5 ms·

> government passes law that requires companies to age verify users > said government provides no way to actually verify a human's age > hilarity ensues

by jhgg 1y ago

brogufaw 1y ago
It’s intentional to give them wiggle room to define truth as needed case by case. Not saying it’s good or bad. Just that it’s intentional.
- Culonavirus 1y ago
  My bank has an API endpoint that (basically) returns your name and age (in this use case). It can return more for signing electronic docs etc. and is basically your digital ID. https://en.wikipedia.org/wiki/BankID https://en.wikipedia.org/wiki/BankID Need to buy "toys", vape products, alcohol... anything adult online? There's a 3rd party web app (you rightfully don't trust) as an age check in the shopping cart / user account of any of these adult shops, and this has multiple ways of verifying your age - and one of them is the bank's api, you pick it, your bank's identity sharing page loads, you log in, it shows exactly what information will be shared in a bullet point list, you tap OK, immediately a request like "this app wants to know your age, please verify" pops up in your smart banking app on your phone, you tap ok, fingerprint scan, DONE. Problem solved. The 3rd party app knows just what it needs to. All of this takes maybe a minute and your personal info is perfectly safe (unless you don't trust your bank at which point you have bigger problems to worry about...)
  - cronin101 1y ago
    As a Brit that relocated to Norway a decade ago, trust me when I say you cannot fathom the lack of organization around identity that the UK (somewhat intentionally) has. (It’s constantly used for political Godwin’s-law fear-mongering) There is no centralized ID number, the closest is your social security number but this is basically only outbound for PAYE tax and haphazardly correlated to your pension payments in late life. Everything operates on a “trust system” where you often present paper (!) with whatever address you claim to be living at as proof you are real (e.g. opening bank accounts). Passport loss is rectified by seeking out “professionals” with government-approved occupations that are not related to you that can vouch you are actually the person you are trying to replace a passport for. The entire thing is a mess and living in digital-identity-native Europe is a dream come true that you should be extremely thankful for.
    - jonathantf2 1y ago
      B-but... if we have an ID card the "government" will be able to track us! /s It does annoy me how much people get away with scaremongering, I just read a comment of someone who's against digital payments because "then the government will be able to work out how much tax you owe"????
    - The-Old-Hacker 1y ago
      The mess around voter ID is a case in point. A badly-implemented "solution" to a problem that didn't exist.
    - gambiting 1y ago
      >>There is no centralized ID number, the closest is your social security number Until you find out that due to a cock up years ago the National Insurance numbers are not guaranteed to be unique, and you realize that somehow the best proof of identity British people have is a humble driving licence because DVLA is at least somewhat competent.
      - pasc1878 1y ago
        Unfortunately I don't have a driving license as I am physically unable to get one by law.
    - vidarh 1y ago
      It's even worse now: A lot of places now accept PDF's of things like bank statements, since so many people don't get paper copies any more. It's not that it was hard to fake before if you wanted to, but when you can just get a real PDF as a starting point, and edit it slightly it's just theatre.
      - astrange 1y ago
        It doesn't have to be perfect. This is how financial regulation works in the US too, but it does work. The idea is that every individual step is weak, but it's a crime to bypass any of it. So the deterrence is you can catch things probabilistically and most people don't want to commit a whole bunch of crimes at once because they all have individual punishments.
  - dfghjk4 1y ago
    Identity shouldn’t be tied to a private institution that requires you to have a bank account to login. Two of the well-used solutions to identity in the U.S. are login.gov (government-managed) and id.me (private, but used by government). Basically to get setup, at some point you have to have physical presence to get an actual government-approved physical ID, which can still be a barrier to some, but it doesn’t require a bank account. Just don’t implement your own like Discourse and Tea.app.
    - hnthrowaway7483 1y ago
      > Discourse Another victim of auto-correct!
    - masklinn 1y ago
      > Just don’t implement your own like Discourse and Tea.app. FWIW discord did not implement their own (sensibly), but since the british government does not provide this service it basically mandates possibly dodgy middlemen. My understanding is that discord uses (contracted?) https://www.k-id.com/ https://www.k-id.com/
    - close04 1y ago
      Whether it’s a government controlled or private identity provider which can or has to provide data to the government, in the end it’s still the perfect way to control what people do online. It’s age restricted stuff at first, but can just as well be applied to any store or social media. Not so eager to express your dissent if it has your name stapled to it.
    - deleted 1y ago
      [deleted]
    - morkalork 1y ago
      >Identity shouldn’t be tied to a private institution This right here. Just look at what happened with visa/mastercard this week, private institutions can and will cave to special interest groups advocating to block access to legal content.
  - W3zzy 1y ago
    This is the way. Belgian banks joined forces years ago to create such a platform for identity verification and private companies can get granular acces when needed and after they are vetted. It's all based on the 2014 eIDAS regulation. https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS
W3zzy 1y ago
Actually, they could release a platform quite easily that only delivers age verification, without anything else. For example, our id's have a qr on it that contains some basic info. Why not provide a platform for age checks with that qr? Anyway, fuck them. Education goes a lot further than trying to force identity verification on private companies when there is no real life threat in play.
cedws 1y ago
