7 ms·

Show HN: Anonymous Age Verification

71 points by jwally 1y ago

So I'm not an expert in this area, but here's an attempt at cost effective, anonymous, age verification flow that probably covers ~70% of use cases in the United States. The basic premise is to leverage your bank (who already has had to perform KYC on you to open an account) to attest to your age for age-restricted merchant sites (pornhub, gambling, etc) without sharing any more information than necessary. Flow works like this: 1) You go to gambling.com 2) They request you to verify your age 3) You choose "Bank Verification" 4) You trigger a WebAuthn Credential Creation flow 5) gambling.com gives you a string to copy ------------- 6) You log into your bank 7) You go to bank.com/age-verify 8) You paste in the string you were given 9) The bank verifies it/you and creates a signed payload with your age-claims (over_18: true, over_21: false) 10) You copy this and go back to gambling.com --------------- 11) You paste the string back into gambling.com 12) You perform WebAuthn Auth flow 13) gambling.com verifies everything (signatures, webauthn, etc) 14) gambling.com sets a session-cookie and _STRONGLY_ encourages you to create an account (with a pass key). This will prevent you from having to verify your age every time you visit gambling.com The mechanics might feel off, but it feels like this in the neighborhood of a way to perform anonymous age verification. This is virtually free, and requires extremely light infra. Banks can be incentivized with small payments, or offer it because everyone else does and don't want to get left behind.

