it says about things like abortion and trans people.

A lot of ecommerce companies would probably be happy with a locked down adults only internet, because it would kick bot protection up a level, and would require a fairly robust solution to it.

>I believe that event would change it's governance and social structure in a negative way and significantly degrade it as a public resource.

This can and has already been doing even without age verification. We're way beyond government survellaince in many countries.

You traditionally can say one "Fuck" in a PG-13 movie, which will be about brutally displayed murder and violence and how awesome vigilante justice is. But if you have even a couple frames of a single (female, but like, that's its own insane can of worms) nipple, you cannot get lower than an R rating.

This is all well publicized, despite there not being public standards for the process, and the specific wording of the PG-13 advisory is "Some content may be unsuitable for children under 13", which is weird language to describe what actually happens in practice.

This is because the rating system is a weird club of "Parents of children in school" in los angeles. It's about as corruptible and sketchy as a system can get.

The ESRB is similar. Shooting lots of people? Well there's no blood so that can be for everyone. Oh, now you added some red particle effects? Sorry, now it's Mature.

GTA 3 had an M rating, but a person found that if you hacked the game and changed the code you could play a sex minigame. That caused the game to have an Adults Only rating. Even though it's not something you could do, see, or activate in game at all. And also the game already had functionality to have sex with a hooker and then murder them to get your money back.

It exists because the dumbest parents went apeshit over yet another fake controversy (Oh my god, D&D has demons!!!. OH MY GOD. This game about saving teenage girls from creatures in a crazy amount of costume who harm them with a 2 foot long grabby arm because the developers wanted to avoid unfortunate implications is JUST TOO SEXY FOR LITTLE TIMMY and we need to make congress bitch and moan about it for an entire week and ban anything that could ever be entertainment)

They are purposely arbitrary because their purpose is to make the crazy people who write letters to the FTC to arrest someone for daring to have a low cut shirt go the hell away. Those people have absurd and arbitrary triggers.

This could be done with setting the age too. Kids don't have their own money and can't sign their own cell contracts, their parents do, and during the phone setup process, the parent could set "the owner of this phone is a minor" checkmark, set the age of birth (so it auto "unlocks" at 18), add a parental password to manually unlock for whatever app needed (or reset or change the setting). Then the phone would just send "user_is_a_minor" flag to whatever and/or filter the 18+ stuff.

I imagine the same thing will happen here...

I do not like this argument. Does an adult theater let anyone in without an ID? Do movie theaters let kids under 18 into an R rated movie without ID? Why do we think this should be different on the internet?

IMHO, they should have Youtube 18+ (Adult book store) where you need an ID and YouTube <18 where you do not (Barnes and Nobles), and they can filter the content as apporpriate.

I think it is evil that YouTube enables kids access to both grooming and violent material.

I don't like this one either. Does the cinema store the ID (or information extracted from said ID) of every single user visiting, along with what they've watched, on electronic records that can and will eventually be breached? Do they ask a third party (like Persona) for said verification providing the user's information?

On the cinema you show your ID to the person in front of you, they check the birth date, if it's valid (and not an obvious forgery) and if the photo matches the person providing it.

This is something that can be done online as well. Capitalism is controllable.

Because when applied to the internet, the age gating model that works okayish for brick-and-mortar locations is ineffective (children can use a friend's older brother's ID or account, websites outside of the relevant jurisdiction can just decide not to verify age, etc.) and invasive (sending private and sensitive information off to US companies that have been breached or linked to mass surveillance). Lack of efficacy is then used to justify crack-downs on privacy tools and the need for broad content-blocking powers with no due process.

Preferable IMO would be with filtering on the local network level, like schools have been doing for decades. Parents typically own the router/mobile data plan, so it'd pretty much just be a change of defaults and maybe some new interoperability standards. A lot less invasive, and arguably more effective.

There should be a single checkbox, "parent mode", which applies government-approved configuration, and the minority who bother, can manually edit it further. Many people are too lazy or not good with computers so the UI should be simple and not what is shown in the screenshots.

There is no need to ask the permission to get age information.

The parent mode should work on "white list" principle:

- only white-listed apps may be installed (list provided by government, parent may edit)

- in those apps ("age-aware apps"), only age-appropriate content is available. In a messenger, only parent- or school-approved contacts may be added.