That's exactly what pisses me off about it. The government could have at least devised a technical solution to verify the age of people privately. Data breaches happen all the time, do they just not care about the consequences when millions of peoples' porn watching habits are inevitably leaked?
- progbits 1y ago
  Because that's their goal. Make you scared about using things that are even legal but private/embarrassing.
  - Telemakhos 1y ago
    It's a great first step toward making criticism of the government scary. Porn, hate speech, and other "legal but private/embarrassing" speech are the sharp end of the spear. When it's okay to restrict those, it becomes more easier to restrict political opposition.
    - immibis 1y ago
      Hate speech is only "legal but embarrassing" in the USA. Almost everywhere else it's illegal.
      - nxm 1y ago
        And therefore no where else does one actually have free speech
        immibis 1y ago
        Nowhere but the USA has free speech extremism.
    - astrange 1y ago
      Nobody in the UK cares about "criticism of the government". That's a paranoid concept that only makes sense in a presidential system like the US. In Westminster systems you can kick out the government all you want and often do. The point of the constitutional monarchy is to separate the people you "shouldn't criticize" from the people who actually have any power. The reason they're doing this is that British people hate themselves, hate their children, and the purpose of the country is to take everyone's money and give it to pensioners.
Hamuko 1y ago
EU is also gonna require companies to verify ages but there's a white label application that EU member states can use. https://ageverification.dev/ https://ageverification.dev/ If I've understood it correctly, Pornhub can't see anything except that you've turned 18 (no names, no date of births, nothing) and your local government can't see that you've signed up for Pornhub using the app.
- stavros 1y ago
  Yes, this is correct. As I understand it, the server asks the application some questions ("is the user above 18?" "are they a resident of country X?" or whatever), you confirm that you want to share the answer, and the application just gets "yes" or "no" to each question.
- Xelbair 1y ago
  Yet it is still not a perfect solution. Arguably worse, for possible freedom of speech aspects, than current state. https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-id-wallet https://www.eff.org/deeplinks/2025/04/age-verification-europ...
dom96 1y ago
This really deserves a digital solution. Let me get a government account and generate tokens that websites can ingest to confirm I'm an adult (and other optional details about me). Having to use passports or poor solutions like face scanning isn't good enough. I guess the reason they don't do this is because they fear the cost, anything governments price up these days seems to be in the billion range. So the politicians who don't understand how cheap it is to build software assume it's way out of their price range.
- parsimo2010 1y ago
  When you place all the requirements on a software product like what the government has to, then it’s going to be expensive. Anyone who thinks that the total cost of a privacy protecting, government accredited, widely available, reliable, audited, and domestically produced age verification system isn’t going to be in the hundreds of millions has never actually shipped something comparable. It is literally illegal to slap a few lines of glue code and say “there’s your age verification, look how cheap it is.” The public would be happy about saving money right up until there’s a massive privacy breach and all the ways you cut corners are exposed. I don’t know if leaving the standards unspecified is the right thing to do (it’s probably not), but don’t pretend like a government verified solution could ever be cheap when dealing with citizens’ identities.
  - criley2 1y ago
    I disagree. This is exactly what happened with the initial launch of Healthcare.gov after the Affordable Care Act. The government spent hundreds of millions contracting a large firm that completely botched the site, it couldn't even handle a few hundred users at launch. Then a small team of highly skilled engineers from Google/Facebook etc were brought in to fix it. They stabilized and relaunched the system in weeks at a fraction of the original cost. It showed that the problem wasn't the complexity or the standards, it was how the project was managed and who was building it.
    - zdragnar 1y ago
      IIRC, it wasn't even that it contracted one firm, it contracted many, and the individual contracts were managed separately. None of the systems were actually required to work with each other in letter, only in spirit. The major advantage of bringing in the engineers (only one ex-googler, most were oracle and redhat, again IIRC) was that they were all already bigwigs and knew how to take ownership of large systems, and were given the authority to do so.
2OEH8eoCRo0 1y ago
Why should the govt provide a way to verify? They should fine companies that violate. Companies will figure how to comply because they don't want to be fined.
- vidarh 1y ago
  The problem is that said companies have no interest in doing more than the barest minimum to keep the details safe.
- DaSHacka 1y ago
  Because then you get situations like OP and that happened with Tea?
skybrian 1y ago
The Apple and Google wallet apps have ways to add your id, but the web apis aren’t widely available yet. Here’s Google’s doc: https://developers.google.com/wallet/identity/verify/accepting-ids-from-wallet-online https://developers.google.com/wallet/identity/verify/accepti... Looks like it will support zero knowledge proofs?
- MBCook 1y ago
  A ton of states also don’t support it. I, for example, couldn’t add my driver’s license even if I wanted to.
  - skybrian 1y ago
    Yeah, it's more about the future. Maybe in a year or three, you'll be able to write a website that does age verification using a standard web API, without processing any identity documents yourself, and expect it to work. And sometimes kids will put fake ID's on their phones, or borrow a phone, but that's not your problem.
anon-3988 1y ago
Don't worry, they just need another inch of your privacy and freedom to verify that you are you C: Everyone that have worked on passwordless authentication is ultimately responsible for this death of internet anonymity.