djfobbz 1y ago
That's putting a lot of trust into banks. I don't like it. Just my personal opinion.
- jwally 1y ago
  Fair enough. Who is putting a lot of trust in the bank? They're slimy af and would sell their grandma's pii for an extra dollar; but that can't happen here. Bank doesn't know where you came from or where you're going; since you are the transport layer. Nothing of value for them to learn.
  - ImJasonH 1y ago
    What incentive does a bank have to support this? The site and the user get what they want, and from the bank's perspective they got to freeload on the age verification the bank has performed (though admittedly they already had to anyway)
    - jwally 1y ago
      Same reason banks offer free checking. Initially they could charge as a premium service, but eventually it would become a commodity. Not offering it would be weird.
  - jeroenhd 1y ago
    Several European countries have been using banks as a form of digital authentication for years. Of course, there are strict regulations to make sure banks don't abuse their position. I wouldn't want to use such a system with American banks, but the concept is hardly novel.
    - raxxorraxor 1y ago
      I don't want to verify anything and use services that don't require verification. The alleged motivation to introduce these checks is the error and the flaw.
AndrewDucker 1y ago
I don't see why you need the first step. What you need[0] is a certificate, signed by a recognised provider[1], asserting that email address X is associated with a person aged over 18. Once you have that, you can then provide it to anyone who asks for it. The certificate provider doesn't need to know who you're proving it to. Literally all they have to do is check whatever information they need to[2] to be happy asserting "Oh yeah, that's an adult". If your browser (or an add-on for it) wanted to make this easy by storing the certificate for you securely, then that would be awesome, obviously. But there's no reason why the certification provider needs to know who they're certifying your adulthood to. [0]Assuming that you want a way to prove you're an adult. [1]That could be a bank, a government, or anyone else who has sufficient levels of societal trust. [2]Photo of you, use of a credit card, records of you using that email address for more than 18 years. Whatever makes them happy making that assertion, that they'd be willing to stand up in court and defend their processes if one of their certificates was issued wrongly.
- ajsnigrutin 1y ago
  But that requires sharing your email every time you want to open pornhub.
  - AndrewDucker 1y ago
    I would absolutely set up an alternate email address for use with things I didn't want my identity to be associated with. Possibly several of them. The alternative is something like the Zero Knowledge Proofs that Google recently open sourced: https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze... This would allow you to prove that you have the certificate that was issued to you, without giving up more detail than that. I think that building that into things is a ways off though.
    - ajsnigrutin 1y ago
      I mean, the alternative is parents parenting their kids and installing parental control on their phones, and well.. pornhub without providing your email. Kids will still be able to torrent porn, but the end goal of having to use real ID with social networks will prevent any free speech still left and kill online anonymity.
joshgachnang 1y ago
TLS Notary[0] is a project already aimed at doing something exactly like this. It lets you only expose the parts of the payload that you want (e.g. your age) and relies on a verifier to prove the data is legit. [0] https://tlsnotary.org https://tlsnotary.org
drhodes 1y ago
Just an FYI: In the US, 5.6 million households are unbanked. https://www.fdic.gov/news/press-releases/2024/fdic-survey-finds-96-percent-us-households-were-banked-2023 https://www.fdic.gov/news/press-releases/2024/fdic-survey-fi...
- djoldman 1y ago
  Yep, this would be a big problem. We'd have to have alternate methods as well.
  - jwally 1y ago
    Exactly. No one way will solve this problem, but this would knock out a lot.
- oncallthrow 1y ago
  Okay, and those 5.6 million probably aren't accessing sites that require age verification. Not every solution needs to work for 100% of people.
  - blahaj 1y ago
    > and those 5.6 million probably aren't accessing sites that require age verification. Why would you presume that? > Not every solution needs to work for 100% of people. A solution that censors large amounts of speech and culture from millions of people is clearly either insufficient or, if it is deemed sufficient, authoritarian.
    - jwally 1y ago
      Any incremental advance is better than nothing where our rights are getting eroded faster than we can contact the ACLU to start investigating whether or not we have a case. The American Right have figured out that they can DDOS the legal system with all kinds of bullshit laws that they know won't stick, but it will take everyone 10x the time and effort that they spent spewing it out. We can't back and wait for the perfect solution that covers all corner cases and makes everyone happy and has the perfect UX. We have to fight now while we still have something to fight for.
drivenextfunc 1y ago
This reads like GPT-5 output. Anyone familiar with the model will recognize its distinctive style. While using LLM-generated content isn't inherently wrong, why not share the prompts? It's like presenting a book summary without naming the book.
- jwally 1y ago
  It is, Claude and it boiled down to this. My original idea was to have the bank sign a thing that contained your ip address and user agent; have the bank add in an age claim; and copy/paste it to the RP. I figured it would produce a document a little more on point. This setup with webauthn feels like overkill; but with banks and regs - it feels more beefy without adding a substantial amount of complexity.
- deleted 1y ago
  [deleted]
longboredofit 1y ago
What here stops someone from just sharing fake age verifications. If indeed the bank doesn't know what you are visiting and the site doesn't know who you are, anyone could just create an api to autogenerate fake authentications. Age verifications will always be a bad idea and will always leak information in one direction or another.
- jwally 1y ago
  Webauthn public key for pornhub gets signed by chase and authenticated on pornhub along with chases signature. I give that to you, chases signature is valid but you can't perform webauthn auth. Thats why you cant sell spun up credentials en masse.
  - LamaOfRuin 1y ago
    You've said this a couple times, but... it's not true? Webauthn allows for software authenticators and there is nothing to stop you from transferring it complete with keys to someone else.
    - jwally 1y ago
      Fair point...but worth the effort? Also, what if the bank signs your ip-address and user-agent-header as part of their payload back to the RP? That's like mission-impossible / hack into Langely level of effort to get into pornhub, no?
  - jeroenhd 1y ago
    My Bitwarden extension stores my webauthn keys and those keys work on any device I have Bitwarden unlocked on. I could definitely share any webauthn account with anyone of my choice if I wanted to. Just store the generated key in a shared webauthn vault. You can go spec-incompliant and tell the browser to only accept certain types of hardware to store your credential, but unless the entire ecosystem maintains lists of compromised hardware and blocks half the desktop user base for defeated TPM mechanisms, you're going to have to deal with spoofed clients. The only reason spoofed TPM/hardware backed credential stores aren't a problem for webauthn right now is that there is no need to spoof them at the moment.
Medea 1y ago
This is an active area of research see for example: EU Digital Identity & Anonymous Credentials at real world crypto 2025 https://www.youtube.com/watch?v=UpQHWObCx4I https://www.youtube.com/watch?v=UpQHWObCx4I
immibis 1y ago
so what if I sell this service to under-18 people in exchange for $30 each time? Apart from me going to jail, I mean. How would the protocol prevent this?
- acheron 1y ago
  https://xkcd.com/1494/ https://xkcd.com/1494/
- jwally 1y ago
  Webauthn ties the credential to your device.
  - hsbauauvhabzb 1y ago
    So now I can’t use a device that allows me to load kernel modules, no more sideloading, rooting or *desktop computers*?
    - jeroenhd 1y ago
      Most devices support signing requests using a certificate baked into the device's hardware certificate store, in a way the OS can't tamper with. Using that certificate to sign a nonce would prove legitimacy of the hardware store (basically, remote attestation). Your modified kernel can redirect communication attempts with the hardware to another device, but you'll still need a "sanctioned" device every time. This system makes a lot of sense in corporate environments where compatible hardware can be bought and managed en masses. It doesn't make a lot of sense for something like this. Still, it's technically and practically possible to use such a mechanism, even if it's not advisable. Webauthn isn't necessarily going to save you, though, and websites need to blacklist any hardware that has been found compromisable in the past (i.e. most consumer laptops, many consumer phones) and it won't work on Android phones running custom ROMs that don't implement the full security service but rather load in the bare minimum to get the API working.
      - immibis 1y ago
alkonaut 1y ago
The POC shouldn't even be mentioning banks explicitly. Any one that needs or could know you. Any authority such as a tax authority, voting registry, whatever, that already knows who you are, could verify this. An authority is preferable to a bank. And if a country already has a functioning digital ID solution that covers every citizen it should be a simple add-on to add this. The "functioning digital ID solution that covers every citizen" seems like the step to fix _first_ (definitely before imposing age verification laws online!). Also, having such a system really should be seen as par for the course for any developed country.
- jeffrallen 1y ago
