7 ms·

> No one should have to provide any personal details to use any general computing device I agree. I also agree with S76 that some laws regarding how an operati

> No one should have to provide any personal details to use any general computing device I agree. I also agree with S76 that some laws regarding how an operating system intended for wide use should function are acceptable. How would you react to this law if the requirement was only that the operating system had to ask the user what age bracket it should report to sites? You get to pick it, it isn't mandatory that it be checked, and it doesn't need to be a date, just the bucket. Is that still too onerous? I ask because I feel like if we don't do something, the trajectory is that ~every website and app is going to either voluntarily or compulsorily do face scans, AI behavior analysis, and ID checks for their users, and I really don't want to live in that world.

edflsafoiewq 8mo ago
What makes you think this is going to stave off that world? More likely you'll get both, since I doubt this API is going to satisfy other states' age verification requirements.
- idle_zealot 8mo ago
  Sometimes a token effort or theater is sufficient to quell public sentiment. Like the oft-ignored and ineffective speed limits on roads, or the security theater at airports. That only handles the sentiment angle though. You still have to do something about would-be autocrats who want censorship and surveillance tools, and the oligarchs who want tracking and targeting data.
heavyset_go 8mo ago
> if we don't do something, the trajectory is that ~every website and app is going to either voluntarily or compulsorily do face scans, AI behavior analysis, and ID checks for their users You're going to get that, anyway. Platforms want to sell their userbases as real monetizable humans. Governments want to know who says and reads what online. AI companies want your face to train their systems they sell to the government, and they want to the be the gatekeepers that rank internet content for age appropriateness and use that content as free training material. Age verification across platforms is already implemented as AI face and ID scans. This is where we're already at.
- idle_zealot 8mo ago
  I am well aware of the alignment of interests and the dismal state of things. I'm of the opinion that the only way to divert is radical legal action that shatters the defense industry and social media titans, and it sure as hell won't be Gavin Newsom who delivers it.
- gzread 8mo ago
  And laws like this California one actually make it more illegal.
thayne 8mo ago
> How would you react to this law if the requirement was only that the operating system had to ask the user what age bracket it should report to sites? You get to pick it, it isn't mandatory that it be checked, and it doesn't need to be a date, just the bucket. Is that still too onerous? Isn't that what the CA law is?
- db48x 8mo ago
  Almost. Technically an adult must create an account for any non–adult who wants to use the computer, and configure it with the appropriate age category. Honestly it’s the dumbest thing ever. Best just not to play that game.
  - ohhnoodont 8mo ago
    How is that dumb? It seems reasonable and pragmatic. If the current status quo is ID uploads and face scans, this seems like the better approach. It shifts the responsibility back to parents. All adult service operators have to do is filter requests with the underage HTTP header set.
    - db48x 8mo ago
      How about the part where children cannot legally create accounts of their own, on computers that they own? I did that by the time I was 10. > It shifts the responsibility back to parents. Without these stupid laws parents already _have_ that responsibility.
      - ohhnoodont 8mo ago
        > How about the part where children cannot legally create accounts of their own, on computers that they own? Where is that actually stated in any law being discussed? If a parent gives a child a device with admin access, that’s their choice to do so. But it also makes sense that we, the minds behind all of this technology, also provide parents with the most basic of tools to restrict a child’s access online and hold accountable companies that knowingly serve adult content to children. That’s all the CA law does AFAIK. Sure, my generation was raised on 4chan. But I can understand why parents today may want the tools to limit that.
AnthonyMouse 8mo ago
The main problem with the "report your age to the website" proposals is that they're backwards. You shouldn't be leaking your age to the service. Instead, the service should be telling your device the nature of the content. Then, if the content is for adults and you're not one, your parents can configure your device not to display it.
- ray_v 8mo ago
  It may often times be trickier than that - content often mixed of course. My 10 y/o hit me with a request yesterday to play Among Us where the age verification system wanted my full name, address, email, AND the last 4 digits of my SSN. I refused.
  - AnthonyMouse 8mo ago
    > It may often times be trickier than that - content often mixed of course. So put the content tag at the granularity of the content.
    - valleyer 8mo ago
      Honestly, <span content-filter-level="adult">fuck</span> that.
    - onli 8mo ago
      Awesome. Now you have a system where every blog entry, every Facebook post needs a lawyer consultation. Around 20 years ago, Germany actually made a law that would have enforced such a system. I still have a chart in my blog that explained it, https://www.onli-blogging.de/1026/JMStV-kurz-erklaert.html https://www.onli-blogging.de/1026/JMStV-kurz-erklaert.html. Content for people over 16 would have to be marked accordingly or be put offline before 22:00, plus, if your site has a commercial character - which according to german courts is every single one in existence - you would need to hire a someone responsible for protecting teenagers and children (Jugenschutzbeauftragten). Result: It was seen as a big censor machine and I saw many sites and blogs shut down. You maybe can make that law partly responsible for how far behind german internet enterprises still are. Only a particular kind of bureaucrat wants to make business in an environment that makes laws such as this. Later the law wasn't actually followed. Only state media still has a system that blocks films for adults (=basically every action movie) from being accessed without age verification if not past 22:00.
sophrosyne42 8mo ago
