7 ms·

The bill does not require face scans nor anything similar. The author of this article wrote another piece claiming that AB 2773 would boost companies that provi

by _23sd 4y ago

The bill does not require face scans nor anything similar. The author of this article wrote another piece claiming that AB 2773 would boost companies that provide age verification products, and someone from a trade group representing age verification providers showed up in the comments to defend their products and used face scans as an example of a method that protects your identity (why they thought that was a good example is a mystery). This is the relevant text in the bill: >Estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202120220AB2273 https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml...

walterbell 4y ago
How do the legislation authors expect complying companies to "estimate the age" of internet visitors? Would driver's licenses and other state IDs be considered acceptable? Would website publishers be required to store those records? If so, does this practically mean that websites would contract with third party age-estimation services which do store state-identity records? What's the track record of such vendors with data protection? Can the state provide age verification services directly, since they are already trusted with the data?
- deleted 4y ago
  [deleted]
- _23sd 4y ago
  From what I can see in the bill, storing personal information collected to determine age is specifically not allowed. The specifics of how to implement the actions specified are left up to a "California Children’s Data Protection Working Group" that would prepare a report on best practices. So probably it depends on whether the age verification providers get to influence that committee to the exclusion of the rest of the industry.
  - cryptonector 4y ago
    What are the chances?
  - bruce511 4y ago
    I feel like you are being down-voted for reporting what is in the bill, which seems like a poor use for a vote. I don't see any replies disputing your reading of the bill, and I'm not sure you are saying that this is a good bill for these reasons.
cryptonector 4y ago
Presumably those age verification providers are lobbying for this bill. And maybe a state agency will issue a regulation that facial recognition will be required?
- _23sd 4y ago
  The facial recognition thing seems unlikely to me, nobody likes it except tech companies that want a magic AI to solve their compliance problems. If you care about privacy then biometrics is a no-go, if not then actual ID verification is more accurate. The point is that facial recognition is not the actual requirement, anyone trying to tell you it’s the requirement is probably trying to sell you a facial recognition system (and the author of the article fell for it).
  - mlyle 4y ago
    > The point is that facial recognition is not the actual requirement The requirement is doing something horribly invasive to determine age. We all know it doesn't have to be facial recognition (though this is probably cheapest and least invasive, even though it's still gross). It's also worth noting that while the bill prohibits entities with significant child audiences from retaining the information, it doesn't appear to extend that limitation to service providers providing age verification services.
    - _23sd 4y ago
      The requirement is to do something to estimate the age of users, nowhere does it say that would always need to be more invasive than asking the user if they're over 18. If we do all know that it doesn't have to be facial recognition that's great, but the title of the post suggested that the law requires you to "scan your face on every website" and I was taking issue with that.
      - mlyle 4y ago
        > The requirement is to do something to estimate the age of users, nowhere does it say that would always need to be more invasive than asking the user if they're over 18. No, it doesn't say that it would always need to be more invasive than that. I doubt a prompt asking the age would generally be seen as "Estimate the age of child users with a reasonable level of certainty..." Having to deal with invasive means of validating your age is a reasonably anticipatable consequence of this law. And it shouldn't be a big surprise that the data ends up misused, even if the law makes a token (very weak) effort to prohibit that.
akira2501 4y ago
> Estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers I'm hearing that as "wave a magic wand that costs way too much per shake and hope the magic is strong enough that you don't get sued in one of three different ways." It gets even more abiguous: > Configure all default privacy settings provided to children by the online service, product, or feature to settings that offer a high level of privacy, unless the business can demonstrate a compelling reason that a different setting is in the best interests of children. How are we defining "high level of privacy?" The text seems to imply just the "highest setting you have available." And all of this hinging on if a child is "likely" to access the service in any way.

by _23sd 4y ago

walterbell 4y ago

How do the legislation authors expect complying companies to "estimate the age" of internet visitors? Would driver's licenses and other state IDs be considered acceptable? Would website publishers be required to store those records? If so, does this practically mean that websites would contract with third party age-estimation services which do store state-identity records? What's the track record of such vendors with data protection? Can the state provide age verification services directly, since they are already trusted with the data?

deleted 4y ago
[deleted]
_23sd 4y ago
From what I can see in the bill, storing personal information collected to determine age is specifically not allowed. The specifics of how to implement the actions specified are left up to a "California Children’s Data Protection Working Group" that would prepare a report on best practices. So probably it depends on whether the age verification providers get to influence that committee to the exclusion of the rest of the industry.
- cryptonector 4y ago
  What are the chances?
- bruce511 4y ago
  I feel like you are being down-voted for reporting what is in the bill, which seems like a poor use for a vote. I don't see any replies disputing your reading of the bill, and I'm not sure you are saying that this is a good bill for these reasons.

cryptonector 4y ago

Presumably those age verification providers are lobbying for this bill. And maybe a state agency will issue a regulation that facial recognition will be required?

_23sd 4y ago
The facial recognition thing seems unlikely to me, nobody likes it except tech companies that want a magic AI to solve their compliance problems. If you care about privacy then biometrics is a no-go, if not then actual ID verification is more accurate. The point is that facial recognition is not the actual requirement, anyone trying to tell you it’s the requirement is probably trying to sell you a facial recognition system (and the author of the article fell for it).
- mlyle 4y ago
  > The point is that facial recognition is not the actual requirement The requirement is doing something horribly invasive to determine age. We all know it doesn't have to be facial recognition (though this is probably cheapest and least invasive, even though it's still gross). It's also worth noting that while the bill prohibits entities with significant child audiences from retaining the information, it doesn't appear to extend that limitation to service providers providing age verification services.
  - _23sd 4y ago
    The requirement is to do something to estimate the age of users, nowhere does it say that would always need to be more invasive than asking the user if they're over 18. If we do all know that it doesn't have to be facial recognition that's great, but the title of the post suggested that the law requires you to "scan your face on every website" and I was taking issue with that.
    - mlyle 4y ago
      > The requirement is to do something to estimate the age of users, nowhere does it say that would always need to be more invasive than asking the user if they're over 18. No, it doesn't say that it would always need to be more invasive than that. I doubt a prompt asking the age would generally be seen as "Estimate the age of child users with a reasonable level of certainty..." Having to deal with invasive means of validating your age is a reasonably anticipatable consequence of this law. And it shouldn't be a big surprise that the data ends up misused, even if the law makes a token (very weak) effort to prohibit that.

akira2501 4y ago

> Estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers I'm hearing that as "wave a magic wand that costs way too much per shake and hope the magic is strong enough that you don't get sued in one of three different ways." It gets even more abiguous: > Configure all default privacy settings provided to children by the online service, product, or feature to settings that offer a high level of privacy, unless the business can demonstrate a compelling reason that a different setting is in the best interests of children. How are we defining "high level of privacy?" The text seems to imply just the "highest setting you have available." And all of this hinging on if a child is "likely" to access the service in any way.