4 ms·

Just a reminder of what liability the CA age verification law imposes upon developers and providers. It's not enough to adhere to the OS age signal: > (3) (A)

Just a reminder of what liability the CA age verification law imposes upon developers and providers. It's not enough to adhere to the OS age signal: > (3) (A) Except as provided in subparagraph (B), a developer shall treat a signal received pursuant to this title as the primary indicator of a user’s age range for purposes of determining the user’s age. > (B) If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age. Developers are still burdened with additional liability if they have reason to believe users are underage, even if their age flag says otherwise. The only way to mitigate this liability is to confirm your users are of age with facial and ID scans, as it is implemented across platforms already. Not doing so opens you up to liability if someone ever writes "im 12 lol" on your app/platform.

stephbook 8mo ago
How do you know all this before any court decided upon it?
- heavyset_go 8mo ago
  Do you want to go to court to find out where the line is? That's expensive, risky and time consuming. It's easier to just scan faces and IDs to make sure your users are of age and not take on that liability.
wtallis 8mo ago
> if they have reason to believe users are underage The law requires "clear and convincing information", not merely "reason to believe". And since the law requires developers to rely on the provide age signal as the primary indicator of the user's age, developers are not incentivized to create a system that uses sophisticated data mining to derive an estimated age. If someone posts a comment on a YouTube video saying "I'm twelve years old and what is this?", that would absolutely not require YouTube to immediately start treating that account as an under-13 account.
- heavyset_go 8mo ago
  That would have to be litigated in court, and the easiest and cheapest way to avoid litigation is to just scan faces and IDs so you're sure your users won't upload or say anything that can bankrupt you while you sleep.
  - wtallis 8mo ago
    It would be at least as valid a strategy to avoid collecting any unnecessary personal information about your users, so that you don't have to worry about whether the information you've amassed adds up to "internal clear and convincing information". Remember, only the state AG can bring a suit under this law, and the penalty is limited to $2500 per child for negligent violations. It's probably cheaper to get insurance against such a judgement than to implement an invasive ID-scanning age verification system (and assume the risks of handling such highly-sensitive personal information).
    - heavyset_go 8mo ago
      No platform is going to forgo analytics and using demographic information for advertising, that's their bread and butter. I'd also argue it's clear and convincing if a kid changes their profile picture to a selfie of themselves, says they're 12, says they're in grade school, etc. Any reasonable person would take that at face value. > implement an invasive ID-scanning age verification system (and assume the risks of handling such highly-sensitive personal information) It's already implemented as face and ID scans by all the major platforms as it is. The systems are already there and they're already deployed. Apps and platforms already integrate with 3rd party age verification platforms who handle the face and ID data, nothing ever has to touch your servers.
      - Dylan16807 8mo ago
        > I'd also argue it's clear and convincing if a kid changes their profile picture to a selfie of themselves, says they're 12, says they're in grade school, etc. Any reasonable person would take that at face value. That's so fragile, and it's not like they're making those claims to the site, it's natural language posting. And someone who knows what they're doing would never take "I'm twelve years old and what is this?" at face value.
crote 8mo ago
I read it the exact opposite way: you are forbidden from using facial and ID scans solely for age verification (as the OS-provided signal shall be the primary indicator of age), but if you already need to obtain the user's age for other reasons using more reliable means (say, a banking KYC law requiring ID scans) you are not required to discard this more reliable source in favor of the OS-provided signal.
- gzread 8mo ago
  I read it as you're not allowed to discard the more reliable source.
  - jdashg 8mo ago
    You are not allowed to discard the more reliable source, but you're excused from, and basically forbidden from, asking for more info or for info from third parties.
gzread 8mo ago
If you aren't already scanning ID or similar then you don't have clear and convincing reasoning to believe the user is underage. This section targets spyware companies like Facebook, who already know damn well if the user is underage and this section forbids them from pretending they don't know. It doesn't say you have to go and become Facebook.
lokar 8mo ago
How does a website know if the age signal from a client is authentic? That seems unworkable.

stephbook 8mo ago

How do you know all this before any court decided upon it?

heavyset_go 8mo ago
Do you want to go to court to find out where the line is? That's expensive, risky and time consuming. It's easier to just scan faces and IDs to make sure your users are of age and not take on that liability.

wtallis 8mo ago

> if they have reason to believe users are underage The law requires "clear and convincing information", not merely "reason to believe". And since the law requires developers to rely on the provide age signal as the primary indicator of the user's age, developers are not incentivized to create a system that uses sophisticated data mining to derive an estimated age. If someone posts a comment on a YouTube video saying "I'm twelve years old and what is this?", that would absolutely not require YouTube to immediately start treating that account as an under-13 account.

heavyset_go 8mo ago
That would have to be litigated in court, and the easiest and cheapest way to avoid litigation is to just scan faces and IDs so you're sure your users won't upload or say anything that can bankrupt you while you sleep.
- wtallis 8mo ago
  It would be at least as valid a strategy to avoid collecting any unnecessary personal information about your users, so that you don't have to worry about whether the information you've amassed adds up to "internal clear and convincing information". Remember, only the state AG can bring a suit under this law, and the penalty is limited to $2500 per child for negligent violations. It's probably cheaper to get insurance against such a judgement than to implement an invasive ID-scanning age verification system (and assume the risks of handling such highly-sensitive personal information).
  - heavyset_go 8mo ago
    No platform is going to forgo analytics and using demographic information for advertising, that's their bread and butter. I'd also argue it's clear and convincing if a kid changes their profile picture to a selfie of themselves, says they're 12, says they're in grade school, etc. Any reasonable person would take that at face value. > implement an invasive ID-scanning age verification system (and assume the risks of handling such highly-sensitive personal information) It's already implemented as face and ID scans by all the major platforms as it is. The systems are already there and they're already deployed. Apps and platforms already integrate with 3rd party age verification platforms who handle the face and ID data, nothing ever has to touch your servers.
    - Dylan16807 8mo ago
      > I'd also argue it's clear and convincing if a kid changes their profile picture to a selfie of themselves, says they're 12, says they're in grade school, etc. Any reasonable person would take that at face value. That's so fragile, and it's not like they're making those claims to the site, it's natural language posting. And someone who knows what they're doing would never take "I'm twelve years old and what is this?" at face value.

crote 8mo ago

I read it the exact opposite way: you are forbidden from using facial and ID scans solely for age verification (as the OS-provided signal shall be the primary indicator of age), but if you already need to obtain the user's age for other reasons using more reliable means (say, a banking KYC law requiring ID scans) you are not required to discard this more reliable source in favor of the OS-provided signal.

gzread 8mo ago
I read it as you're not allowed to discard the more reliable source.
- jdashg 8mo ago
  You are not allowed to discard the more reliable source, but you're excused from, and basically forbidden from, asking for more info or for info from third parties.

gzread 8mo ago

If you aren't already scanning ID or similar then you don't have clear and convincing reasoning to believe the user is underage. This section targets spyware companies like Facebook, who already know damn well if the user is underage and this section forbids them from pretending they don't know. It doesn't say you have to go and become Facebook.

lokar 8mo ago

How does a website know if the age signal from a client is authentic? That seems unworkable.