The push to do biometric data collection is entirely the result of entrepreneurs trying to get ahead before laws are passed. Their behavior is the result of the push to restrict the open internet. If we don't do anything, they will stop. You don't always have to do "something". Sometimes the harm comes by trying to do something.
flir 8mo ago
> Is that still too onerous? Isn't it just pointless? I'm getting upset by face scan creep too. I do not like it. No sir. But mandating a self-reporting mechanism feels about as useful as DNT cookies, or those "are you 18? yes/no" gates on beer sites.
- idle_zealot 8mo ago
  It'd be more useful than DNT because there would be legal teeth on the side of the sender and receiver of the signal. It'd be more useful than the yes/no gates because an operating system could choose to allow the creation of child accounts. I.e. it would be a standardization of parental controls with added responsibility on sites/apps to self-determine if they should be blocked or limit functionality, rather than relying on big white/blacklists. Basically an infrastructure upgrade, rather than relying on a patchwork of competing private solutions to parental controls and age checks. The hope is also that a system like this would remove concerned parents from the list of supporters for pervasive mass surveillance and age scans. If they feel like you'd need to be a moron to miss the "This is a child device" button while setting up their kid's phone and laptop, and it's broadly understood that just pressing that button locks down what the device can access pretty effectively, that puts and damper on the FUD surrounding their child's internet usage.
latentsea 8mo ago
> I agree. I also agree with S76 that some laws regarding how an operating system intended for wide use should function are acceptable. How would you react to this law if the requirement was only that the operating system had to ask the user what age bracket it should report to sites? You get to pick it, it isn't mandatory that it be checked, and it doesn't need to be a date, just the bucket. Is that still too onerous? What's the point in doing any of this if it doesn't result in materially better outcomes?
- idle_zealot 8mo ago
  The point is that I think it's one of a few things that if done together could result in better outcomes. First, it standardizes parental controls, which ought to be so easy to use that failure to do so is nearly always a proactive decision on the part of the guardian. It doesn't need to be perfect, just reduce friction for parents and increase friction for kids accessing the adult internet. Second, it would signal to worried parents and busybodies that something has been done to deal with the danger that unmediated internet access might pose to minors. I don't think that it's a big issue, but a lot of energy has gone into convincing a lot of people that it is. The other part of achieving a good outcome would be to disempower those in the political and private sphere who benefit from a paranoid and censorious public and have worked to foment this panic. That's the much harder part, but it's not really the one being discussed here. I'm pitching the low-intrusiveness version to gauge sentiment here for that easier part of the path.
  - latentsea 8mo ago
    Your last point is the only one I partially agree with. The rest... will make no practical difference to what is going on in the world today. I genuinely think the only two solutions to this problem that are workable are "zero privacy, zero freedom" or "fuck the children, we don't care". Now, to be fair... there is a middle-ground that is neither of those options that I believe would be much more effective and allow us to retain our freedom and privacy and keep kids a lot safer. It's called education. But... no one will go for it, because I think for it to truly be effective you'd have to go as far as showing very young kids all the darkness that's out there and lay it out in paintstaking detail exactly how it works and deeply drill it into them. Ain't a snowballs chance in hell anyone would go for that, BUT... would it work? I'd bet you bottom dollar it would. The current extent of this education in public schools is a half hour visit from a police offer to the classroom and handing out a sheet to the kids and giving a 'good touch' / 'bad touch' talk. What's needed is a full length university level course on the whole topic from end to end. If you're in an adversarial relationship and need to defend yourself the best thing you can do is "know your enemy". But no... "they're too young to learn about that stuff, we need to shield them from it - think of the children!" is the reasoning people throw back at you when you suggest it. It hands down has to be the number one thing that could actually move the dial significantly, and it's just completely unpalatable to the majority of the populace.
iugtmkbdfil834 8mo ago
Sadly, the only real response here is non-compliance. Recently, credit card company wanted me to provide ID upon login ( I was amused -- while my setup may not be common, it has not changed for years now ). So I didn't and just ignored it. I checked on it this month and it suddenly was fine. But then.. one has to be willing to take a hit to their credit and whatnot. The point remains though. They have zero way to enforce it if we choose to not comply. Just saying.
- idle_zealot 8mo ago
  They have plenty of ways to enforce it. It's a law, they can take you to court. I guess it's easy to forget these days but laws do still apply to some people. If you're going to host a service, I guess consider using Tor or something.
  - iugtmkbdfil834 8mo ago
    Friend. On this very forum, you will normally see me argue that further deterioration of civil society is bad and we should be doing everything to maintain society as is. However, as with most things, there is a limit. That limit varies from person to person, but it is getting harder and harder to argue that laws apply ( especially once you recognize they don't quite apply across the board ). << If you're going to host a service, I guess consider using Tor or something. That one confused me. What do you mean?
    - hellojesus 8mo ago
      I think the person meant that if you don't comply there may be civil or criminal consequences, so if you want to knowingly provide a non compliant website or app, you should host it on tor to prevent your person from being the subject of the state. I know the CA law is civil only, so I don't think there is much CA can do if you publish an OS and don't make money from CA folks, but other implementations may decide to impose criminal penalties.
