4 ms·

> a measure certain to seriously restrict free speech and privacy online for _everyone_ . I'm not saying I like KOSA, but my reading is it explicitly does not

> a measure certain to seriously restrict free speech and privacy online for _everyone_ . I'm not saying I like KOSA, but my reading is it explicitly does not apply to adult-only services (who make reasonable steps to enforce this). If, for example, WhatsApp split into an "open network" and a "verified 18+ network" then the latter would be ok for KOSA even if the latter is used for general chat and not just porn and sexting. It would even be a start if they enforced the, mostly theoretical, 13 lower age limit for meta products. (Lest anyone think this is unrealistic, in Israel there are already separate phones and services only for the ultra-orthodox, so they don't encounter anything "unholy" there.) (And fetlife will probably carry on as usual.) Personally, I wish more of the reaction to unreasonable "think of the children" plans would be to reply with reasonable plans. If the choice is between doing too much and doing nothing at all, we'll end up with too much somewhere down the line.

ndriscoll 2y ago
My reading is they don't even need to verify age. The bill refers to users the platform "knows or reasonably should know is a minor" all over the place, and has a bit about a feasibility study for age verification (which can, of course, be done in a privacy preserving way). Unless I missed a particular sentence that didn't include that language, it seems that it's more that if the user tells you their age, or if you are a giant advertising company that stalks everyone in the world to build profiles on them and you determine through your nefarious activities that someone is a child, then you need to take that into account. If you don't collect information on your users, then you don't know they are minors. The main sticking point is probably (some) games and child focused spaces where perhaps you should reasonably assume they are. Basically, they need rules that even the likes of 4chan have enforced for decades: mention being underage, or being in high school, etc.? Banned (or in these cases, set to child mode).
saurik 2y ago
To build a verified 18+ network inherently requires undermining some privacy to determine, as you are now collecting ID from all of the users of your (e.g.) fetlife platform. The responsibility and liability should be with parents to prevent their kids from using platforms for which they are not legally old enough, not with the service provider. (Note that I'm not saying this bill requires age verification, nor that it doesn't: I am merely responding to the suggestion to build "verified 18+ networks" as a way of easily being compliant.)
- ndriscoll 2y ago
  It does not inherently require the network to know anything more than "over 18". It does not require an age verification oracle to know anything other than "requested verification", and even that can be done only once so the oracle doesn't know how many times you provided that verification to someone. See e.g. digital IDs/driver's licenses.
  - saurik 2y ago
    Sure: if we believe that having a giant third-party in the sky that does verification of users itself a giant privacy violation that the web currently doesn't require us to subject ourselves to--and if we also believe that the information they collect won't be invasive, particularly when dealing with an international context--I absolutely agree that we can then use various cryptographic schemes to protect our information from the provider. However, I certainly don't believe that: I believe that having a giant centralized verification service is inherently dangerous in a world where we are apparently reliant on inanity like CrowdStrike to feel a sense of security; and, in fact, there was even just recently a big hack of an identity provider company. https://www.eff.org/deeplinks/2024/06/hack-age-verification-company-shows-privacy-danger-social-media-laws https://www.eff.org/deeplinks/2024/06/hack-age-verification-...
    - ndriscoll 2y ago
      You don't need a centralized service. In the US, individual states are adopting[0] the ISO 18013-5 mDL standard, for example, which allows each state to be authoritative on identity information for its residents (or, if I understand it correctly, something like "isOver18" signed attributes). [0] https://www.mdlconnection.com/implementation-tracker-map/ https://www.mdlconnection.com/implementation-tracker-map/
    - tzs 2y ago
      The "giant centralized verification service" can be some entity that already has your information such as your government.
- 2y ago

ndriscoll 2y ago

My reading is they don't even need to verify age. The bill refers to users the platform "knows or reasonably should know is a minor" all over the place, and has a bit about a feasibility study for age verification (which can, of course, be done in a privacy preserving way). Unless I missed a particular sentence that didn't include that language, it seems that it's more that if the user tells you their age, or if you are a giant advertising company that stalks everyone in the world to build profiles on them and you determine through your nefarious activities that someone is a child, then you need to take that into account. If you don't collect information on your users, then you don't know they are minors. The main sticking point is probably (some) games and child focused spaces where perhaps you should reasonably assume they are. Basically, they need rules that even the likes of 4chan have enforced for decades: mention being underage, or being in high school, etc.? Banned (or in these cases, set to child mode).

saurik 2y ago

To build a verified 18+ network inherently requires undermining some privacy to determine, as you are now collecting ID from all of the users of your (e.g.) fetlife platform. The responsibility and liability should be with parents to prevent their kids from using platforms for which they are not legally old enough, not with the service provider. (Note that I'm not saying this bill requires age verification, nor that it doesn't: I am merely responding to the suggestion to build "verified 18+ networks" as a way of easily being compliant.)

ndriscoll 2y ago
It does not inherently require the network to know anything more than "over 18". It does not require an age verification oracle to know anything other than "requested verification", and even that can be done only once so the oracle doesn't know how many times you provided that verification to someone. See e.g. digital IDs/driver's licenses.
- saurik 2y ago
  Sure: if we believe that having a giant third-party in the sky that does verification of users itself a giant privacy violation that the web currently doesn't require us to subject ourselves to--and if we also believe that the information they collect won't be invasive, particularly when dealing with an international context--I absolutely agree that we can then use various cryptographic schemes to protect our information from the provider. However, I certainly don't believe that: I believe that having a giant centralized verification service is inherently dangerous in a world where we are apparently reliant on inanity like CrowdStrike to feel a sense of security; and, in fact, there was even just recently a big hack of an identity provider company. https://www.eff.org/deeplinks/2024/06/hack-age-verification-company-shows-privacy-danger-social-media-laws https://www.eff.org/deeplinks/2024/06/hack-age-verification-...
  - ndriscoll 2y ago
    You don't need a centralized service. In the US, individual states are adopting[0] the ISO 18013-5 mDL standard, for example, which allows each state to be authoritative on identity information for its residents (or, if I understand it correctly, something like "isOver18" signed attributes). [0] https://www.mdlconnection.com/implementation-tracker-map/ https://www.mdlconnection.com/implementation-tracker-map/
  - tzs 2y ago
    The "giant centralized verification service" can be some entity that already has your information such as your government.
2y ago