- the browser refuses to open any web page not having a government-approved signature in HTTP headers (geek minority can add their signatures to the white list). Adult sites are not allowed to have such a signature.

- there should not be multiple age gradations, 3 is enough (adult, teenager, tiny child).

So all parents or store employee should do is to tick the checkbox and set a password or fingerprint for management.

It wouldn't solve the problem completely because there are many irresponsible parents.

Companies have show that they are incapable or unwilling to address the problems they cause. And market forces are not working to correct things. It’s also pretty obvious that saying “parent should take responsibility” is also not working. Just observe the world around you to know it’s a non starter.

This is where regulation is supposed to come in.

At the same time, companies have shown that they will abuse any personal information that is shared with them and we are now giving them more details about ourselves…

I'm not a fan of age verification in the first place, but I am extremely not a fan of random third parties doing the verifying.

You can't tell me that these social media companies don't already know exactly how old someone is just based on the enormous data that is collected.

Your solution here has the same flaw, I think. If the algorithm thinks I'm underage, I'm locked out.

Even literal regulated electricity utilities aren’t expected to provide service to every last marginal customer.

For example, a poor old grandma missing many electricity bill payments usually will see leniency if she is polite, the utility eventually won’t try to collect cash anymore and instead put a lien on the home while continuing to provide service.

But if the billing department receives multiple threats from her, then they may just cut the service.

Anyway it's generally a tradeoff: is it worth doing it? By adding very strict age verification systems and marginalising people, do we make society globally better or not? Will those age verification systems work to prevent underage people from accessing the stuff we don't want them to access in the first place? Not clear. If they do, will it result in underage people being better? Not clear. And if it does, will it have been worth the damage on the people it marginalised? Not clear.

How does “freedom” relate to an electrical utility deciding whether to cut service?

Even if we take marginalization out of it, this is the same kind of system that let's Healthcare recklessly utilize AI Systems to automatically reject patients' care, with a Herculean effort required to find a human to talk to. Its easy yo shrug until you are hallucinated into their crosshair.

But sure, that's "freedom".

Do you aware how many people are locked out from access of the bank because the bank think they are too risky by some algorithm and no human review?

And people got rejected for flying because they have same name as somebody on no fly list?

chatgpt basically never sent email and it's regular now - like 2 4 emails per month

so, it doesn't look great for chatgpt

Also, if you've ever played with this kind of data, there is immense overlap between how some adults and some kids use the internet. Is this user legally a child, or just emotionally a child? Similar to the problem of "There is overlap between the smartest bears and dumbest tourists" in designing bear proof garbage cans.

If that’s the nearly infinite wiggle room we’re playing with then I’d say what about Adult and Child versions of phones? You have to flash your ID to the clerk to buy an adult one, like buying cigarettes at a gas station, and then you get to do what the internet offers. Child phones - let parents and governments come up with whatever they want to block. The phone autoupdates in the background with the blocklist, the device can’t do those things. There ya go. Each person and family gets to make their own choices and nobody has to give an ID card to PornHub or a company that literally exists to harvest your information. Win-win?

When I was a kid there was no TV in my bedroom nor a computer. Everything I watched or did online was on full display in the family room. What changed in the modern home where that's not the case? Are kids glued to their phones because their parents are too?

So if there is something being done we should choose a solution that has at least some accountability to the general public (through elected representatives).

The alternative is Google, Apple etc where almost anyone has exactly zero influence and the government can still block as they like.

Of all the 3rd parties who could be responsible for this, I trust the government the least.

But really the best solution here is no third party. The device owner (e.g. parents) should be responsible for setting the user's age when setting up the device. Anything that tries to take that responsibility away from parents and give it to a third party is necessarily going to be highly authoritarian; putting that third party in the role of parent for everyone, adults included.

Really? can you name any 3rd party you'd trust with this more than your own government?

Given that you know, the government already has all of this info on us. This isn't a choice between "the government doesn't know how old I am" and "the government has all the info on me". Governments usually already do. They have enough data already to issue such proof just by the virtue of us living in the country. Tax records, birth records, driving licences, council taxes, passport info, medical information - there's more than enough to give me a cryptographic certificate that says "yes, gambiting is definitely 18 years old" without me having to do anything. Compared to literally any third party that cannot do any of this, unless they buy my marketing cookies on the open market or something, or yes - I actually go out of my way to give them my passport/credit card/selfies etc.

