Protecting children from online exploitation, abuse, and inappropriate content is an undeniable moral imperative. The internet poses real, well-documented dangers to minors, and society has a vital obligation to create safer digital environments for them. However, when evaluating how to achieve this safety, we must ensure the proposed solutions do not introduce even greater harms to our fundamental rights.
Current age and identity verification laws unequivocally increase surveillance and information control and are a threat to freedom of information on the internet.
There are countless issues with policies like the ones enacted in the UK’s Online Safety Act. See the wonderful work of the EFF for well cited details on everything wrong with them.
I would like to focus on the mechanics of how these policies could work if they really were anything but an excuse for surveillance, and how they are being implemented by governments.
The first question is whether it even makes sense to implement these kinds of age gates. Almost any mechanism you can use for this verification is either deeply invasive or utterly ineffective.
A mechanism that could work is one which uses some highly privacy invasive mechanism to verify your identity and age, and then uses that to create a cryptographic mechanism which can then anonymously prove age without providing specific identity to sites. So sites get an anonymous but verifiable token proving “some adult is accessing this” while the government who helped to issue these tokens can also not go to the site and ascertain your identity just because you verified your age. This would be released fully open source and you’d be able to use the mechanism even if you built the software yourself, proving end to end privacy and security.
The critical functional requirements for a system that protects the kids and doesn’t further surveillance interests is
- age is verified in a high trust way (IE govt. ID verified by govt.) so that the cryptographic tokens actually carry some weight
- the government issues the ability to prove age in a way that functionally does not allow them any access to whether the user even used the system at all. All they can know is that particular citizen now has the ability to prove age. Not that they have used that ability, nor where they used it, or anything else.
- the sites who check ID cannot tell who it is, or ascertain any information about the user through the process of verifying. They are mathematically provably unable to link any information coming from verification to any other information they may have. It should provide them literally zero info besides just that the user is of age. It should be compatible with tools like Tor to enable truly private verification of age, so that privacy respecting sites might voluntarily use it
- if either the government or a company find a way to circumvent these measures, they should be legally barred from using it and punished if they do so. For the nerds, this means if they train a model to use session IDs or timing analysis to link tokens to identities, we’ll see them in court
A related concept that is often discussed Zero Knowledge Proofs, for context those are the building blocks which would help us construct this larger system.
The key is to separate the privacy invasive and personally identifiable step of verifying age and ID from the ability to track site usage, both by the site owners and the government.
It should be also enshrined in law that identity links driven by age verification online are inadmissible in courts, illegal to use for advertising, and their misuse should carry real, enforceable, and hefty punishments.
Unless I see that extent of respect for privacy or better, you will not convince me that any age or ID verification law is anything but a weak excuse to surveil the population.
If a politician is reading this, they may point out that this system can be porous. “What if a kid steals their parent’s token generator or their private key?” This policy must be compared to other policies and compared like-for-like. If a politician is pushing for another policy, like the UK’s solution of delegating to private companies, they must prove their system less porous. The truth is that this system is arguably substantially more reliable than any proposed system such as that used by the UK despite being imperfect. In the UK, it just takes sneaking your parent’s drivers license, AI generating an image of an adult, or countless other tricks to break the system; far harder than understanding and successfully heisting a cryptographic key. This is especially if these keys are handled similarly to passkeys or 2fa keys. The reality is that this policy is not only privacy respecting, but would be significantly more difficult to circumvent than anything any government is doing or is proposing to do at time of writing.
Parents should think of this type of verification in the same way as their password manager. If their access to their work email, their bank account, etc. is secure enough against their kids, this is too. If they are concerned that being as secure as those things isn’t enough, the problem is with them. The UK seeks to move verification to time-of-access with the webcam to avoid misuse where kids share devices with parents. I encourage the solution to instead be education about guided access, multiple user accounts, profiles in browsers, and myriad other solutions which have the added benefits of parental controls & not letting your kids play in your bank account.
Like banking apps, regulated apps could ask the user to re-authenticate for new sessions, even without an account a “tap fingerprint to verify age” action would be near zero friction from an adult and ensure complete prevention of same-device abuse by children.
This solution is imperfect, but critically not more imperfect than existing proposals in its ability to ProTEcT tHe ChIlDReN. Enforcement against violators may not be perfect either, nor is using the government as a central issuing authority. The exact methods of these are subject to fair debate and discussion, and better solutions probably exist. That being said, an absence of any attempts to prevent government and corporate abuse and the absence of a real durable issuance mechanism are both hallmarks of an utterly ineffective law. How many ID based age verification solutions have caused major leaks of sensitive info at the time of reading?
If you are a voter, think carefully about whether a policy is being proposed that is even slightly less privacy respecting than what I wrote about here. If it is, I implore you to oppose it.
“Think of the children” is an excuse as old as time for mass surveillance. It’s especially powerful because of its emotional resonance, so usually articles arguing against it have to write a few sentences of platitudes to get over that hurdle. I trust you to be clearheaded enough to not need that, but in case you’re not, I’d like to disclose that the opening paragraph was written with ChatGPT just for this purpose.