It's been true for decades in the USA that if they want to arrest you, they will. The age verification doesn't make this situation better, but at this point it's almost just a formality.
Extra-territorial issue are huge here. What is the limit of the boundary on a given nations constitution and law? How much does the economy of the user, the hosting company, the owning company, the receiving parties matter?
Social Media has advertising and publishers. It has people who can effect editorial control over what is seen and by who and to who it is "said" -And that imposes obligations on them, and on people lodging content. Differentially depending on their economy, the reach of law, registration of legally incorporated entities.
All of this is being implemented somewhat haphazardly internationally, enforced differently, subject to legal and financial and social pressures differently depending on the times and the context.
If you want to ask questions about America, about Americans, using American companies, speaking to Americans, believe me you don't neccessarily have a simpler task here. It may well be clearer to some of you, but to me, its just as fraught.
It's just not clear to me "free speech" is the bastion rule which applies here. The EFF may think so, I don't think they have actually demonstrated it all the way to the end.
Then you have the mega corps like Facebook who can figure out every detail about you even from merely _not_ using their system because of the hole you leave in your social network that does use them.
The only privacy left is from anonymous troll farms claiming to be an American while talking about how the Texas oblast is valuable for its warm water ports.
I am fine for privacy on consumption of content, but you should be forced to identify yourself for posting so the common man at least has a chance to evaluate your statements instead of being misled, all while, as stated above, our governments and corporations don’t have that limitation.
Also anonymity can actually improve social media polarization (see Chris Bail’s research)
Also again, the corporations and governments(for certain levels of government like the members of the Five Eyes) can pierce this veil of anonymity, the people who have a lot to lose already are risking it by speaking.
Edit: this also isn’t a newly diagnosed phenomena, I remember seeing this satirical description of the behavior as a kid back when Web 2.0 and social media was starting to change the internet[1]
[1] https://www.penny-arcade.com/comic/2004/03/19/green-blackboa...
It really isn't, though. Don't mistake the internet for reality. The majority of people in the US and Europe support laws like these, and most of the rest don't care.
Even on Hacker News the consensus is mostly in favor of anything from age restriction to making all social media illegal.
That doesn't sound right. Put up a poll. I'd put money on 90%+ choosing some flavor privacy/anonymity on the internet.
Governments that are serious about age verification and individual privacy (which, doubtful they truly are) should agree on a protocol and set up certificate issuers that are associated with a digital ID. Then age verification will not be an invasive procedure or risk data leaks or insider threats.
[1]: https://blog.cryptographyengineering.com/2026/03/02/anonymou...
If it's unlinkable, what's preventing someone from setting up a site that hands out anonymous tokens for anyone to use?
I grew up in a neighborhood full of drug dealers. Street sellers, not the classy Walter White kind.
Ironically being on a computer all day kept me out of trouble.
But with these laws in place I guess you might as well start doing stupid ish in real life.
Too bad?
Too bad!
I'm glad we're discussing parental liability. It seems no one else is advocating for "social media access is criminal neglect," so I appreciate the novelty.
More to the point, if a kid walked into a convenience store and the clerk sold them a pack of cigarettes, the clerk wouldn't get off the hook by claiming, "well, the parents are responsible for their kids." I'm also not sure how one would justify holding parents legally liable for crimes they played no role in committing.
I'm not saying that I agree with these laws. They appear to be taking things too far. But that has more to do with there being no clear way to define sites that are only of interest to adults (no gatekeeping needed) and sites that should be restricted to adults.
If I misbehave here, dang can just ban me. There's no reason HN needs to know my real name. The only reason to mandate blanket age and identity verification is to control online speech.
You are required to identify yourself for an electricity account because it is essentially extending you credit. You use the electricity first, and then they bill you for it later. They also only identify the person who is receiving the bill. You could have a house with a dozen people in it but the electric company only knows the name of the person responsible for the bill.
You are free to identify yourself on the internet right now. People who are intelligent and/or believe in freedom and free speech are opposed to this authoritarian power grab.