If age verification was an open standard, we could hope for competition so that we could jump ship from a bad actor. If one blocks our access, we would have alternatives. In theory.

Not so with a centralized government-mandated service.

What services are those other than p*rn?

Edit: I just realized that’s exactly what Android is announcing in the article, so that’s pretty neat

And, that public key of yours must be used only on given platforms. You want to participate on Facebook or Reddit, then you use that public key to prove who you are. Which platforms require verification is another issue.

But it should still be legal and allowed to access conventional forums, Usenet , tor accessible discord servers without having to prove who you are.

Otherwise , the right to organize is over and we effectively live in an authoritarian regime .

One not entirely inaccurate definition of government is a loose agglomeration of third parties.

Or, less flatteringly, a stupendously large way too loose agglomeration of way too many third parties welding way too much power way too arbitrarily.

(Now if the people want to tear apart government, democracy delivers that too.)

I’ll bet that most people are in the same boat - they trust their device manufacturer with information like their credit card number, but not anyone else.

And I think it’s a pragmatic compromise.

The people clutching pearls and screaming “what about the children” can deliver universal healthcare, child care, parental leave, and free education FIRST, and then I will extend a modicum of trust for their overriding “concerns”. Until then, I’m gonna treat this as the bad faith power grab that it very clearly is.

Then who should? Government, where each implementation strips away rights to privacy - which in some countries, including mine, are a constitutional right? Where it expands powers of government to track everyone's activity online - and remember we're one election away from total policy shift(just like with latest US elections)?

Free market? The profitable solution is, depending on environment - either ignore the problem(profit from ads served to children, no extra work necessary), or strip away all privacy (to filter out bots and get paid more per ad).

The sad reality is that "parent should take responsibility" is least bad option available, and takes into the account individual development of a child.

Even creation of a highly regulated child only internet creates more problems - as now that becomes a highly profitable target for bad actors(both individual abusers, and companies trying to serve ads)

Site/app asks "≥18?", device generates a UUID specifically for that [app/domain + device], the device passes that UUID to government database along with the "≥18?" question and the ID card info but not the app/domain, government database gives the answer and signs just the UUID and the answer and doesn't include any ID card info.

Government doesn't know what you're looking at, website doesn't know your ID.

(There's probably also better ways to do all this, I'm not a cryptographer and I expect that will be obvious from this comment to people who are).

How does it prevent fingerprinting if you get access to both logs and try to time it? Even more so if you include already present tracking infrastructure, which as a government you can just request data from.

It is possible to de-anonymize people based on aggregate data already, and this proposed solution just adds extra data points.

Even in countries in which this requires a subpoena, agencies break the law frequently and don't get punished.

Legal systems aren't computer systems. This isn't a technical problem but a social/political one.

True, but as this problem exists without any ID at all*, I don't see how the addition of the ID cards makes any difference?

> It is possible to de-anonymize people based on aggregate data already, and this proposed solution just adds extra data points.

This is why I specified a "UUID specifically for that [app/domain + device]". Can't aggregate when each app/domain gets a different signed UUID.

> Legal systems aren't computer systems. This isn't a technical problem but a social/political one.

While true, the reverse also applies: computer systems are not legal systems.

I think many lawmakers' ignorance of this is to the detriment of everyone.

In this case, the social/political problem is: we want to stop kids accessing age-inappropriate material.

The options-space for doing this appears to be:

(0) give up

(1) require parents to limit their kids' behaviour (to which I say: "Have you met a kid? Do you remember being one?")

(2) require websites to age-rank appropriately (to which I say in a sarcastic tone of voice: "Gee, that worked soooooo well for GDPR")

(3) require operating systems to intermediate. Will this suck? Yes. Will it be buggy? Also yes. Will there be false positives and false negatives? Yes to both. Will it be a constant fight as kids keep finding loopholes? Indeed.