  The new eIDs in Switzerland and the EU will allow this use case.
  - uyzstvqs 1y ago
    But are not completely anonymous and can share your browsing activity with the government. At least with the EU's system. https://news.ycombinator.com/item?id=44870161 https://news.ycombinator.com/item?id=44870161
    - jeroenhd 1y ago
      The source behind that comment doesn't verify the claim that your browsing history is being shared. Only that the app currently being developed is a temporary app for use until the full app has been finished. In fact, the linked article links to the EU website where it is specifically stated that the final protocol will be compatible with the temporary app (the anonymous age verification protocol). The final app will also serve as a method to identify oneself (i.e. to a police officer) but that's separate functionality from the token based authentication. The current lack of zero knowledge proofs does pose a potential privacy issue when websites and governments work together to track you across a length of time and re-authentications, but it's not like you're inherently sharing your browser history with the government. As far as I know, the temporary app intents to implement ZKPs but ran into standardization issues, so it's not like this is an intentional shortcoming either.
wsces 1y ago
Isn't this roughly what mDL (and broader future W3C Digital Credentials spec) offers albeit with the issuing agency of the ID (e.g. state DMV) acting as the credential issuer rather than a bank? A relying party make a claim for a coarse age limit 'is user over N years old'? With the user's consent, the application receives an attestation back from their wallet, with a chain of trust back to the issuer (without the issuer's intervention or knowledge). The user's credential is bound to the device and protected by their biometrics (Face ID/Touch ID), and the consent screen feels very similar to using a Passkey (gaining in mainstream popularity) or Apple Pay (pretty mainstream at this point). - https://www.w3.org/TR/digital-credentials/ https://www.w3.org/TR/digital-credentials/ - Apple's implementation - https://developer.apple.com/wallet/get-started-with-verify-with-wallet/ https://developer.apple.com/wallet/get-started-with-verify-w... (and moving to the browser in iOS 26 https://support.apple.com/en-gb/guide/apple-business-connect/abcb17bcda04/web https://support.apple.com/en-gb/guide/apple-business-connect...) The challenge here is adoption and availability of digital credentials. It appears State Department is allowing iOS 26 to issue digital credential representations of US passports also. Japan are also providing their national ID card in this way. Given some US states' online age verification laws (and whatever it is the UK are trying to do at the moment), seems like a great incentive for those governments to provide robust digital ID infrastructure.
tamimio 1y ago
Shifting the power from the state to banks.. what could go wrong!! Hell no! Banks should NOT assume an expanded role in transaction processes; rather, their involvement should be further reduced. The objective should be to establish public consensus that positions banks as an optional payment method, not as an integral component of daily activities. Even in scenarios where banks do not access personal identification information, their institutional power should be constrained rather than extended. Cashless payment systems present inherent risks for surveillance and control, as they channel all transactions through centralized, heavily monitored networks. Individuals flagged within these systems may face severe exclusion from economic participation without due process protections. KYC protocols may have poorly regulated flagging databases that lack the procedural safeguards associated with formal criminal records. Unlike criminal records, which require due process for inclusion and can be destroyed, banking flags operate without comparable regulatory oversight. This transfers significant power to corporate entities and their stakeholders, having this “shadow” power that would control the public. Regardless of anonymity provisions, banks should function solely as optional convenience tools for payment processing, not as mandatory intermediaries in financial transactions or any process. The integration of banking systems into essential processes is the worst for anyone who cares about surveillance free society and create a concentrated institutional power, and it will reduce individual autonomy, financial or not.
zb3 1y ago
Explain how even if the bank and the adult site cooperate together, they'd not be able to identify you. This is what I'd expect "anonymous" to be.
sandeepkd 1y ago
Theoretically a good idea, practically there are couple challenges with it- 1. Some one makes an intermediary service where they allow users to get the age verification from them. Get the information from the user provided to them by merchant, use their own (service providers) bank account to get the token and return back to the user. Identity less age verification is not practically possible, somewhere down the line you have to peg the identification for the user with a common identifier that services can mutually trust. 2. WebAuthn flow has timeouts (everyones spec implementation might be different) associated with it, most people are going to run into that
- jwally 1y ago
  Fair point on the timeout. Webauthn ties the public keys to your device; chases signature of it verifies it; your webauthn authentication of chases signed version of your key proves it was you the whole time. Nested dolls/Chain of custody. What am I overlooking?
  - sandeepkd 1y ago
    Chase signed a key that was provided to it, and chase verified for that user who logged in to chase. For whom the key was generated for and who entered in the chase site/api can be altogether two different entities. This is where it breaks. And chase like banks do not have any practical reason/motivation to provide such a functionality where they are vouching for something but dont really control how that information is used. The legal would never approve it, there is nothing but risk in it for them.
hsbauauvhabzb 1y ago
You should see my lie-about-over-18.com website You get your verification code Paste it into my website and pay $15 One of my crowdsourced reps will complete the request for you and collect $7.50
- jwally 1y ago
  Bank's signed payload includes part of the webauthn public key _and_ your ip address. If you modify the payload, it breaks the bank's sig. If your IP doesn't match what you had at the bank, the RP rejects you. If you can't verify the webauthn sig - the RP rejects you. Its not bullet proof, but not something you can copy/paste/share on pirate-bay either.
  - hsbauauvhabzb 1y ago
    Guess you’ll have to install my app so I can proxy my signature through your ip.
deleted 1y ago
[deleted]
sxp 1y ago
The problem with this is that the verifier (Bank, DMV, Government, etc) can track that you went to gambling.com. E.g, maybe the gambling.com string is "gambling.com-123". Or if it's a random number, maybe gambling.com is storing it somewhere and the bank/government files a legal request to get a copy. You have to trust the government in this case which isn't ideal. A better one is Chaum's Ecash protocol: https://en.wikipedia.org/wiki/Ecash https://en.wikipedia.org/wiki/Ecash To use a metaphor for that protocol: 1) The gambling site gives you a piece of with a UID on it. 2) You put the paper in a opaque envelope. (This is a cryptographic way of hiding the contents) 3) You take the envelope to the bank (or DMV, police station, etc) along with a copy of your birth certificate/RealID and they emboss it with their stamp saying you are over 18. The embossing is transferred through the envelop to the paper, but the bank hasn't seen the contents of that paper. (This is a cryptographic signing method which can affect the UID in step 2 without the bank needing to see the UID: https://en.wikipedia.org/wiki/Blind_signature) 4) You take the paper out of the envelope and destroy the envelope. The paper with the UID has the stamp but doesn't have any tracking information that the bank might have put on it. 5) You give the UID to the gambling site. They see that you got it stamped by the bank so they know you have an account with the bank and are over 18, but they don't know the RealID that the bank saw when the bank stamped the envelope. This is secure because the bank never saw the UID so they don't know if it was gambling-123 or disney-123. The gambling site can save that stamped UID and give it to the bank (or government) if required, but bank can't figure who came in to get that UID embossed. The only person who knows all the tracking information is the user. And as long as they burn the envelope (which is cryptographically secure), there is no usable tracking information. As long as the bank is Good and uses the same stamp for all users (i.e, they don't use alice-stamp, and bob-stamp, etc for different users), there is no way for anyone to connect that Alice got her gambling-123 UID stamped. But this stamp is normally using PKI so anyone can check the public key of the stamp. This algorithm was originally conceived to create anonymous "cash" since the bank would charge $1 to stamp your envelope and the gambling site could sell their UID paper to the bank to get that $1 from the bank.
- jwally 1y ago
  This is cool - thanks for sharing!
- 1y ago
kkfx 1y ago
No thanks. A valid and safe "age verification" (actually to be BANNED because meant as a way to pass internet censorship) could simply be: the State offer FLOSS and open-hardware IDs, we got a USB reader/built in in keyboard, built-in in laptop like we have hat in early 2000, who being all open we can trust, and the a simple boolean request "above age?" with a true or false answer PERIOD. If we want more we ERASE the not needed anymore banking sector with a state backed crypto and state backed open hardware and FLOSS wallets with a simple display usable as smartwatch or pendent with a retractable necklace like the one we use for skipass, where we could see on a trusted device what we are going to approve or reject. It's time to craft rules as code, in money/finance and laws/bureaucracy ERASING nazi censorship we see growing everywhere starting with biometry push.
