I'm fine with age assurance. If you're under 13, you go to the post office to prove that you're under 13, they digitally sign some token on your phone, and the

I'm fine with age assurance. If you're under 13, you go to the post office to prove that you're under 13, they digitally sign some token on your phone, and then your access is restricted according to the law. If you are an adult who wishes to remain anonymous, take no action. Problem solved! It would be interesting to see how the reverse of this system is implemented; adults must prove they're adults before being able to access certain websites. What technical measures would allow this? Information can leak in HTTP requests and responses, i.e. "curl -H 'User-Agent: help me i am trapped at the bottom of the ocean' https://example.com https://example.com" before any authentication has taken place. Is an adult allowed to send that request to a child? Probably not! This would mean the system has to be implemented at a lower level layer; websites would only be served on private IP ranges, and you'd have to setup an IPSec tunnel or similar first to prevent that out-of-band leakage. (You can get more absurd; everyone has a /64 of IPv6 space for themselves, so you can use your source address as a form of intentional information leakage; 1:2:3:4::1234 is a 1, 1:2:3:4::4321 is a 0. This means that, legally, you would have to be careful about how you do the TCP 3 way handshake, because, as a middlebox, you can't prove that sending a SYN in reply to a SYN is not actually someone requesting adult content.) All in all, this seems technically impossible to implement, prone to making identity theft even more lucrative than it already is (don't reuse your ID.me password anywhere else, or some kid is going to use it to cheat in a video game and get you sent to jail a la South Korea), and unconstitutional ("prior restraint").