Not in Australia
I may sound crazy for saying so, but I think the answer is more government run infrastructure for enabling identity-based operations, like payments and authentication, with rules about standards, open source, contractor selection, and audit that make operation transparent. It can work if technical operations are legislated instead of "left for the engineers to figure out." Then at least the evolution of systems can become real political issues that map to election cycles.
My stance is probably a polarizing one, but this is precisely why we need to be able to debate the minutae of these systems through our political discourse instead of just "will we; won't we" legislation. This should be debated in democratic process.
Tech companies should ignore it and just publicly name whoever attempts to prosecute them and see how the population responds. I think people today are orders of magnitude more informed about their privacy and the consequences of digital ID laws. A few countries are on the edge of revolt at the moment anyway, and this would be a good way to get young people into the streets.
20 years ago, people would have had no defense against it or understanding of what was being imposed on them. Today, normal people use Signal and encrypted messengers, faraday bags, and leave their phones at home. Where we were nerdy security guys back then, non-technologist women and girls use spy tradecraft level electronic opsec for their own safety and security from middle school. People are much more sophisticated about their privacy now. They're ready to take this on.
The laws coming into force are on people who are not in favour of them, and I'm so optimistic that I will not interrupt the enemies of privacy and human dignity while they are making a mistake.
1. Age gating + VPN ban under the guise of protecting children from social media
2. Few years pass, Identity Passport gets ushered in under guise of convenience of not having to repeat those pesky age verification checks.
3. Utilities start to require ID Passport. Including signing up with an ISP.
4. Renting starts to require ID Passport.
5. Work requires ID Passport.
6. Well done, you built the torment nexus!
I think for this argument to carry weight with voters, privacy advocates need to be much more specific about what "coming back to haunt you" looks like. They do a little bit of it later on[1], but I think most people do a rough cost benefit in their head and decide that the small benefit outweighs the small risk (to them).
[1] "And that creates a lot of risks for data breaches, overly broad data collection and retention, censorial legal demands for collected data, corporate and governmental malfeasance, pressure to self-censor, and perhaps blatant First Amendment violations. Every new layer and every new mandate brings more potential for risk. As we’ve unfortunately seen many times over the years, people including high-level government officials will maliciously seek to root out the identities of their critics, so the more layers of anonymity we can preserve in online speech, the better."
I'm starting to think we need to lean on conspiracy theories in order to get broader population on train with this - and I'm saying this in utmost regret. That's a borrowing game from a right wing/extremist playbook.
Start with this: requiring IDs online is a first step in micro-chipping the population.
...or how about this: marxists/atifa/nazis/zionists/islamist/whoever-group-people-think-is-in-power want to erode your privacy online so it can be used against you. Some nefarious group what to know your every move!
...or how about this: remember Epstein files!? Well the pedos now want to id your children online!
I simply saying truth/evidence/rational based approach to this will not get people attention. People just don't care.
It’s simply not on the cards, and I live a frugal enough life in a high paying industry that I can retire in a few years. If I was willing to bank on inheritance then I could retire now.
I feel for the people that are forced to engage though. But too many of them simply don’t care about privacy, which is why we’re here.
The Supreme Court has repeatedly held that the right to anonymous speech is inherent in the first amendment [1] [2]. See also The Federalist Papers or Common Sense, without which the US might not exist at all.
Free speech absolutism that ends up in creating an environment where real speech is drowned out by lies is not valuable to me. It’s like the paradox of tolerance.
You may as well advocate for no one to be allowed to drive cars because of the possibility of someone getting into a car accident.
Or (in case you're a fan of the second amendment) - advocate for guns not being allowed to be sold to law-abiding citizens because of the possibility of the gun later working its way into the hands of someone who would use it for a mass shooting.
Freedoms exist with the understanding that both positive and negative consequences can result from them. The argument is that the good vastly out-weighs the bad and are worth preserving.
If you were correct, there would be no need for them to push these new laws. The fact is, you will have less privacy after these identification requirements are fully enforced.
I can only say what I've observed from numerous threads - people's advocacy for privacy on the internet here does not extend so social media.
But OK this could be fun let's put my keyboard where my mouth is: https://news.ycombinator.com/item?id=48680434
Social media is full of astroturfing.