lyu07282 1y ago
Right we still pretend this is about protecting children I forgot. The proper-ish solution to the problem are zero knowledge proofs: I get my government or whoever to give me a credential with my date of birth, I go to website which asks me for my age, the website gives me a token, I use the token and my gov credential to generate a proof that says "today i'm over 18" i give proof to website, the website verifies the proof using my governments public key and lets me pass. This way nobody knows anything more than necessary and it protects everybodys privacy. [1] Hey we make it a standard open protocol! So everybody can implement it easily. We finance a open-source reference implementation. All the children are forever saved from harm. We have parties under rainbows and world peace! [1] ZKRP's Zero Knowledge Range Proofs: https://arxiv.org/pdf/1907.06381 https://arxiv.org/pdf/1907.06381
runningmike 1y ago
Anonymity by default : not true, banks shouldn’t be trusted. And retrieved referral info will be stored by banks.
jchw 1y ago
Don't some of the jurisdiction requiring strong age verification also require you to store identity documentation? e.g. I believe that's the case for Mississippi. In those cases, storing the fact that age verification took place or even a proof of it would probably not be legally sufficient.
jeroenhd 1y ago
This mechanism is essentially what the European age verification system is doing, except they're also dealing with offline credentials (so you can log into gambling.com while bank.com is down for maintenance). There are some details thatihjt still need to be worked out for an American implementation (the lack of an eIDAS equivalent, for one), but the EU solution is being developed cross platform, in the open. You can just take the source code, replace/extend the chains of trust with whatever verification platforms you can convince others to join your programme, and reuse most of the existing code. For an American implementation, you can probably take out the part where verifiers need to be registered with the verification service (which I believe is part of EU law but makes implementing anonymous verification difficult). The wording and name should probably also be changed to be more in line with American expectations, and removing the remote attestation requirement would be nice if your verification services don't demand you include it. I'd also wait for ZKPs to be implemented, or add them to the implementation, to reduce the potential impact of collusion between governments and websites. The account creation part is optional but probably recommend. I wouldn't lock it to just passkeys, though, having a fallback to classic username/password is probably a good idea just in case.
sema4hacker 1y ago
Since most USA residents have already had their birth date determined by their DMV and/or Social Security, using those authorities seems much more logical compared to getting banks involved.
perihelions 1y ago
This isn't an anonymous protocol. It's asks for trust that the bank and the media platforms who age-restrict political protests aren't colluding to store all verification requests indefinitely, to build shadow profiles for evil reasons. (Of course they can doxx people if they collude: they have shared timing and device fingerprints). Translate this to a state collapsing into a dictatorship, like Serbia or Turkey, and you'd expect the supposed "trusted" verifiers, banks, to be run by people who collude with the people black-bagging people. The assumption "banks are ultimately trusted" is not a sound assumption. The implicit assumption "age attestation cryptography is only for unimportant things like gambling.com, so we can YOLO this" is not sound. Age-attestation is a general-purpose backdoor for doxxing people in many contexts—not just unimportant ones that are embarrassing at worst.
- jwally 1y ago
  But the bank doesn't know where you're going. Only that you need to attest to verification. Further, if you encountered a bad KYC actor, there's this; which if I understand it makes it impossible to correlate you to a merchant by crypto alone. https://arxiv.org/pdf/1907.06381 https://arxiv.org/pdf/1907.06381 You could use a VPN just for interacting with your bank or TOR for hyper vigilance... p.s. thx sxp!
  - perihelions 1y ago
    If the bank and the website collude, they can de-anonymize attestation requests by correlating their two views of the interaction—the timestamps and various device fingerprints. It's impossible to make strong security guarantees against this threat model—imperfect statistical ones, at best. Your version makes this trivial, since per your other comment, you expect the bank to insist on seeing the same IP address as the website, as an anti-fraud measure. ("If your IP doesn't match what you had at the bank, the RP rejects you.")
    - jwally 1y ago
      Salt and hash the IP or something so the RP can see the user's IP is the same as the bank's; but not necessarily _what_ the IP is...?
DvdGiessen 1y ago
You might also be interested in the IRMA protocol and the app implementing it, Yivi. They support a similar scheme, but using some additional cryptographic systems that provide extra security properties such as unlinkability that are very useful for privacy. https://docs.yivi.app/technical-overview/ https://docs.yivi.app/technical-overview/ Since I learned about it I've been hoping a system providing such unlinkability would be further developed and preferably adopted as the standard for online identity by for example the EU. Unfortunately I don't think the current proposals for the eIDAS include this (although it's been a while since I read up on this and I'd love to hear from someone more familiar if I'm wrong!)
aaron695 1y ago
[dead]
Alex4386 1y ago
Congratulations, You just reinvented age/identity verification in South Korea! Now you are one step closer for creating government-id based tracking landscape just like in S.Korea
- jwally 1y ago
  lol - the US already has it; we just subcontracted it to FAANG!
greatgib 1y ago
Indeed, you are a not an expert, and you are doing the same as reinventing your own broken crypto. Please do not! This has the appearance of anonymous when it is not. First, the moment that a value, being it a nonce, a random value or whatever will be common on both side, there is no anonymity anymore. Then, there is timing attack, where visiting a website, you then need to go to your bank. And the bank will sign at a specific time for a specific timeframe. Then, the need to manually "copy" the signature. I guess you don't see what size, difficult characters this has to have, but totally impracticable. So in the end people would use that to pretend that it is possible with anonymity skipping that step. Then, if the bank doesn't know the website where you went, gambling.com will know what is your bank. And in a lot of countries, age limit might be different for some activities, like gambling allowed at 21, porn at 18, or even rules would not be the same by countries. So again, you will be leaking the country and potentially you will have to leak to the bank the activity that is intended. And what do you do when banking app force you to have a certified Apple or Google spying approved phone? Bank already have too much power and responsibility and easily abuse of it, so it would be better to not give them even more. So again, please refrain of inventing stupid solution like that, that can give the wrong impression to the bad persons that it is possible, justifying laws and co, when it is not possible without costing hardly on our privacy!
- captainmuon 1y ago
  No, please do invent your own crypto, just don't deploy it! Coming up with schemes and then seeing where they fail is the best way to learn the intricacies. I think more of us 'lowly developers' should be familiar with the common pitfalls. That the bank is aware of your identity is not neccessarily a flaw, but a boundary condition of the protocol. Assuming a trusted intermediary, how can we.... I think a solution here is not purely technical, but also social. How about establishing a trusted intermediary that can check your identity, but for sure does not do anything malicious with the information? Maybe there is a strong taboo against disclosing the information, like with the confidentiality of confession. There is another flaw in the proposed scheme, how do you make sure that people don't just take the signature from another person? This one is pretty tricky to solve. I have been thinking about similar "proof of attribute" protocols for a while, since they have interesting use cases outside of age verification. You could verify that a person on HN is really an Apple employee, without Apple being able to identify that user. Or on a dating site, you could verify that the user is a certain gender, in a certain age bracket, and the account is tied to a social media account in good standing (not a throwaway account), without having the link explicit somewhere (and thus leakable).
Bender 1y ago
Anonymous age verification already exists but is not legally implemented or required. RTA headers [1] tell the client the URL may contain adult content or user generated content which can be adult in nature and then the client can detect the header and prompt for a local password if parental controls are enabled. A simple law to require client applications to look for the header and triggering parental controls would handle this in an anonymous manor. Not perfect, nothing is, but would address much more than 70% of use cases for actual small children. Small children would be restricted to whatever browsing agents are installed as they do not have administrative permissions. If this was done in error the parent can reset the device. Teens will bypass any method anyone can think of as current centralized methods do not even apply to most of their current methods of downloading and sharing porn. [1] - https://www.rtalabel.org/index.php?content=howtofaq#single https://www.rtalabel.org/index.php?content=howtofaq#single
AngryData 1y ago
Age verification schemes do not need to and should not exist. All it will accomplish at the end of the day is tie peoples personal ID to their online activity.

