4 ms·

Yes, this isn't the right solution. The power needs to be given to the users. A better solution is more robust device management, with control given to the dev

Yes, this isn't the right solution. The power needs to be given to the users. A better solution is more robust device management, with control given to the device owner (read: the parent). The missing legislative piece is mandating that social media companies need to respond differently when the user agent tells them what to send. I should be able to take my daughter's phone (which I own), set an option somewhere that indicates "this user is a minor," and with every HTTP request it makes it sets e.g. an OMIT_ADULT_CONTENT header. Site owners simply respond differently when they see this.

notsound 3y ago
Another option that allows for better privacy and versatility is the website setting a MIN_USER_AGE header based on IP geolocation.
- Terr_ 3y ago
  Geolocation to that degree not that reliable and not necessarily 1:1 with jurisdiction or parental intent. If we're already trusting a parental-locked device to report minor-status, then it's trivial to also have it identify what jurisdiction/ruleset exists, or some finer-grained model of what shouldn't work. In either case, we have the problem of how to model things like "in the Flub province of the nation of Elbonia children below 150.5 months may not see media containing exposed ankles". OK, maybe not quite that bad, but the line needs to be drawn somewhere.
Terr_ 3y ago
Exactly, any design for this stuff requires parental-involvement because every approach without it is either (A) uselessly-weak or (B) creepy-Orwellian. If we assume parents are involved enough to "buy the thingy that advertises a parental lock", then a whole bunch of less-dumb options become available... And more of the costs of the system will be borne by the people (or at least groups) that are utilizing it.
cmiles74 3y ago
Emancipation of children is also a thing, where a minor may petition the court to be treated as an adult. This also falls afoul of a blanket age restriction. https://jeannecolemanlaw.com/the-legal-emancipation-of-minors-under-florida-statutory-law/ https://jeannecolemanlaw.com/the-legal-emancipation-of-minor...
- FireBeyond 3y ago
  I think there's an ambiguity here. Even on this page, talking about "for all purposes". This seems to mostly refer to parental decision making and rights. i.e. even as an emancipated minor, being treated as a "legal adult" does not mean you can buy alcohol or tobacco.
  - selectodude 3y ago
    Being an actual legal adult does not mean that you can buy alcohol or tobacco.
  - cmiles74 3y ago
    Understood, but being emancipated could mean that you need to be able to used LinkedIn, perhaps as part of a job search. An argument could be made that an emancipated minor should have access to some social media.
PH95VuimJjqBqy 3y ago
then propose the RFC. I haven't read the legislation myself but I don't see why this couldn't still be done, I doubt the legislation specified _how_ to do it.
- Izkata 3y ago
  > "Reasonable age verification method" means any commercially reasonable method regularly used by government agencies or businesses for the purpose of age and identity verification. So no, that wouldn't work right now.
cesarb 3y ago
Sounds like you want PICS (though it works on the opposite direction, with the web site sending the flag, and the browser deciding whether to show the content based on it).
basil-rash 3y ago
Already exists, simply include the header Rating: RTA-5042-1996-1400-1577-RTA in HTTP responses that include adult content, and every parental controls software in existence will block it by default, including the ones built into iPhones/etc and embedded webviews. As far as I know all mainstream adult sites include this (or the equivalent meta tag) already. In general, I don’t think communicating to every site you visit that you are a minor and asking them to do what they will with that information is a good idea. Better to filter on the user’s end.
- JeremyNT 3y ago
  I honestly wasn't aware of this, and it sounds like a great solution for "adult content." Certainly, the site specifying this is better than the user agent having to reveal any additional details about its configuration.
- pdpi 3y ago
  That's a much better approach in general. It's much easier to regulate and enforce that websites must expose these headers so that UAs can do their own filtering. Adult Content = headers in response, no ifs, ands, or buts Response headers are encrypted in the context of HTTPS, so there's no real sacrifice in privacy. Implementation effort about as close to trivial as can be. No real free speech implications (unless you really want to argue that those headers constitute compelled speech). All in all, it's a pretty decent solution.
- joshyeetbox 3y ago
  This is not a response header. It's a meta tag that's added to a websites head element to indicate it's not kid friendly. The individual payloads returned from an adult site don't include this as a header.
  - basil-rash 3y ago
    That'd be the "equivalent meta tag" I mentioned. And this site claims the header works too, though I haven't tested it myself. https://davidwalsh.name/rta-label https://davidwalsh.name/rta-label

notsound 3y ago

Another option that allows for better privacy and versatility is the website setting a MIN_USER_AGE header based on IP geolocation.