> government passes law that requires companies to age verify users > said government provides no way to actually verify a human's age > hilarity ensues

by jhgg 1y ago

> government passes law that requires companies to age verify users > said government provides no way to actually verify a human's age > hilarity ensues

brogufaw 1y ago

It’s intentional to give them wiggle room to define truth as needed case by case. Not saying it’s good or bad. Just that it’s intentional.

Culonavirus 1y ago
My bank has an API endpoint that (basically) returns your name and age (in this use case). It can return more for signing electronic docs etc. and is basically your digital ID. https://en.wikipedia.org/wiki/BankID https://en.wikipedia.org/wiki/BankID Need to buy "toys", vape products, alcohol... anything adult online? There's a 3rd party web app (you rightfully don't trust) as an age check in the shopping cart / user account of any of these adult shops, and this has multiple ways of verifying your age - and one of them is the bank's api, you pick it, your bank's identity sharing page loads, you log in, it shows exactly what information will be shared in a bullet point list, you tap OK, immediately a request like "this app wants to know your age, please verify" pops up in your smart banking app on your phone, you tap ok, fingerprint scan, DONE. Problem solved. The 3rd party app knows just what it needs to. All of this takes maybe a minute and your personal info is perfectly safe (unless you don't trust your bank at which point you have bigger problems to worry about...)
- cronin101 1y ago
  As a Brit that relocated to Norway a decade ago, trust me when I say you cannot fathom the lack of organization around identity that the UK (somewhat intentionally) has. (It’s constantly used for political Godwin’s-law fear-mongering) There is no centralized ID number, the closest is your social security number but this is basically only outbound for PAYE tax and haphazardly correlated to your pension payments in late life. Everything operates on a “trust system” where you often present paper (!) with whatever address you claim to be living at as proof you are real (e.g. opening bank accounts). Passport loss is rectified by seeking out “professionals” with government-approved occupations that are not related to you that can vouch you are actually the person you are trying to replace a passport for. The entire thing is a mess and living in digital-identity-native Europe is a dream come true that you should be extremely thankful for.
  - jonathantf2 1y ago
    B-but... if we have an ID card the "government" will be able to track us! /s It does annoy me how much people get away with scaremongering, I just read a comment of someone who's against digital payments because "then the government will be able to work out how much tax you owe"????
  - The-Old-Hacker 1y ago
    The mess around voter ID is a case in point. A badly-implemented "solution" to a problem that didn't exist.
  - gambiting 1y ago
    >>There is no centralized ID number, the closest is your social security number Until you find out that due to a cock up years ago the National Insurance numbers are not guaranteed to be unique, and you realize that somehow the best proof of identity British people have is a humble driving licence because DVLA is at least somewhat competent.
    - pasc1878 1y ago
      Unfortunately I don't have a driving license as I am physically unable to get one by law.
  - vidarh 1y ago
    It's even worse now: A lot of places now accept PDF's of things like bank statements, since so many people don't get paper copies any more. It's not that it was hard to fake before if you wanted to, but when you can just get a real PDF as a starting point, and edit it slightly it's just theatre.
    - astrange 1y ago
      It doesn't have to be perfect. This is how financial regulation works in the US too, but it does work. The idea is that every individual step is weak, but it's a crime to bypass any of it. So the deterrence is you can catch things probabilistically and most people don't want to commit a whole bunch of crimes at once because they all have individual punishments.