71 points by jwally 1y ago

djfobbz 1y ago

That's putting a lot of trust into banks. I don't like it. Just my personal opinion.

jwally 1y ago
Fair enough. Who is putting a lot of trust in the bank? They're slimy af and would sell their grandma's pii for an extra dollar; but that can't happen here. Bank doesn't know where you came from or where you're going; since you are the transport layer. Nothing of value for them to learn.
- ImJasonH 1y ago
  What incentive does a bank have to support this? The site and the user get what they want, and from the bank's perspective they got to freeload on the age verification the bank has performed (though admittedly they already had to anyway)
  - jwally 1y ago
    Same reason banks offer free checking. Initially they could charge as a premium service, but eventually it would become a commodity. Not offering it would be weird.
- jeroenhd 1y ago
  Several European countries have been using banks as a form of digital authentication for years. Of course, there are strict regulations to make sure banks don't abuse their position. I wouldn't want to use such a system with American banks, but the concept is hardly novel.
  - raxxorraxor 1y ago
    I don't want to verify anything and use services that don't require verification. The alleged motivation to introduce these checks is the error and the flaw.

AndrewDucker 1y ago

I don't see why you need the first step. What you need[0] is a certificate, signed by a recognised provider[1], asserting that email address X is associated with a person aged over 18. Once you have that, you can then provide it to anyone who asks for it. The certificate provider doesn't need to know who you're proving it to. Literally all they have to do is check whatever information they need to[2] to be happy asserting "Oh yeah, that's an adult". If your browser (or an add-on for it) wanted to make this easy by storing the certificate for you securely, then that would be awesome, obviously. But there's no reason why the certification provider needs to know who they're certifying your adulthood to. [0]Assuming that you want a way to prove you're an adult. [1]That could be a bank, a government, or anyone else who has sufficient levels of societal trust. [2]Photo of you, use of a credit card, records of you using that email address for more than 18 years. Whatever makes them happy making that assertion, that they'd be willing to stand up in court and defend their processes if one of their certificates was issued wrongly.

ajsnigrutin 1y ago
But that requires sharing your email every time you want to open pornhub.
- AndrewDucker 1y ago
  I would absolutely set up an alternate email address for use with things I didn't want my identity to be associated with. Possibly several of them. The alternative is something like the Zero Knowledge Proofs that Google recently open sourced: https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze... This would allow you to prove that you have the certificate that was issued to you, without giving up more detail than that. I think that building that into things is a ways off though.
  - ajsnigrutin 1y ago
    I mean, the alternative is parents parenting their kids and installing parental control on their phones, and well.. pornhub without providing your email. Kids will still be able to torrent porn, but the end goal of having to use real ID with social networks will prevent any free speech still left and kill online anonymity.

joshgachnang 1y ago

TLS Notary[0] is a project already aimed at doing something exactly like this. It lets you only expose the parts of the payload that you want (e.g. your age) and relies on a verifier to prove the data is legit. [0] https://tlsnotary.org https://tlsnotary.org

drhodes 1y ago

Just an FYI: In the US, 5.6 million households are unbanked. https://www.fdic.gov/news/press-releases/2024/fdic-survey-finds-96-percent-us-households-were-banked-2023 https://www.fdic.gov/news/press-releases/2024/fdic-survey-fi...

djoldman 1y ago
Yep, this would be a big problem. We'd have to have alternate methods as well.
- jwally 1y ago
  Exactly. No one way will solve this problem, but this would knock out a lot.
oncallthrow 1y ago
Okay, and those 5.6 million probably aren't accessing sites that require age verification. Not every solution needs to work for 100% of people.
- blahaj 1y ago
  > and those 5.6 million probably aren't accessing sites that require age verification. Why would you presume that? > Not every solution needs to work for 100% of people. A solution that censors large amounts of speech and culture from millions of people is clearly either insufficient or, if it is deemed sufficient, authoritarian.
  - jwally 1y ago
    Any incremental advance is better than nothing where our rights are getting eroded faster than we can contact the ACLU to start investigating whether or not we have a case. The American Right have figured out that they can DDOS the legal system with all kinds of bullshit laws that they know won't stick, but it will take everyone 10x the time and effort that they spent spewing it out. We can't back and wait for the perfect solution that covers all corner cases and makes everyone happy and has the perfect UX. We have to fight now while we still have something to fight for.

drivenextfunc 1y ago

This reads like GPT-5 output. Anyone familiar with the model will recognize its distinctive style. While using LLM-generated content isn't inherently wrong, why not share the prompts? It's like presenting a book summary without naming the book.

jwally 1y ago
It is, Claude and it boiled down to this. My original idea was to have the bank sign a thing that contained your ip address and user agent; have the bank add in an age claim; and copy/paste it to the RP. I figured it would produce a document a little more on point. This setup with webauthn feels like overkill; but with banks and regs - it feels more beefy without adding a substantial amount of complexity.
deleted 1y ago
[deleted]

longboredofit 1y ago

What here stops someone from just sharing fake age verifications. If indeed the bank doesn't know what you are visiting and the site doesn't know who you are, anyone could just create an api to autogenerate fake authentications. Age verifications will always be a bad idea and will always leak information in one direction or another.

jwally 1y ago
Webauthn public key for pornhub gets signed by chase and authenticated on pornhub along with chases signature. I give that to you, chases signature is valid but you can't perform webauthn auth. Thats why you cant sell spun up credentials en masse.
- LamaOfRuin 1y ago
  You've said this a couple times, but... it's not true? Webauthn allows for software authenticators and there is nothing to stop you from transferring it complete with keys to someone else.
  - jwally 1y ago
    Fair point...but worth the effort? Also, what if the bank signs your ip-address and user-agent-header as part of their payload back to the RP? That's like mission-impossible / hack into Langely level of effort to get into pornhub, no?
- jeroenhd 1y ago
  My Bitwarden extension stores my webauthn keys and those keys work on any device I have Bitwarden unlocked on. I could definitely share any webauthn account with anyone of my choice if I wanted to. Just store the generated key in a shared webauthn vault. You can go spec-incompliant and tell the browser to only accept certain types of hardware to store your credential, but unless the entire ecosystem maintains lists of compromised hardware and blocks half the desktop user base for defeated TPM mechanisms, you're going to have to deal with spoofed clients. The only reason spoofed TPM/hardware backed credential stores aren't a problem for webauthn right now is that there is no need to spoof them at the moment.

