25 ms·

It will be less than a decade until there is news of a massive data breach where one of the affected companies improperly stored PII.

by kohbo 3y ago

lolinder 3y ago
While I don't discount the possibility of a service screwing this up (I've been in the industry long enough to know that they will), the bill at least tries to address this by requiring that there be zero retention of age-identifying PII once the age has been verified.
- guiambros 3y ago
  That's the problem with age verification. As it stands, someone, somewhere, will certainly retain the information. Either because they want to intentionally track users (irrespective of the law saying otherwise), or unintentionally ("Oops, I thought this S3 bucket would be deleted automatically"). And, as always, the law will skew towards appearance of compliance rather than enforcement (GDPR-style), so if this goes through, you'll soon be asked to upload your driver's license to any random website.
- mmanfrin 3y ago
  Is not the identification that someone is of age potentially defined by this?
chrisjj 3y ago
Or leaked it without storing it.
tzs 3y ago
That can be addressed by using a three party age verification system, where the three parties are the social media site that wants to know you are above the age limit, the site that you provide proof of your identity and age to, and you. With a properly designed protocol you can do this in such a way that (1) the social media site gets no information about you other than that you are old enough, and (2) the site your prove your identity and age to only gets whatever documents you provide and does not learn which social media site the proof is for. That covers data breaches at the social media sites. They never see the PII for age verification. The way to deal with the possibility of a breach at the site that does see your documents is to use a site that already have copies of those documents, such as a government agency or maybe a bank.
red-iron-pine 3y ago
give it 3-5 years, tops. probably not a big player directly, but a 2nd line aggregator or value-add company.

It will be less than a decade until there is news of a massive data breach where one of the affected companies improperly stored PII.

by kohbo 3y ago

It will be less than a decade until there is news of a massive data breach where one of the affected companies improperly stored PII.

lolinder 3y ago

While I don't discount the possibility of a service screwing this up (I've been in the industry long enough to know that they will), the bill at least tries to address this by requiring that there be zero retention of age-identifying PII once the age has been verified.

guiambros 3y ago
That's the problem with age verification. As it stands, someone, somewhere, will certainly retain the information. Either because they want to intentionally track users (irrespective of the law saying otherwise), or unintentionally ("Oops, I thought this S3 bucket would be deleted automatically"). And, as always, the law will skew towards appearance of compliance rather than enforcement (GDPR-style), so if this goes through, you'll soon be asked to upload your driver's license to any random website.
mmanfrin 3y ago
Is not the identification that someone is of age potentially defined by this?

chrisjj 3y ago

Or leaked it without storing it.

tzs 3y ago

That can be addressed by using a three party age verification system, where the three parties are the social media site that wants to know you are above the age limit, the site that you provide proof of your identity and age to, and you. With a properly designed protocol you can do this in such a way that (1) the social media site gets no information about you other than that you are old enough, and (2) the site your prove your identity and age to only gets whatever documents you provide and does not learn which social media site the proof is for. That covers data breaches at the social media sites. They never see the PII for age verification. The way to deal with the possibility of a breach at the site that does see your documents is to use a site that already have copies of those documents, such as a government agency or maybe a bank.

red-iron-pine 3y ago

give it 3-5 years, tops. probably not a big player directly, but a 2nd line aggregator or value-add company.