But you know what else? All that psych testing Facebook have used for evil, can also catch bugs and loopholes faster than kids can figure them out. A school full of kids can beat their parents at the security game because they have more time to spend on finding exploits than the parents have to spend keeping up, the reverse is true of the difference between kids and Google LLC etc.

It doesn't need to be perfect, the kids aren't a computer program.

What does need to be held to a high standard is making sure the OSes don't leak all over the place.

* to be specific, the Investigatory Powers Act 2016 is one of two reasons I left the UK, just look at how over-broad the "Internet connection records without a warrant" list is https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016#...

What would be the incentive for meta to deploy that against their own self interests?

> Will it be a constant fight as kids keep finding loopholes? Indeed.

Good thing there are no other issues we as a species face. Let’s burn resources on a sysphian task because what else were we going to do with them…

The normal method is passing laws. That's kinda the point of laws.

Zuckerberg may be arrogant as hell, think he can bully governments into bending over backwards for him, governments have guns and get to arrest (and have in the past arrested) anyone local who does what Zuckerberg says instead of what the laws say when they are in conflict.

> Good thing there are no other issues we as a species face. Let’s burn resources on a sysphian task because what else were we going to do with them…

Hardly. This is more like gardening. It matters much less if kids get a few days of messing around where they're not ment to be, than if it's continuous.

And ultimately, if you want to run a business without spending money on legally required actions, you're in the wrong business, nobody should shed tears for you.

In an ideal world. Personal experience has shown that isn't the case with him.

(0) give up

...

(n) waste resources

yeah, i think current state is good enough, might as well slap regulation and ban any form of targetted ads.

However, the issues are rather broader than showing ads to kids who have no money to spend on whatever is being advertised.

The goal doesn't even need to be to make a completely perfect, impossible to circumvent, barrier for all minors; all this needs to do is just make it equally difficult for a minor to get adult (for whatever definition thereof) content online as it is to get tobacco or alcohol or gambling in real life, the hard part being to do so without compromising privacy, privacy being the bit which has to be done perfectly.

But then the government knows your location at any point of time and how often you use websites requiring the age check. Also, if your device is configured to do it automatically, a child can also follow this verification.

Not as described. There's no location info in that path, and the signed statement of that UUID passing the age check does not need to be re-signed because I've not given any consideration to expiry.

(Should I consider expiry? It's not like people age backwards?)

> Also, if your device is configured to do it automatically, a child can also follow this verification.

Yes, if that device has been associated with a government ID and also the government ID signing process fails to make use the things we've already got on-device like how my phone reads my fingerprint to know I'm me and can store copies of some forms of government ID (in some places but not where I live, Apple Wallet apparently only supports some US states, Japan, Greece, and UAE).

How? Phones are already locked down pretty hard. Anything like this would need to be in something secured at the OS level just to stop signatures getting leaked between apps.

If you're thinking "kid roots device, replaces OS entirely", that's not the problem of the manufacturer of the OS that just got deleted.

If you want the US government to not know something about you, unfortunately there's a lot of changes that need to happen, including entirely new political parties and making changes to the Supreme Court, and popular support for taking the privacy rights you already have much more seriously.

The reason the current system doesn't work when it comes to unfettered internet access is either that parents by and large don't actually agree with the threat assessment of said internet access for kids, or they ignore it because the consequences of doing so are disproportionately small. Personally, my vote is that they just don't think it's that big of a problem.

To me, the ideal solution would be more granular and better parental control configurations, especially on the web. Pair that with preconfigured devices that have "unremovable" parental controls, branded as "kids/youth phones." If parents care about this, they'll buy those phones for their kids and the problem is solved. If they don't, then this isn't something parents want, and we shouldn't really pursue it further.

Sometimes parents know their children, and what's best for them, better than faceless politicians (who we've seen are often attracted to said children for some reason).

Growing up in my household there was a time when I was allowed to read and watch whatever I found interesting. My younger brother was not. That was because my parents knew us and judged that at my level of maturity I was unlikely to be negatively impacted, whereas my brother would get nightmares or copy-cat things he saw that he definitely shouldn't.

That's how it should be. Yes, there are bad parents who will decide poorly. That's the cost of freedom.