Medea 1y ago

This is an active area of research see for example: EU Digital Identity & Anonymous Credentials at real world crypto 2025 https://www.youtube.com/watch?v=UpQHWObCx4I https://www.youtube.com/watch?v=UpQHWObCx4I

immibis 1y ago

so what if I sell this service to under-18 people in exchange for $30 each time? Apart from me going to jail, I mean. How would the protocol prevent this?

acheron 1y ago
https://xkcd.com/1494/ https://xkcd.com/1494/
jwally 1y ago
Webauthn ties the credential to your device.
- hsbauauvhabzb 1y ago
  So now I can’t use a device that allows me to load kernel modules, no more sideloading, rooting or *desktop computers*?
  - jeroenhd 1y ago
    Most devices support signing requests using a certificate baked into the device's hardware certificate store, in a way the OS can't tamper with. Using that certificate to sign a nonce would prove legitimacy of the hardware store (basically, remote attestation). Your modified kernel can redirect communication attempts with the hardware to another device, but you'll still need a "sanctioned" device every time. This system makes a lot of sense in corporate environments where compatible hardware can be bought and managed en masses. It doesn't make a lot of sense for something like this. Still, it's technically and practically possible to use such a mechanism, even if it's not advisable. Webauthn isn't necessarily going to save you, though, and websites need to blacklist any hardware that has been found compromisable in the past (i.e. most consumer laptops, many consumer phones) and it won't work on Android phones running custom ROMs that don't implement the full security service but rather load in the bare minimum to get the API working.
    - immibis 1y ago

alkonaut 1y ago

The POC shouldn't even be mentioning banks explicitly. Any one that needs or could know you. Any authority such as a tax authority, voting registry, whatever, that already knows who you are, could verify this. An authority is preferable to a bank. And if a country already has a functioning digital ID solution that covers every citizen it should be a simple add-on to add this. The "functioning digital ID solution that covers every citizen" seems like the step to fix _first_ (definitely before imposing age verification laws online!). Also, having such a system really should be seen as par for the course for any developed country.

jeffrallen 1y ago
The new eIDs in Switzerland and the EU will allow this use case.
- uyzstvqs 1y ago
  But are not completely anonymous and can share your browsing activity with the government. At least with the EU's system. https://news.ycombinator.com/item?id=44870161 https://news.ycombinator.com/item?id=44870161
  - jeroenhd 1y ago
    The source behind that comment doesn't verify the claim that your browsing history is being shared. Only that the app currently being developed is a temporary app for use until the full app has been finished. In fact, the linked article links to the EU website where it is specifically stated that the final protocol will be compatible with the temporary app (the anonymous age verification protocol). The final app will also serve as a method to identify oneself (i.e. to a police officer) but that's separate functionality from the token based authentication. The current lack of zero knowledge proofs does pose a potential privacy issue when websites and governments work together to track you across a length of time and re-authentications, but it's not like you're inherently sharing your browser history with the government. As far as I know, the temporary app intents to implement ZKPs but ran into standardization issues, so it's not like this is an intentional shortcoming either.

wsces 1y ago

Isn't this roughly what mDL (and broader future W3C Digital Credentials spec) offers albeit with the issuing agency of the ID (e.g. state DMV) acting as the credential issuer rather than a bank? A relying party make a claim for a coarse age limit 'is user over N years old'? With the user's consent, the application receives an attestation back from their wallet, with a chain of trust back to the issuer (without the issuer's intervention or knowledge). The user's credential is bound to the device and protected by their biometrics (Face ID/Touch ID), and the consent screen feels very similar to using a Passkey (gaining in mainstream popularity) or Apple Pay (pretty mainstream at this point). - https://www.w3.org/TR/digital-credentials/ https://www.w3.org/TR/digital-credentials/ - Apple's implementation - https://developer.apple.com/wallet/get-started-with-verify-with-wallet/ https://developer.apple.com/wallet/get-started-with-verify-w... (and moving to the browser in iOS 26 https://support.apple.com/en-gb/guide/apple-business-connect/abcb17bcda04/web https://support.apple.com/en-gb/guide/apple-business-connect...) The challenge here is adoption and availability of digital credentials. It appears State Department is allowing iOS 26 to issue digital credential representations of US passports also. Japan are also providing their national ID card in this way. Given some US states' online age verification laws (and whatever it is the UK are trying to do at the moment), seems like a great incentive for those governments to provide robust digital ID infrastructure.

tamimio 1y ago

Shifting the power from the state to banks.. what could go wrong!! Hell no! Banks should NOT assume an expanded role in transaction processes; rather, their involvement should be further reduced. The objective should be to establish public consensus that positions banks as an optional payment method, not as an integral component of daily activities. Even in scenarios where banks do not access personal identification information, their institutional power should be constrained rather than extended. Cashless payment systems present inherent risks for surveillance and control, as they channel all transactions through centralized, heavily monitored networks. Individuals flagged within these systems may face severe exclusion from economic participation without due process protections. KYC protocols may have poorly regulated flagging databases that lack the procedural safeguards associated with formal criminal records. Unlike criminal records, which require due process for inclusion and can be destroyed, banking flags operate without comparable regulatory oversight. This transfers significant power to corporate entities and their stakeholders, having this “shadow” power that would control the public. Regardless of anonymity provisions, banks should function solely as optional convenience tools for payment processing, not as mandatory intermediaries in financial transactions or any process. The integration of banking systems into essential processes is the worst for anyone who cares about surveillance free society and create a concentrated institutional power, and it will reduce individual autonomy, financial or not.