      - iugtmkbdfil834 8mo ago
Alan_Writer 8mo ago
Totally agree, but I think we are heading to a full intrusion system in every aspect. And this is just the beginning. Even decentralized identity systems are not that decentralized, of course.
tsukikage 8mo ago
My objection to all this stuff is the requirement to share government ID / biometrics / credit card info etc with arbitrary third party sites, their 228 partners who value my privacy and need all my data for legitimate interest, and whatever criminals any of those leak everything to, and also give the government an easily searchable history of what I read when those sites propagate the info back. Any scheme that doesn’t require this won’t get pushback from me. As an alternative: I already have government-issued ID and that branch of government already has my private info; have it give me a cryptographic token I can use to prove my age bracket to the root of trust module in my computer; then allow the OS to state my age to third parties when it needs to with a protocol that proves it has seen the appropriate government token but reveals nothing else about my identity. Other alternatives are possible.
- biofox 8mo ago
  That would require technical know-how. It's much easier for clueless lawmakers to write "the computer check the age", and make it everyone else's problem.
Xelbair 8mo ago
Exactly the same way as i do now for such laws. It's pointless, does not increase security, does increase complexity of every interaction, and introduces a lot of weird edge cases. What i want is full anonymity enshrined in law, while at the same time giving parents, not governments, but parents, options to limit what their children can do on the internet.
soulofmischief 8mo ago
A cornerstone philosophy behind the American legal system is that we must view every single increase in State power as a potential slippery slope, and must prove that it isn't. In this case, it's a slippery slope; if we're normalized to this, what other incursions into our 1A rights to free speech, religious freedom and public gathering will we allow? And I say religious freedom, because these kinds of laws are largely peddled by religious folk or people who otherwise have been deeply influenced by early American Puritan religious culture. I, nor my children, should be forced to subject to such religiously-motivated laws. I can decide for myself and for my child what is appropriate. I, nor my children, cannot be compelled to enter personal information into a machine created by someone who is also illegally compelled to require it. I, nor my children, can be compelled to avoid publicly gathering on the internet just because we don't want to show identification and normalize chilling surveillance capitalism. I thought this was fucking America.
jprjr_ 8mo ago
I think a better approach would be incentives versus punishments. Like - you don't make it illegal to not do age attestations, but you provide a mechanism to encourage it. You get a certification you can slap on your website and devices stating you meet the requirements of a California Family-Friendly Operating System or whatever. Maybe that comes with some kind of tax break, maybe it provides absolution in the case of some law being broken while using your OS, maybe it just means you get listed on a website of state-recommended operating systems. That certification wouldn't necessarily have to deal with age attestation at all. It could just mean the device/OS has features for parents - built-in website filtering, whatever restrictions they need. Parents could see the label and go "great, this label tells me I can set this up in a kid-safe way." Hell, maybe it is all about age certification/attestation. Part of that certification could be when setting it up, you do have to tell it a birthdate and the OS auto-applies some restrictions. Tells app stores your age, whatever. The point is an OS doesn't want to participate they don't have to. Linux distros etc would just not be California Family-Friendly Certified™. I wouldn't have to really care if California Family-Friendly Certified™ operating systems are scanning faces, IDs, birth certificates, collecting DNA, whatever. I'd have the choice to use a different operating system that suits my needs.
pc86 8mo ago
> I also agree with S76 that some laws regarding how an operating system intended for wide use should function are acceptable. The only laws the government should pass regulating software running on someones computer are laws protecting those consumers from the companies writing that software. For example, anti-malware/anti-spyware. The government has no business telling a random company that their software needs to report my age, whether it's unverified and self-reported or not.
- idle_zealot 8mo ago
  > protecting those consumers from the companies writing that software Of course, but that's exactly the framing of the verification laws. Protecting underage computer users from products/services unsuitable for them. If you want protection to be effective then it needs to be on by default, but also needs to ultimately be controlled by the user, and it's that second part that ID checks and the like fail.
ApolloFortyNine 8mo ago
>I ask because I feel like if we don't do something, the trajectory is that ~every website and app is going to either voluntarily or compulsorily do face scans, AI behavior analysis, and ID checks for their users, and I really don't want to live in that world. The only reason they'd _have_ to do that is government laws making them do so. When the law is vague around what age verification is, if one company decided to do ID verification, now any site that doesn't might not be doing 'enough' in the eyes of the law (it'd come down to a court case if not specifically defined). Though it may seem more convenient to just do it at the os level (though really the browser level would make more sense with a required header/cookie no?), I'd be shocked if you don't see it expanded in the future to be more than a checkbox.
Hizonner 8mo ago
> You get to pick it, it isn't mandatory that it be checked, and it doesn't need to be a date, just the bucket. Is that still too onerous? Yes, because (a) it wouldn't do anything, and (b) it would take about 5 seconds for the morons who push this stuff to start whining about that fact, and using the fact that "Society(TM) has mandated this and people are avoiding it" to demand effective verification, which would be a huge disaster. They won't be placated by anything short of total victory, and if you give them anything, you're just enouraging them.