My personal philosophy is that parents have a duty to raise their children but that duty is on behalf of the society into which the children will eventually enter. Consequently, a just society may sometimes impose itself on parental freedoms (in the case of neglect, for example) because, in the end, the child's ultimate guardian and responsibility is the society itself, not the parents. The internet is full of material exposure to which, for children, could reasonably be construed as neglect or abuse, and it is insufficient to leave the entirety of the responsibility to the parents, in that case.

I don't know why Americans are so obsessed with freedom as if were the only social good that a society can pursue. There are many things which make life worth living, that contribute to flourishing, and freedom is high on that list, but its not the only thing.

All that said, I don't approve of age checks of the sort being proposed everywhere now. We can do a lot better at mitigating these problems without damaging privacy so much.

Unfortunately they completely botched it by having the proof-of-concept app rely on Apple & Googles integrity APIs - which a bunch of countries copied.

My personal opinion is that age verification itself is a bad idea, but if we're going to go ahead with it, I'd much rather we use ZKP for it than the current mess of "upload your passport and picture of yourself to dodgy 3rd parties that likely now have your browsing traffic associated with your real name"...

The point is that if you build a service that sells age verification tokens, you are doing something illegal. And if you start doing something illegal by gathering said tokens with your own identity, maybe it's not the most clever way to do something illegal?

Is it going to be like structuring law, where it's illegal to access 1000 or more but it's also illegal to avoid accessing 1000 or more by accessing a lower number?

... unless you get thousands of tokens every day and sell them on a website, where suddenly you start leaking information about yourself everywhere. ZKP still did its job: it's not the tokens that link to your identity, it's your behaviour.

There should however be no force age verification. Social media companies already know how old you are or very close to it using the data they collect everyday. Using this data they should be required to use "best effort" to determine which algorithm you fall in. Nothing is 100% and we should stop pretending it is, sure some kids will find a way around but they would also if there is a age verification system.

Frankly, in that case I want the kids algorithm. It is preferable for me as an adult, I do not want the intentionally harmful one either.

I have the firm belief that infinite scrolling is one of the darkest pattern that was ever invented.

I can’t wait to not age verify on instagram and permanently get back a feed that’s only people I follow.

Next we're thinking about spatial pages, an innovation which considers the app as a viewport flying over the pages laid out in a line. In consideration we have database-views which presents the unpaged tables of content in the database directly to the end user, completely bypassing outdated 'page' skeuomorphisms from the olden days of printers and books. Further out, our researchers are working on Shepherd Tone-inspired viewing, where technically legally it is paged, but it looks and feels like it isn't!

For those precocious kids who parents decide should be the exception because they are "good with computers" well I'm thinking some sort of waiver would be required that held the parents responsible then maybe let the kid hack on the internet but this is an unpopular view, the unpopular part being the "parents being responsible for their kids" bit.

But in general I think its a tough time to be legislating this stuff because "reasonable perspectives" are not what we are voting into office right now lol

When I was in primary school, one of the things teachers had us do was debate the pros- and cons- of television. The pro side included educational content.

First Windows PC at any of my schools had Encarta.

Wikipedia can be downloaded in entirety and read offline, though it is so broad it may need a degree of filtering to become age-appropriate even for 16 year olds.

https://news.ycombinator.com/item?id=49091153

> This is where regulation is supposed to come in.

This is such a misdirected effort... Why the heck are we focusing on addressing those problems for a small subset of population (kids) while creating even bigger problems for the rest? Lets regulate those companies into actually addressing the problems they cause for everyone!

Yes, agreed. However regulation does not necessarily have to mean age checks.

The most obvious low hanging fruit to start off with is open and interoperable content filtering infrastructure (ie parental controls) so that there's some common standard that literally everything supports out of the box. It needs to all work together - the current situation tends to be spotty and unreliable thus parents tend not to bother trying to use it.

Start with an extensible metadata format that enables websites to self-classify pages. Account for things like loading alternative resources on the same page. Mandate that all websites and app stores include such metadata and that all browsers and operating systems have some baseline functionality for making use of such data in a sensible manner.

Only after that has completely and utterly failed should we even begin to consider highly invasive measures such as mandating government ID checks.

This is the rot at the center of tech IMO. We have all these wondrous toys but we can't do something as simple as verify age without abuse. What's the point of all this tech if we can't trust any of it?