zb3 1y ago

Explain how even if the bank and the adult site cooperate together, they'd not be able to identify you. This is what I'd expect "anonymous" to be.

sandeepkd 1y ago

Theoretically a good idea, practically there are couple challenges with it- 1. Some one makes an intermediary service where they allow users to get the age verification from them. Get the information from the user provided to them by merchant, use their own (service providers) bank account to get the token and return back to the user. Identity less age verification is not practically possible, somewhere down the line you have to peg the identification for the user with a common identifier that services can mutually trust. 2. WebAuthn flow has timeouts (everyones spec implementation might be different) associated with it, most people are going to run into that

jwally 1y ago
Fair point on the timeout. Webauthn ties the public keys to your device; chases signature of it verifies it; your webauthn authentication of chases signed version of your key proves it was you the whole time. Nested dolls/Chain of custody. What am I overlooking?
- sandeepkd 1y ago
  Chase signed a key that was provided to it, and chase verified for that user who logged in to chase. For whom the key was generated for and who entered in the chase site/api can be altogether two different entities. This is where it breaks. And chase like banks do not have any practical reason/motivation to provide such a functionality where they are vouching for something but dont really control how that information is used. The legal would never approve it, there is nothing but risk in it for them.

hsbauauvhabzb 1y ago

You should see my lie-about-over-18.com website You get your verification code Paste it into my website and pay $15 One of my crowdsourced reps will complete the request for you and collect $7.50

jwally 1y ago
Bank's signed payload includes part of the webauthn public key _and_ your ip address. If you modify the payload, it breaks the bank's sig. If your IP doesn't match what you had at the bank, the RP rejects you. If you can't verify the webauthn sig - the RP rejects you. Its not bullet proof, but not something you can copy/paste/share on pirate-bay either.
- hsbauauvhabzb 1y ago
  Guess you’ll have to install my app so I can proxy my signature through your ip.

deleted 1y ago

[deleted]

sxp 1y ago

The problem with this is that the verifier (Bank, DMV, Government, etc) can track that you went to gambling.com. E.g, maybe the gambling.com string is "gambling.com-123". Or if it's a random number, maybe gambling.com is storing it somewhere and the bank/government files a legal request to get a copy. You have to trust the government in this case which isn't ideal. A better one is Chaum's Ecash protocol: https://en.wikipedia.org/wiki/Ecash https://en.wikipedia.org/wiki/Ecash To use a metaphor for that protocol: 1) The gambling site gives you a piece of with a UID on it. 2) You put the paper in a opaque envelope. (This is a cryptographic way of hiding the contents) 3) You take the envelope to the bank (or DMV, police station, etc) along with a copy of your birth certificate/RealID and they emboss it with their stamp saying you are over 18. The embossing is transferred through the envelop to the paper, but the bank hasn't seen the contents of that paper. (This is a cryptographic signing method which can affect the UID in step 2 without the bank needing to see the UID: https://en.wikipedia.org/wiki/Blind_signature) 4) You take the paper out of the envelope and destroy the envelope. The paper with the UID has the stamp but doesn't have any tracking information that the bank might have put on it. 5) You give the UID to the gambling site. They see that you got it stamped by the bank so they know you have an account with the bank and are over 18, but they don't know the RealID that the bank saw when the bank stamped the envelope. This is secure because the bank never saw the UID so they don't know if it was gambling-123 or disney-123. The gambling site can save that stamped UID and give it to the bank (or government) if required, but bank can't figure who came in to get that UID embossed. The only person who knows all the tracking information is the user. And as long as they burn the envelope (which is cryptographically secure), there is no usable tracking information. As long as the bank is Good and uses the same stamp for all users (i.e, they don't use alice-stamp, and bob-stamp, etc for different users), there is no way for anyone to connect that Alice got her gambling-123 UID stamped. But this stamp is normally using PKI so anyone can check the public key of the stamp. This algorithm was originally conceived to create anonymous "cash" since the bank would charge $1 to stamp your envelope and the gambling site could sell their UID paper to the bank to get that $1 from the bank.

jwally 1y ago
This is cool - thanks for sharing!
1y ago

kkfx 1y ago

No thanks. A valid and safe "age verification" (actually to be BANNED because meant as a way to pass internet censorship) could simply be: the State offer FLOSS and open-hardware IDs, we got a USB reader/built in in keyboard, built-in in laptop like we have hat in early 2000, who being all open we can trust, and the a simple boolean request "above age?" with a true or false answer PERIOD. If we want more we ERASE the not needed anymore banking sector with a state backed crypto and state backed open hardware and FLOSS wallets with a simple display usable as smartwatch or pendent with a retractable necklace like the one we use for skipass, where we could see on a trusted device what we are going to approve or reject. It's time to craft rules as code, in money/finance and laws/bureaucracy ERASING nazi censorship we see growing everywhere starting with biometry push.

lyu07282 1y ago

Right we still pretend this is about protecting children I forgot. The proper-ish solution to the problem are zero knowledge proofs: I get my government or whoever to give me a credential with my date of birth, I go to website which asks me for my age, the website gives me a token, I use the token and my gov credential to generate a proof that says "today i'm over 18" i give proof to website, the website verifies the proof using my governments public key and lets me pass. This way nobody knows anything more than necessary and it protects everybodys privacy. [1] Hey we make it a standard open protocol! So everybody can implement it easily. We finance a open-source reference implementation. All the children are forever saved from harm. We have parties under rainbows and world peace! [1] ZKRP's Zero Knowledge Range Proofs: https://arxiv.org/pdf/1907.06381 https://arxiv.org/pdf/1907.06381

runningmike 1y ago

Anonymity by default : not true, banks shouldn’t be trusted. And retrieved referral info will be stored by banks.

jchw 1y ago

Don't some of the jurisdiction requiring strong age verification also require you to store identity documentation? e.g. I believe that's the case for Mississippi. In those cases, storing the fact that age verification took place or even a proof of it would probably not be legally sufficient.

jeroenhd 1y ago

This mechanism is essentially what the European age verification system is doing, except they're also dealing with offline credentials (so you can log into gambling.com while bank.com is down for maintenance). There are some details thatihjt still need to be worked out for an American implementation (the lack of an eIDAS equivalent, for one), but the EU solution is being developed cross platform, in the open. You can just take the source code, replace/extend the chains of trust with whatever verification platforms you can convince others to join your programme, and reuse most of the existing code. For an American implementation, you can probably take out the part where verifiers need to be registered with the verification service (which I believe is part of EU law but makes implementing anonymous verification difficult). The wording and name should probably also be changed to be more in line with American expectations, and removing the remote attestation requirement would be nice if your verification services don't demand you include it. I'd also wait for ZKPs to be implemented, or add them to the implementation, to reduce the potential impact of collusion between governments and websites. The account creation part is optional but probably recommend. I wouldn't lock it to just passkeys, though, having a fallback to classic username/password is probably a good idea just in case.