- dfghjk4 1y ago
  Identity shouldn’t be tied to a private institution that requires you to have a bank account to login. Two of the well-used solutions to identity in the U.S. are login.gov (government-managed) and id.me (private, but used by government). Basically to get setup, at some point you have to have physical presence to get an actual government-approved physical ID, which can still be a barrier to some, but it doesn’t require a bank account. Just don’t implement your own like Discourse and Tea.app.
  - hnthrowaway7483 1y ago
    > Discourse Another victim of auto-correct!
  - masklinn 1y ago
    > Just don’t implement your own like Discourse and Tea.app. FWIW discord did not implement their own (sensibly), but since the british government does not provide this service it basically mandates possibly dodgy middlemen. My understanding is that discord uses (contracted?) https://www.k-id.com/ https://www.k-id.com/
  - close04 1y ago
    Whether it’s a government controlled or private identity provider which can or has to provide data to the government, in the end it’s still the perfect way to control what people do online. It’s age restricted stuff at first, but can just as well be applied to any store or social media. Not so eager to express your dissent if it has your name stapled to it.
  - deleted 1y ago
    [deleted]
  - morkalork 1y ago
    >Identity shouldn’t be tied to a private institution This right here. Just look at what happened with visa/mastercard this week, private institutions can and will cave to special interest groups advocating to block access to legal content.
- W3zzy 1y ago
  This is the way. Belgian banks joined forces years ago to create such a platform for identity verification and private companies can get granular acces when needed and after they are vetted. It's all based on the 2014 eIDAS regulation. https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS

W3zzy 1y ago

Actually, they could release a platform quite easily that only delivers age verification, without anything else. For example, our id's have a qr on it that contains some basic info. Why not provide a platform for age checks with that qr? Anyway, fuck them. Education goes a lot further than trying to force identity verification on private companies when there is no real life threat in play.

cedws 1y ago

That's exactly what pisses me off about it. The government could have at least devised a technical solution to verify the age of people privately. Data breaches happen all the time, do they just not care about the consequences when millions of peoples' porn watching habits are inevitably leaked?

progbits 1y ago
Because that's their goal. Make you scared about using things that are even legal but private/embarrassing.
- Telemakhos 1y ago
  It's a great first step toward making criticism of the government scary. Porn, hate speech, and other "legal but private/embarrassing" speech are the sharp end of the spear. When it's okay to restrict those, it becomes more easier to restrict political opposition.
  - immibis 1y ago
    Hate speech is only "legal but embarrassing" in the USA. Almost everywhere else it's illegal.
    - nxm 1y ago
      And therefore no where else does one actually have free speech
      - immibis 1y ago
        Nowhere but the USA has free speech extremism.
  - astrange 1y ago
    Nobody in the UK cares about "criticism of the government". That's a paranoid concept that only makes sense in a presidential system like the US. In Westminster systems you can kick out the government all you want and often do. The point of the constitutional monarchy is to separate the people you "shouldn't criticize" from the people who actually have any power. The reason they're doing this is that British people hate themselves, hate their children, and the purpose of the country is to take everyone's money and give it to pensioners.