The "think of the children" shit is just a tactic to make emotional, non-critical-thinking people into die-hard soldiers for the cause that get angry when you argue against it.

"Oh you're against protecting children? What are you, some kind of pedophile?"

That's like saying "take a look at owners of fast sport cars, it's obvious this is not working and they have too many accidents." If you want to patronize other parents and think the government should be more responsible and parents less responsible, please state that honestly. Don't make up alleged "facts" to make a point.

Otherwise, I'll just say "it's obvious you're wrong, just observe the world around you and you know age verification is a non starter."

So punish those people.

Stop letting them neglect the responsibility a parent innately has to their child

and to the rest of us.

In any case, the story with parents and addictive devices is even harder for parents than e.g. cigarets. For example, a LOT of schools in the UK think that it's good to give childrens ipads to study, and there's nothing that parents can do to prevent this. In this specific situation saying that "parents should take responsibility" is unfair to parents, because their only option to avoid this is home schooling.

I doubt it matters because nobody seems to configure the parental controls that are there, anyway. Only schools seem to try, and only because they're legally held responsible for what kids do on their computers.

You can set up, for example a child friendly DNS (Family version of OpenDNS) then Firefox come along and bypass it (DoH).

Probably, we need an OS level setting, per account, browsers would need to expose it to websites, apps installed would have to check and provide content according to local legislation/rules. Bypasses would have to be performed by an "adult" account.

The main issue is that adults would be able to set themselves as children and avoid negative commercial activity. That's a problem because it means FANG, etc, will lobby against it and then ensure their implementations are convoluted and broken.

Parents should be teaching kids from a early age how to use technology responsibly.

For some reason we're making sure no 12 year old can drive or run for any government positions, but a 90 year old can keep the driver's license that they've had since before the start of colour television, or make critical decisions affecting millions. We can't have it both ways.

Connect them with each other and populate their air-gapped "Internet" with like-minded authoritarian AI-bots and create special news like Don and Vladimir are being fed to keep them from tantrums. A win win for everyone!

Ooh, and mental health services. Plenty of mental health services as we're so poor of a race that even our richest can't afford enough therapy to feel alright!

... unfortunately I don't have a vote according to Tobi

https://fortune.com/2026/07/27/shopify-ceo-voting-rights-str...

The problem remains though that, since the laws this feature was created to comply with put the onus on Google to verify the user's age and not on the device owner (e.g. the parents), the method they use to determine the user's age to feed into this API is terrible from both a privacy and freedom perspective: they force you to send them a copy of your government ID, and delete your account if you don't comply.[3]

[1]: https://support.google.com/googleplay/answer/17232873

[2]: https://developer.android.com/google/play/age-signals/unders...

[3]: https://support.google.com/accounts/answer/1333913

This is kind of inevitable.

and don’t assist in orchestrating big, cross-border paradigm shifts like this?

A few hundred rich people and the world's politicians. Having secret off-the-record meetings, yes.

This is much much better than having to do face scans and credit checks etc. to prove to some sketchy third party that you are over 18.

I think if Google had bothered to do this 5 years ago we might not be in the shitty situation we are now, but it's probably too late now.

Which parents and which developers? How many of them? From where?

I have mozilla, brave, waterfox, mullvad and a few others.

It's amazing to see how google and others big companies are marking you as bot.

> To request a user's age range and sharing status, you call the Play Age Signals API (beta) from your app at runtime. The default age ranges the API returns are 0-12, 13-15, 16-17, and 18+, but you can receive custom age ranges.

https://developer.android.com/google/play/age-signals/use-ag...

But I don't find it any better. I don't see any viable reason to provide identification to my phone's OS. If a parent buys a phone for their child, they can already set up parental controls before handing it over.

I wish Motorola all the best with their GrapheneOS partnership.

The rumored Motorola devices are even more expensive. It's the signature and some foldables, all in the 1000+ MSRP range. At least with pixels you can get the a series for as little as 400 on sale.

And if enough people stand out, it doesn't matter anymore.

If anything, I would imagine that Google's changes are motivated by driving traffic to their Google Play Store, where they make billions in commissions.

Once this framework is in place for the Google Play Store, perhaps they can lobby for strict age verification laws, and then tell developers who publish outside of Google Play that they are responsible for compliance themselves.