Other approaches are possible. I'm particularly keen on ones that treat attestations as anonymous digital currency and use cryptographic penalties like slashing to discourage copying post-hoc instead of relying on EU-style implementation certification.
There's a huge literature on the subject I don't want to reproduce here. The point is that yes, we do have the technology to do attestation without sacrificing privacy, which makes all the calls for non-privacy-preserving attestation awfully curious.
Or make it so that tokens cannot be tested except by spending/burning them, which would significantly reduce (but not eliminate) a black market because it would be hard for buyers to trust the seller.
The best outcome is going to involve a system that is "good enough" for broad social results (e.g. less brain-rot in the kids) without being so strict or overbuilt that it leads to an even-worse problem (e.g. authoritarian hellhole tools.)
If so, this stuff is already broken, and imagine it would be pretty simple to apply the same principles here.
I'm probably wrong on this though I'm out of my depth
I'm surprised anyone considers this viable.
It would limit access to those sites to a limited set of acceptable devices and operating systems.
I couldn't use my laptop, desktop, or a jailbroken phone.
Yes, that can eventually be worked around, but not really that different than doing the verification today on someone else's device.
"Use this exact tor/vpn server"
>It would also throttle the number of identifications
So I can only wank off 5 times a day, or grant access to porn sites for 5 kids?
So I'm constantly grabbing new tokens from the government every time I go from work WiFi to my cellular internet to the train WiFi and then home?
Sounds like a fantastic point for capturing more tracking data.
> /geolocation.
Which means I have to send my geolocation data to apps to confirm I can use my token?
Don't want that either.
> It would also throttle the number of identifications,
And if I move around too much in one day or change networks too often, I'm unable to log into anything until tomorrow?
The anonymous crypto token scheme does not have any trace-back mechanism like this at all. If there's no way to track those tokens back to you, why not sell them for $1 each on the internet to make some extra money?
Majority of people understand their SIN or SSN number or whatever, they understand they have a drivers license number. This could be built in such a way that it's basically just be another government issued "thing" that they have to know about and be able to produce when requested
And you want to satisfy voters who are worried about children online or have heard scary things about anonymous criminals. You want to be seen to do something about those.
A distant third is that you want the system to be cheap and built up fast and relatively easy so voters don't complain about it.
All together this leads you to something like "any time a site needs to verify your age (based on this broad list of requirements) put in your government ID number / picture". The infrastructure already exists for that, banks need it, social media needs it, and the current president has agitated for it a few times now. If you're really aiming high you set up some digital ID attached to it that's easier for the users.
Either they validate so little information that a single homeless person can authenticate the entire country or they validate so much information as to not have a significant privacy guarantee.
There is no in-between for ZKP validating someone's age.
the truth is that the two extremes you listed can be titrated.
if you use nullifiers you can trade some privacy for some security. basically you convert your true identity into a private token which you can use to authenticate aspects of yourself, the price being that the token can be tracked with some effort across services. better than just using your identity at least. if a token/nullifier is abused it can be revoked and then you have to jump through a bunch of hoops to get another.
there are some other trade offs that can be made.
What combination of details can you validate on that is meaningfully privacy-preserving and couldn't result in wide-spread re-use of tokens?
Additionally - what would prevent some kids from getting a homeless man in the city to hand them his ID, get a facial scan, and everything else you can think of to generate a token and then pass that token around?
ZKP are a cryptography-nerd's joy but are are categorically unsuitable for the purpose of age verification. I stand by this without the slightest reservation.
tying multiple accounts and services together isn't ideal but its inarguably better than tying your real world identity to every single service.
To clarify - it's not cryptographically necessary to present the same token for each and every transaction and serves to categorically defeat the entire privacy guarantee of ZKP.
It also makes it trivial to associate your ZKP token with your real identity.
> use of a persistent identifier
> tied to a person
I've also always been curious how a truely anonymous identity verification could possibly work. At best for age verification, I could be given some kind of token that would still have to verify my age and be verifiable with a central authority to ensure my token is valid. The central authority could always keeper records of my token, revoke it whenever they please, and every entity that can verify the age associated with, or embedded into, the token knows at least some of my PII.