sema4hacker 1y ago

Since most USA residents have already had their birth date determined by their DMV and/or Social Security, using those authorities seems much more logical compared to getting banks involved.

perihelions 1y ago

This isn't an anonymous protocol. It's asks for trust that the bank and the media platforms who age-restrict political protests aren't colluding to store all verification requests indefinitely, to build shadow profiles for evil reasons. (Of course they can doxx people if they collude: they have shared timing and device fingerprints). Translate this to a state collapsing into a dictatorship, like Serbia or Turkey, and you'd expect the supposed "trusted" verifiers, banks, to be run by people who collude with the people black-bagging people. The assumption "banks are ultimately trusted" is not a sound assumption. The implicit assumption "age attestation cryptography is only for unimportant things like gambling.com, so we can YOLO this" is not sound. Age-attestation is a general-purpose backdoor for doxxing people in many contexts—not just unimportant ones that are embarrassing at worst.

jwally 1y ago
But the bank doesn't know where you're going. Only that you need to attest to verification. Further, if you encountered a bad KYC actor, there's this; which if I understand it makes it impossible to correlate you to a merchant by crypto alone. https://arxiv.org/pdf/1907.06381 https://arxiv.org/pdf/1907.06381 You could use a VPN just for interacting with your bank or TOR for hyper vigilance... p.s. thx sxp!
- perihelions 1y ago
  If the bank and the website collude, they can de-anonymize attestation requests by correlating their two views of the interaction—the timestamps and various device fingerprints. It's impossible to make strong security guarantees against this threat model—imperfect statistical ones, at best. Your version makes this trivial, since per your other comment, you expect the bank to insist on seeing the same IP address as the website, as an anti-fraud measure. ("If your IP doesn't match what you had at the bank, the RP rejects you.")
  - jwally 1y ago
    Salt and hash the IP or something so the RP can see the user's IP is the same as the bank's; but not necessarily _what_ the IP is...?

DvdGiessen 1y ago

You might also be interested in the IRMA protocol and the app implementing it, Yivi. They support a similar scheme, but using some additional cryptographic systems that provide extra security properties such as unlinkability that are very useful for privacy. https://docs.yivi.app/technical-overview/ https://docs.yivi.app/technical-overview/ Since I learned about it I've been hoping a system providing such unlinkability would be further developed and preferably adopted as the standard for online identity by for example the EU. Unfortunately I don't think the current proposals for the eIDAS include this (although it's been a while since I read up on this and I'd love to hear from someone more familiar if I'm wrong!)

aaron695 1y ago

[dead]

Alex4386 1y ago

Congratulations, You just reinvented age/identity verification in South Korea! Now you are one step closer for creating government-id based tracking landscape just like in S.Korea

jwally 1y ago
lol - the US already has it; we just subcontracted it to FAANG!

greatgib 1y ago

Indeed, you are a not an expert, and you are doing the same as reinventing your own broken crypto. Please do not! This has the appearance of anonymous when it is not. First, the moment that a value, being it a nonce, a random value or whatever will be common on both side, there is no anonymity anymore. Then, there is timing attack, where visiting a website, you then need to go to your bank. And the bank will sign at a specific time for a specific timeframe. Then, the need to manually "copy" the signature. I guess you don't see what size, difficult characters this has to have, but totally impracticable. So in the end people would use that to pretend that it is possible with anonymity skipping that step. Then, if the bank doesn't know the website where you went, gambling.com will know what is your bank. And in a lot of countries, age limit might be different for some activities, like gambling allowed at 21, porn at 18, or even rules would not be the same by countries. So again, you will be leaking the country and potentially you will have to leak to the bank the activity that is intended. And what do you do when banking app force you to have a certified Apple or Google spying approved phone? Bank already have too much power and responsibility and easily abuse of it, so it would be better to not give them even more. So again, please refrain of inventing stupid solution like that, that can give the wrong impression to the bad persons that it is possible, justifying laws and co, when it is not possible without costing hardly on our privacy!

captainmuon 1y ago
No, please do invent your own crypto, just don't deploy it! Coming up with schemes and then seeing where they fail is the best way to learn the intricacies. I think more of us 'lowly developers' should be familiar with the common pitfalls. That the bank is aware of your identity is not neccessarily a flaw, but a boundary condition of the protocol. Assuming a trusted intermediary, how can we.... I think a solution here is not purely technical, but also social. How about establishing a trusted intermediary that can check your identity, but for sure does not do anything malicious with the information? Maybe there is a strong taboo against disclosing the information, like with the confidentiality of confession. There is another flaw in the proposed scheme, how do you make sure that people don't just take the signature from another person? This one is pretty tricky to solve. I have been thinking about similar "proof of attribute" protocols for a while, since they have interesting use cases outside of age verification. You could verify that a person on HN is really an Apple employee, without Apple being able to identify that user. Or on a dating site, you could verify that the user is a certain gender, in a certain age bracket, and the account is tied to a social media account in good standing (not a throwaway account), without having the link explicit somewhere (and thus leakable).

Bender 1y ago

Anonymous age verification already exists but is not legally implemented or required. RTA headers [1] tell the client the URL may contain adult content or user generated content which can be adult in nature and then the client can detect the header and prompt for a local password if parental controls are enabled. A simple law to require client applications to look for the header and triggering parental controls would handle this in an anonymous manor. Not perfect, nothing is, but would address much more than 70% of use cases for actual small children. Small children would be restricted to whatever browsing agents are installed as they do not have administrative permissions. If this was done in error the parent can reset the device. Teens will bypass any method anyone can think of as current centralized methods do not even apply to most of their current methods of downloading and sharing porn. [1] - https://www.rtalabel.org/index.php?content=howtofaq#single https://www.rtalabel.org/index.php?content=howtofaq#single

AngryData 1y ago

Age verification schemes do not need to and should not exist. All it will accomplish at the end of the day is tie peoples personal ID to their online activity.