They gather more data now. Only verified users will be able to use the internet in unrestricted ways - that is what is new.

If it appeals to politicians who view "protect the children" and surveillance positively, that is a bonus.

It always gives me the "he only beats me because he loves me" or "he wouldn't beat me if I knew how to behave better" vibes. It's not healthy, not sane, not rational.

One disagreement though; I don't even think they will lock people out of their devices outside of very narrow and specific instances or examples to "cut the grass" as the Israelis call it, to scare and remind people they are the slaves and the long arm of the tyranny can reach out and crush them if they don't self-censor and self-subjugate. Psychological and ideological control has very much proved itself far more effective than physical control in all circumstances. They want to be able to monitor and then use methods and technologies to control that have not really come to light in society even thought they were systematized through the Iraq war. You are now the "insurgents", are you old enough to remember those, those insurgents in their own country?

Too many seem to fall into the familiar problem-solving mode, ready to provide compromises or solutions while forgetting that once the infrastructure is in place, it can easily be modified later to undo the compromises which facilitated its acceptance in the first place. There is an inherent power asymmetry and it's not generally in favor of those building and using the infrastructure.

They also actively undermine the US constitution. Will be interesting to see whether the remaining judges have any power to change this or whether they were also integrated into the new dictatorship model.

Do you force people not to give up their own liberties? In a democracy?

Although better privacy laws would cut off the access of non-customers to the data of those customers devices.

These things could be true or not. It's the fact that they could be true which means that we cannot allow ourselves to slip into an unretractable surveillance capitalist hellscape. That means people must have avenues to stop things like this.

Petitioning city hall doesn't seem to be working; in fact, it's waking many people up to the fact that their local governments are not working for their interests, as mayors openly discuss banning discussion about data centers.

Laws exist because some people won't play nice otherwise. It is asymmetrical to put the burden of defense of liberty on the individual. The individual is the last line of defense against the government, and when it is the individual's turn to act, it's because law has already failed.

We need to act, and fix the law, so that I don't have to act like a paranoid psycho around others in my life who are wholly unequipped to understand or even care about this problem.

(In case it's not obvious: rethorical question, Google just wants to do platform lock-in with Android and sees this as a useful means to bludgeon it.)

Sounds like an adtech targeting demographic, not protecting children.

Also on the "privacy-preserving tool", technically apps get a bracket ("16–17") instead of a birthdate. But who holds the actual data? Google. The privacy improvement is against the developer only.

It seems like a very good solution to me. It gives parents a simple solution to define the age of the phones user and a mechanism to allow apps to get an age range and tailor usage appropriately.

It does all this while leaving everyone else undisturbed.

Put the age range into http headers and you solve children accessing content via the web as well.

Until a KYC verification via Persona is required to prove you are actually of age. Coming in the next Android version.

But the principle of this can work on everything.

Own an iphone, apple can do the same tied to the apple account.

On a windows machine you can do the same tied the user account login for the child.

People will no doubt pick holes in something like this, but it's the least intrusive, least effort solution to the problem that will actually work.

> it's the least intrusive, least effort solution to the problem that will actually work.

Currently, I have no account tied to my phone or my computer(s), except for an older iPad. Also, I have never sent my ID to any FAANG company. This would force everyone (including adults) to tie an account to their devices and a government ID to their accounts. Bans (which Google does not justify, a lot of the time) would gate users from using apps and possibly sites.

In other words, this helps solidify Google's control over Android users. The problem would be the same for Apple, Microsoft, etc, and in many cases it already is the same.

I get that most people probably have a cloud account for their own devices, and I think that's OK. But currently there is the option not to use their services, and I think that's the fundamental issue, they're effectively removing that option by making apps block users who don't have an account, in the guise of age verification (together with Play Integrity, etc). That option is fundamentally linked to the right to privacy, as once you're required to use certain services to be basically integrated into society (making payments, communicating with others, watching turtle documentaries according to the post) you're not effectively able to exert that right anymore.

There are also other related rights and freedoms here, like the rights to repair, tinker and innovate, that are affected by this action, which helps cement an ecosystem where every app requires Play Services, and as such, is hard to be ported or emulated into other ecosystems, and other actions from Google and Apple.