You go to a store. You show the clerk your id and give him a quarter. The clerk pulls a scratch-off ticket from the front of a ticket tape. The ticket contains a token identifier.
It's anonymous. The clerk or his POS system knows your name and age, but doesn't know your number. The vendor providing the tape doesn't know your number or your name. The system accepting the token knows your number, but doesn't know your name. The token is only valid for a day after use, so loss and transfer isn't much of an issue.
It's the exact same process by which you buy lottery tickets in a world where they don't need to verify your identity when you redeem them. The lottery has no idea who bought a particular ticket, only that a ticket was bought. The clerk knows you bought a ticket, but doesn't know which ticket.
Obviously, Eavesdropping Eve looking over your shoulder knows both your name and your ticket number, but that's not a practical attack.
Where does this 3rd party identity token provider come from?
For government-issued identity tokens, there are not separate parties. It's just the government, and they can choose to link whatever they want in their internal system if they decide it's in the interests of national security.
You're also forgetting that lottery tickets are tracked. This is how they can announce which store sold the winning ticket before anyone steps forward with it. It would be trivial to match a buyer to the ticket if they wanted to inspect the records. In the case of a government identity token service, there isn't even a separation of parties providing the records. They do it all and can have all the data.
Some oracle whose job it is to print tokens and hand out rolls to the stores (and to the websystems). They would know which store got which roll, and which website authenticated it, but not who each ticket from that roll went to.
With a big enough roll, this is essentially anonymous.
Yes, lotteries know which store got the winning ticket, but they have no idea which of the patrons in the store got it. Not unless they ask Eve to get her telescopic lens and notepad out.
You're saying the real solution is that we bring in a private, 3rd-party company to start checking our IDs to access websites now?
I am not actually advocating for it. I'm just saying how it's possible to solve it given those constraints.
What prevents a commercial "AI" security camera analysis firm from doing a decent job of linking a footage of a store's customers to a likely subset of tokens, based on the knowledge of which tokens are sent to which store and how many tokens have been pulled off of the roll so far? Remember that you can design the token roll packaging so the easiest thing for a clerk to do is to pull off the rolls in the order in which they were shipped. Or -hell- you can design the token dispenser so that it phones home to the oracle that sent the roll to the store with the range of tokens in the roll when the roll is loaded into the dispenser (for "security purposes").
> It's the exact same process by which you buy lottery tickets in a world where they don't need to verify your identity when you redeem them.
I've seen many people buy lotto tickets. I've never seen anyone asked for ID. Perhaps the merchant is supposed to check for ID, but they don't. Relatedly:
> The clerk pulls a scratch-off ticket from the front of a ticket tape. The ticket contains a token identifier.
What prevents rolls of those tickets from falling off of a truck and either being handed out for free or at a substantial markup, no questions asked? [0]
In the real world, the system you propose absolutely will not function to the standards required by the people agitating for these systems. You can't "protect the children" if "children" can easily get their hands on anonymous access-granting tokens.
[0] The fact that this doesn't happen with lotto tickets often enough to be newsworthy is not a compelling counterexample. Stores make a decent amount of money selling those, and wouldn't want to get cut off from that revenue source by regularly "losing" shipments of tickets. What you propose doesn't make stores any money, so either you have to spend a bunch of money to induce them to carry the tokens [1], or you have to have harsh penalties for "losing" shipments of tokens. If you risk harsh penalties for choosing to sell the tokens, why even bother? Stores put up with the risk of selling booze because it's quite profitable... selling 5c or 0c tokens absolutely is not.
[1] Where does that money come from? From you and me, of course!
It's one thing to be concerned about someone stealing my credential, but another to prevent the transfer of these credentials, especially if they are limited use credentials.
The entire point of age verification systems is to prevent minors from accessing certain resources. I think we all know that this is basically impossible; but what these various governments and social media companies want to do is to make it high friction to do so.
The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime roughly equivalent to providing alcohol to a minor. Without the possibility of real world enforcement, none of these identity solutions can possibly work.
Keep dreaming of a technological solution -- there is none that does not lead to the world that FIRE is warning about, except to accept that we can only make a solution "good enough" and leave it at that, without expanding into full on identity verification. The solution here is likely to just try to provide better abilities for parents to monitor and limit their children's use of the internet. Let individual parents decide on the level of harm that they are willing to accept, and accept that there will be ways to work around this even if parents are vigilant, but just try to reduce it on the margins.