edflsafoiewq 8mo ago

What makes you think this is going to stave off that world? More likely you'll get both, since I doubt this API is going to satisfy other states' age verification requirements.

idle_zealot 8mo ago
Sometimes a token effort or theater is sufficient to quell public sentiment. Like the oft-ignored and ineffective speed limits on roads, or the security theater at airports. That only handles the sentiment angle though. You still have to do something about would-be autocrats who want censorship and surveillance tools, and the oligarchs who want tracking and targeting data.

heavyset_go 8mo ago

> if we don't do something, the trajectory is that ~every website and app is going to either voluntarily or compulsorily do face scans, AI behavior analysis, and ID checks for their users You're going to get that, anyway. Platforms want to sell their userbases as real monetizable humans. Governments want to know who says and reads what online. AI companies want your face to train their systems they sell to the government, and they want to the be the gatekeepers that rank internet content for age appropriateness and use that content as free training material. Age verification across platforms is already implemented as AI face and ID scans. This is where we're already at.

idle_zealot 8mo ago
I am well aware of the alignment of interests and the dismal state of things. I'm of the opinion that the only way to divert is radical legal action that shatters the defense industry and social media titans, and it sure as hell won't be Gavin Newsom who delivers it.
gzread 8mo ago
And laws like this California one actually make it more illegal.

thayne 8mo ago

> How would you react to this law if the requirement was only that the operating system had to ask the user what age bracket it should report to sites? You get to pick it, it isn't mandatory that it be checked, and it doesn't need to be a date, just the bucket. Is that still too onerous? Isn't that what the CA law is?

db48x 8mo ago
Almost. Technically an adult must create an account for any non–adult who wants to use the computer, and configure it with the appropriate age category. Honestly it’s the dumbest thing ever. Best just not to play that game.
- ohhnoodont 8mo ago
  How is that dumb? It seems reasonable and pragmatic. If the current status quo is ID uploads and face scans, this seems like the better approach. It shifts the responsibility back to parents. All adult service operators have to do is filter requests with the underage HTTP header set.
  - db48x 8mo ago
    How about the part where children cannot legally create accounts of their own, on computers that they own? I did that by the time I was 10. > It shifts the responsibility back to parents. Without these stupid laws parents already _have_ that responsibility.
    - ohhnoodont 8mo ago
      > How about the part where children cannot legally create accounts of their own, on computers that they own? Where is that actually stated in any law being discussed? If a parent gives a child a device with admin access, that’s their choice to do so. But it also makes sense that we, the minds behind all of this technology, also provide parents with the most basic of tools to restrict a child’s access online and hold accountable companies that knowingly serve adult content to children. That’s all the CA law does AFAIK. Sure, my generation was raised on 4chan. But I can understand why parents today may want the tools to limit that.