No, it's not. Your top priority is squeezing as much money as possible.

It would be far better if the user could set the age dynamically, as part of a capabilities set, and the browser could forward that data.

Then a person could hand over their phone to a child or a border agent in safety.

If they can afford to buy them on their own, good for them.

You don't use age to decide what's appropriate; I don't mind if my kids see naked bodies. I do care if they see naked porn star bodies, and porn, although actual amateur porn with a range of body shapes is okay. Fighting is okay, but actual graphic bloody violence is less so (funkytown cartel video is no bueno).

Put that in an age range Google.

There's more and more evidence that internet access isn't healthy to have for children anyway.

thanks so much for being awesome like this, pulling the ladder when it no longer concerns you. so mature and brave

That seems to be a uniquely American pathology.

Everywhere where else in the world, and in non-white American subcultures, the community taking a hand in raising children is expected. But many Americans seem to consider it socialist and an attack on Christian values.

See Hillary Clinton getting mocked for saying "it takes a village"[0] or BLM being accused of wanting to "destroy the nuclear family" by encouraging community based parenting[1].

[0]https://www.cnn.com/ALLPOLITICS/1996/news/9608/27/hillary.sp...

[1]https://medium.com/@emailnatesmith/the-blm-statement-on-fami...

Nowadays there are many many ways to supervise your children's online access. And yes, there are also many many ways for kids to work around that too, but ultimately if you buy your kid a device with internet access, you should try to supervise that. Parents need to care more about what their children are up to, instead of silencing them with a tablet for a moment of personal silence.

The internet as we knew it comes to an end and we are... complicit?

Judging from comments here it seems like some of HN readers do actually unironically take this at face value. Which is weird. Of all people, we should be ones to see what is this going towards.

So at the end of the year they contract again?

Or should the headline read _by_ the end of the year?

Heard Google is also rolling out QR codes to get past captchas? Ie linked to a device that would now be identity linked too.

All seems pretty dystopian or to quote googles slogan - being evil

On the other hand, youtube became so unusable that I have spotify premium now.

So, give it a few years and corpos will take it down because of missing profits.

YOU have become their product.

By the way, this also explains one reason why Google shut down third party access/applications recently on Android. Android (if one uses the Google software) becomes the ultimate spy tool on people. At the same time you see several countries force age sniffing on people - this is the beginning of the end of the free web. It will happen in various steps; the next one is Microsoft adding this to their software.

LOL

behind the curve, and completely missing the point.

Prove me wrong

If I a child is on the internet without adult supervision, that’s a parenting problem, not an issue for the state or other people to solve.

And there's no sign of improvement on the horizon, only the tightening of the noose.

Theoretically you could make this double blind and that's the story they are telling.

We have no way to (dis)prove it though.

Alas, here goes the freedom, with thunderous applause.

The problem with this comparison is that the authorities can open a letter if they need to for various well-intended reasons, but they cannot open an encrypted message. Either the authorities can scan all messages, or they can scan no messages, there's no inbetween.

The mandate to verify age before selling alcohol has been around forever. This is not a new idea. The biggest restriction until now has been that there was no good way to do these kinds of age verification, but that problem has been solved. You can still debate whether or not age verification is a good idea for specific subjects, but selling 10 year olds alcohol or porn has been illegal for much longer than the internet has existed.

But there're countries where that already exists. They usually get labelled as a threat to democracy. Isn't it ironic? It's as if our own governments are the greatest threat to our way of life.

The main argument is that there is an assumption this data is not stored in the real world, which is only sometimes true. Some places like airports and some concerts, shows, bars, etc. scan identification with digital readers whose data is presumably retained. One reason for this is because fake identification is a thing so defense against this converges to the same solution as digital verification.

Imo best to spend energy thinking of the appropriate solution that minimizes privacy violation than conceptual fighting against the idea.

I don't think it's fair to say that parents who don't care to use parental control measures already available to them have no tolerance for that.

We could settle on a privacy-preserving idea, like physical cards with single-use codes sold in stores after showing ID, similar to alcohol. Then a few years later they would ban cash payments for those. Then require sellers/payment operators to report all transactions to a central registry. The slope has always been slippery.