So the schemes always start introducing features to reduce the anonymity of the tokens or make them more trackable in some way:
> The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime
Which requires that these identity tokens not be anonymous age-verification credentials. They become a traceable identity token tied to your government-issued ID.
Yes, parents are responsible to set this up. But parents are also responsible to lock their alcohol, drugs or guns, condoms, etc., and many other things.
Perhaps parental controls are not good enough? That's where the regulation could genuinely help - require child-certified devices to implement minimum set of parental controls, and make them easy to use.
Yes, government want to end anonymity and that's clear to some. But governments enjoy on a pretty broad support for this and many people supporting this believe it's a real problem. Suggesting to leave it unsolved or solve it in a way they can't trust or understand is only going to alienate them, making the government job easier.
I think suggesting a simple, cheap and effective solution to this problem that has no impact on privacy is a way better way to counter that. I think local parental controls fits the bill.
Solution: Maximize the distance between yourself and the people
A simple G/PG/PG-13/R header for websites would solve 97% of actual issues anyone could care to present. (violence, porn, etc)
Forcing people to identify themselves will not solve skinner boxes, gambling-for-children, focus-degrading slop, etc.
Bluey-themed slot machines are still harmful.
gchamonlive•1h ago
OnionBlender•1h ago
nathan_compton•1h ago
Ifkaluva•1h ago
ghaff•1h ago
gchamonlive•1h ago
Ifkaluva•45m ago
I do see folks who look homeless using the computers, so I assume there must be a special accommodation for them.
But, if you’re just a regular middle class joe looking for anonymity on the internet, I don’t think the library is the place for you—it’s tied to your library card which knows your address, and anyway what would you want to be private that you would be ok to broadcast in an open library setting? Nobody watching corn or browsing whatever successor to Silk Road.
Usually the login screen says something about fairly restrictive terms of use, even for the WiFi on a personal device, and I don’t know if you can install software on the library computers.
When I look around at library patrons using the computers, it’s usually lower income folks applying to jobs or similar, and people playing chess.
Geezus_42•7m ago
EvanAnderson•1h ago
I don't know what their retention time is on circulation records, but beyond aggregate statistics for culling materials that aren't circulating I bet it isn't too long. Now I want to go check.
My library also only keeps 24 hours of video surveillance because they didn't want to be able to fulfill requests from the cops for footage of patrons. I really liked that.
Edit: In the patron portal it permits me to disable "borrowing history" and says it permanently deletes my records. I do contract IT work for them so next time I'm engaged I'll ask about the details. They're moving to Koha later this year (free / open-source ILS) so I could go look at the code to see what it does (which is nice).
On the theme of their privacy fanaticism:
Over a decade ago the library got a grant to do outdoor public WiFi in the park behind their building. As part of that grant they needed to report the number of distinct users using the WiFi each day. Their UniFi controller tracks MAC addresses of associated stations. I used a query against the underlying MongoDB to get the usage reports to satisfy the grant.
To minimize the potential of tracking individual users the library director had me write a script to grovel thru MongoDB, do a SHA-1 hash of each public MAC address tracked concatenated with a randomly-generated salt for that day, then write back the first 48 bits of the hash over the original MAC. The library gets their daily statistics and long-term traffic trend data, they don't double-count associations for the same device in the same day, but they can't track individual people over a span of multiple days.
Now that devices randomly-generating MACs are mainstream it's much less necessary. I thought it was really cool she thought this. (The whole salting/hashing bit was my idea. She just wanted to be able to fulfill the grant reporting requirements amd be unable to track people.)
HoldOnAMinute•1h ago
Write your own books.
Make your own music.
StanislavPetrov•38m ago
__MatrixMan__•1h ago
TheRoque•1h ago
jazz9k•44m ago
krapp•37m ago
I mean, Nazis have always been attracted to punk because they like the loud noise but are too stupid to understand lyrics, but they tend to get their shit kicked in by punks more often than not. I don't think that's the same thing.