Hamuko 1y ago

EU is also gonna require companies to verify ages but there's a white label application that EU member states can use. https://ageverification.dev/ https://ageverification.dev/ If I've understood it correctly, Pornhub can't see anything except that you've turned 18 (no names, no date of births, nothing) and your local government can't see that you've signed up for Pornhub using the app.

stavros 1y ago
Yes, this is correct. As I understand it, the server asks the application some questions ("is the user above 18?" "are they a resident of country X?" or whatever), you confirm that you want to share the answer, and the application just gets "yes" or "no" to each question.
Xelbair 1y ago
Yet it is still not a perfect solution. Arguably worse, for possible freedom of speech aspects, than current state. https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-id-wallet https://www.eff.org/deeplinks/2025/04/age-verification-europ...

dom96 1y ago

This really deserves a digital solution. Let me get a government account and generate tokens that websites can ingest to confirm I'm an adult (and other optional details about me). Having to use passports or poor solutions like face scanning isn't good enough. I guess the reason they don't do this is because they fear the cost, anything governments price up these days seems to be in the billion range. So the politicians who don't understand how cheap it is to build software assume it's way out of their price range.

parsimo2010 1y ago
When you place all the requirements on a software product like what the government has to, then it’s going to be expensive. Anyone who thinks that the total cost of a privacy protecting, government accredited, widely available, reliable, audited, and domestically produced age verification system isn’t going to be in the hundreds of millions has never actually shipped something comparable. It is literally illegal to slap a few lines of glue code and say “there’s your age verification, look how cheap it is.” The public would be happy about saving money right up until there’s a massive privacy breach and all the ways you cut corners are exposed. I don’t know if leaving the standards unspecified is the right thing to do (it’s probably not), but don’t pretend like a government verified solution could ever be cheap when dealing with citizens’ identities.
- criley2 1y ago
  I disagree. This is exactly what happened with the initial launch of Healthcare.gov after the Affordable Care Act. The government spent hundreds of millions contracting a large firm that completely botched the site, it couldn't even handle a few hundred users at launch. Then a small team of highly skilled engineers from Google/Facebook etc were brought in to fix it. They stabilized and relaunched the system in weeks at a fraction of the original cost. It showed that the problem wasn't the complexity or the standards, it was how the project was managed and who was building it.
  - zdragnar 1y ago
    IIRC, it wasn't even that it contracted one firm, it contracted many, and the individual contracts were managed separately. None of the systems were actually required to work with each other in letter, only in spirit. The major advantage of bringing in the engineers (only one ex-googler, most were oracle and redhat, again IIRC) was that they were all already bigwigs and knew how to take ownership of large systems, and were given the authority to do so.

2OEH8eoCRo0 1y ago

Why should the govt provide a way to verify? They should fine companies that violate. Companies will figure how to comply because they don't want to be fined.

vidarh 1y ago
The problem is that said companies have no interest in doing more than the barest minimum to keep the details safe.
DaSHacka 1y ago
Because then you get situations like OP and that happened with Tea?

skybrian 1y ago

The Apple and Google wallet apps have ways to add your id, but the web apis aren’t widely available yet. Here’s Google’s doc: https://developers.google.com/wallet/identity/verify/accepting-ids-from-wallet-online https://developers.google.com/wallet/identity/verify/accepti... Looks like it will support zero knowledge proofs?

MBCook 1y ago
A ton of states also don’t support it. I, for example, couldn’t add my driver’s license even if I wanted to.
- skybrian 1y ago
  Yeah, it's more about the future. Maybe in a year or three, you'll be able to write a website that does age verification using a standard web API, without processing any identity documents yourself, and expect it to work. And sometimes kids will put fake ID's on their phones, or borrow a phone, but that's not your problem.

anon-3988 1y ago

Don't worry, they just need another inch of your privacy and freedom to verify that you are you C: Everyone that have worked on passwordless authentication is ultimately responsible for this death of internet anonymity.