5 ms·

“ Requires social media platforms to use reasonable age verification methods to verify the ages of account holders and disclose specified policies and provide s

by yibg 3y ago

“ Requires social media platforms to use reasonable age verification methods to verify the ages of account holders and disclose specified policies and provide specified resources, measures and disclaimers.” Problem here is what is considered “reasonable”? And how to do so without privacy issues.

lolinder 3y ago
The actual text of the bill lays out exactly what is "reasonable"—any website affected by the terms of this bill must offer an anonymous age verification option, with very specific requirements including that they not retain PII after verification is complete: > A third party conducting age verification pursuant to ss. 501.1736 and 501.1737: > (a) May not retain personal identifying information used to verify age once the age of an account holder or a person seeking an account has been verified. https://www.flsenate.gov/Session/Bill/2024/1/BillText/er/PDF https://www.flsenate.gov/Session/Bill/2024/1/BillText/er/PDF
- kohbo 3y ago
  It will be less than a decade until there is news of a massive data breach where one of the affected companies improperly stored PII.
  - lolinder 3y ago
    While I don't discount the possibility of a service screwing this up (I've been in the industry long enough to know that they will), the bill at least tries to address this by requiring that there be zero retention of age-identifying PII once the age has been verified.
    - guiambros 3y ago
      That's the problem with age verification. As it stands, someone, somewhere, will certainly retain the information. Either because they want to intentionally track users (irrespective of the law saying otherwise), or unintentionally ("Oops, I thought this S3 bucket would be deleted automatically"). And, as always, the law will skew towards appearance of compliance rather than enforcement (GDPR-style), so if this goes through, you'll soon be asked to upload your driver's license to any random website.
    - mmanfrin 3y ago
      Is not the identification that someone is of age potentially defined by this?
  - chrisjj 3y ago
    Or leaked it without storing it.
  - tzs 3y ago
    That can be addressed by using a three party age verification system, where the three parties are the social media site that wants to know you are above the age limit, the site that you provide proof of your identity and age to, and you. With a properly designed protocol you can do this in such a way that (1) the social media site gets no information about you other than that you are old enough, and (2) the site your prove your identity and age to only gets whatever documents you provide and does not learn which social media site the proof is for. That covers data breaches at the social media sites. They never see the PII for age verification. The way to deal with the possibility of a breach at the site that does see your documents is to use a site that already have copies of those documents, such as a government agency or maybe a bank.
  - red-iron-pine 3y ago
    give it 3-5 years, tops. probably not a big player directly, but a 2nd line aggregator or value-add company.
- rented_mule 3y ago
  > (a) May not retain personal identifying information used to verify age once the age of an account holder or a person seeking an account has been verified. That's good for the people being verified. But it means the companies can't retain proof that they did, in fact, verify age. So how do companies accused of this defend themselves, especially if they're in the right? That's a bit scary in a state where the governor used his power to retaliate against the largest employer in the state for expressing their view of a law that affects their employees.
Talanes 3y ago
It's also going to lock out people who are well over 16 and just can't get past the verification. Like my dad: a 52 year old man who uses social media profusely, but straight up does not own a device with a working camera on it. The year that the IRS was requiring ID verification he was prepared to just give up on filing his taxes until I came over to upload everything for him.

by yibg 3y ago

lolinder 3y ago

The actual text of the bill lays out exactly what is "reasonable"—any website affected by the terms of this bill must offer an anonymous age verification option, with very specific requirements including that they not retain PII after verification is complete: > A third party conducting age verification pursuant to ss. 501.1736 and 501.1737: > (a) May not retain personal identifying information used to verify age once the age of an account holder or a person seeking an account has been verified. https://www.flsenate.gov/Session/Bill/2024/1/BillText/er/PDF https://www.flsenate.gov/Session/Bill/2024/1/BillText/er/PDF

kohbo 3y ago
It will be less than a decade until there is news of a massive data breach where one of the affected companies improperly stored PII.
- lolinder 3y ago
  While I don't discount the possibility of a service screwing this up (I've been in the industry long enough to know that they will), the bill at least tries to address this by requiring that there be zero retention of age-identifying PII once the age has been verified.
  - guiambros 3y ago
    That's the problem with age verification. As it stands, someone, somewhere, will certainly retain the information. Either because they want to intentionally track users (irrespective of the law saying otherwise), or unintentionally ("Oops, I thought this S3 bucket would be deleted automatically"). And, as always, the law will skew towards appearance of compliance rather than enforcement (GDPR-style), so if this goes through, you'll soon be asked to upload your driver's license to any random website.
  - mmanfrin 3y ago
    Is not the identification that someone is of age potentially defined by this?
- chrisjj 3y ago
  Or leaked it without storing it.
- tzs 3y ago
  That can be addressed by using a three party age verification system, where the three parties are the social media site that wants to know you are above the age limit, the site that you provide proof of your identity and age to, and you. With a properly designed protocol you can do this in such a way that (1) the social media site gets no information about you other than that you are old enough, and (2) the site your prove your identity and age to only gets whatever documents you provide and does not learn which social media site the proof is for. That covers data breaches at the social media sites. They never see the PII for age verification. The way to deal with the possibility of a breach at the site that does see your documents is to use a site that already have copies of those documents, such as a government agency or maybe a bank.
- red-iron-pine 3y ago
  give it 3-5 years, tops. probably not a big player directly, but a 2nd line aggregator or value-add company.
rented_mule 3y ago
> (a) May not retain personal identifying information used to verify age once the age of an account holder or a person seeking an account has been verified. That's good for the people being verified. But it means the companies can't retain proof that they did, in fact, verify age. So how do companies accused of this defend themselves, especially if they're in the right? That's a bit scary in a state where the governor used his power to retaliate against the largest employer in the state for expressing their view of a law that affects their employees.

Talanes 3y ago

It's also going to lock out people who are well over 16 and just can't get past the verification. Like my dad: a 52 year old man who uses social media profusely, but straight up does not own a device with a working camera on it. The year that the IRS was requiring ID verification he was prepared to just give up on filing his taxes until I came over to upload everything for him.