Terr_ 3y ago
Geolocation to that degree not that reliable and not necessarily 1:1 with jurisdiction or parental intent. If we're already trusting a parental-locked device to report minor-status, then it's trivial to also have it identify what jurisdiction/ruleset exists, or some finer-grained model of what shouldn't work. In either case, we have the problem of how to model things like "in the Flub province of the nation of Elbonia children below 150.5 months may not see media containing exposed ankles". OK, maybe not quite that bad, but the line needs to be drawn somewhere.

Terr_ 3y ago

Exactly, any design for this stuff requires parental-involvement because every approach without it is either (A) uselessly-weak or (B) creepy-Orwellian. If we assume parents are involved enough to "buy the thingy that advertises a parental lock", then a whole bunch of less-dumb options become available... And more of the costs of the system will be borne by the people (or at least groups) that are utilizing it.

cmiles74 3y ago

Emancipation of children is also a thing, where a minor may petition the court to be treated as an adult. This also falls afoul of a blanket age restriction. https://jeannecolemanlaw.com/the-legal-emancipation-of-minors-under-florida-statutory-law/ https://jeannecolemanlaw.com/the-legal-emancipation-of-minor...

FireBeyond 3y ago
I think there's an ambiguity here. Even on this page, talking about "for all purposes". This seems to mostly refer to parental decision making and rights. i.e. even as an emancipated minor, being treated as a "legal adult" does not mean you can buy alcohol or tobacco.
- selectodude 3y ago
  Being an actual legal adult does not mean that you can buy alcohol or tobacco.
- cmiles74 3y ago
  Understood, but being emancipated could mean that you need to be able to used LinkedIn, perhaps as part of a job search. An argument could be made that an emancipated minor should have access to some social media.

PH95VuimJjqBqy 3y ago

then propose the RFC. I haven't read the legislation myself but I don't see why this couldn't still be done, I doubt the legislation specified _how_ to do it.

Izkata 3y ago
> "Reasonable age verification method" means any commercially reasonable method regularly used by government agencies or businesses for the purpose of age and identity verification. So no, that wouldn't work right now.

cesarb 3y ago

Sounds like you want PICS (though it works on the opposite direction, with the web site sending the flag, and the browser deciding whether to show the content based on it).

basil-rash 3y ago

Already exists, simply include the header Rating: RTA-5042-1996-1400-1577-RTA in HTTP responses that include adult content, and every parental controls software in existence will block it by default, including the ones built into iPhones/etc and embedded webviews. As far as I know all mainstream adult sites include this (or the equivalent meta tag) already. In general, I don’t think communicating to every site you visit that you are a minor and asking them to do what they will with that information is a good idea. Better to filter on the user’s end.

JeremyNT 3y ago
I honestly wasn't aware of this, and it sounds like a great solution for "adult content." Certainly, the site specifying this is better than the user agent having to reveal any additional details about its configuration.
pdpi 3y ago
That's a much better approach in general. It's much easier to regulate and enforce that websites must expose these headers so that UAs can do their own filtering. Adult Content = headers in response, no ifs, ands, or buts Response headers are encrypted in the context of HTTPS, so there's no real sacrifice in privacy. Implementation effort about as close to trivial as can be. No real free speech implications (unless you really want to argue that those headers constitute compelled speech). All in all, it's a pretty decent solution.
joshyeetbox 3y ago
This is not a response header. It's a meta tag that's added to a websites head element to indicate it's not kid friendly. The individual payloads returned from an adult site don't include this as a header.
- basil-rash 3y ago
  That'd be the "equivalent meta tag" I mentioned. And this site claims the header works too, though I haven't tested it myself. https://davidwalsh.name/rta-label https://davidwalsh.name/rta-label