AnthonyMouse 8mo ago

The main problem with the "report your age to the website" proposals is that they're backwards. You shouldn't be leaking your age to the service. Instead, the service should be telling your device the nature of the content. Then, if the content is for adults and you're not one, your parents can configure your device not to display it.

ray_v 8mo ago
It may often times be trickier than that - content often mixed of course. My 10 y/o hit me with a request yesterday to play Among Us where the age verification system wanted my full name, address, email, AND the last 4 digits of my SSN. I refused.
- AnthonyMouse 8mo ago
  > It may often times be trickier than that - content often mixed of course. So put the content tag at the granularity of the content.
  - valleyer 8mo ago
    Honestly, <span content-filter-level="adult">fuck</span> that.
  - onli 8mo ago
    Awesome. Now you have a system where every blog entry, every Facebook post needs a lawyer consultation. Around 20 years ago, Germany actually made a law that would have enforced such a system. I still have a chart in my blog that explained it, https://www.onli-blogging.de/1026/JMStV-kurz-erklaert.html https://www.onli-blogging.de/1026/JMStV-kurz-erklaert.html. Content for people over 16 would have to be marked accordingly or be put offline before 22:00, plus, if your site has a commercial character - which according to german courts is every single one in existence - you would need to hire a someone responsible for protecting teenagers and children (Jugenschutzbeauftragten). Result: It was seen as a big censor machine and I saw many sites and blogs shut down. You maybe can make that law partly responsible for how far behind german internet enterprises still are. Only a particular kind of bureaucrat wants to make business in an environment that makes laws such as this. Later the law wasn't actually followed. Only state media still has a system that blocks films for adults (=basically every action movie) from being accessed without age verification if not past 22:00.

sophrosyne42 8mo ago

The push to do biometric data collection is entirely the result of entrepreneurs trying to get ahead before laws are passed. Their behavior is the result of the push to restrict the open internet. If we don't do anything, they will stop. You don't always have to do "something". Sometimes the harm comes by trying to do something.

flir 8mo ago

> Is that still too onerous? Isn't it just pointless? I'm getting upset by face scan creep too. I do not like it. No sir. But mandating a self-reporting mechanism feels about as useful as DNT cookies, or those "are you 18? yes/no" gates on beer sites.

idle_zealot 8mo ago
It'd be more useful than DNT because there would be legal teeth on the side of the sender and receiver of the signal. It'd be more useful than the yes/no gates because an operating system could choose to allow the creation of child accounts. I.e. it would be a standardization of parental controls with added responsibility on sites/apps to self-determine if they should be blocked or limit functionality, rather than relying on big white/blacklists. Basically an infrastructure upgrade, rather than relying on a patchwork of competing private solutions to parental controls and age checks. The hope is also that a system like this would remove concerned parents from the list of supporters for pervasive mass surveillance and age scans. If they feel like you'd need to be a moron to miss the "This is a child device" button while setting up their kid's phone and laptop, and it's broadly understood that just pressing that button locks down what the device can access pretty effectively, that puts and damper on the FUD surrounding their child's internet usage.

latentsea 8mo ago

> I agree. I also agree with S76 that some laws regarding how an operating system intended for wide use should function are acceptable. How would you react to this law if the requirement was only that the operating system had to ask the user what age bracket it should report to sites? You get to pick it, it isn't mandatory that it be checked, and it doesn't need to be a date, just the bucket. Is that still too onerous? What's the point in doing any of this if it doesn't result in materially better outcomes?

idle_zealot 8mo ago
The point is that I think it's one of a few things that if done together could result in better outcomes. First, it standardizes parental controls, which ought to be so easy to use that failure to do so is nearly always a proactive decision on the part of the guardian. It doesn't need to be perfect, just reduce friction for parents and increase friction for kids accessing the adult internet. Second, it would signal to worried parents and busybodies that something has been done to deal with the danger that unmediated internet access might pose to minors. I don't think that it's a big issue, but a lot of energy has gone into convincing a lot of people that it is. The other part of achieving a good outcome would be to disempower those in the political and private sphere who benefit from a paranoid and censorious public and have worked to foment this panic. That's the much harder part, but it's not really the one being discussed here. I'm pitching the low-intrusiveness version to gauge sentiment here for that easier part of the path.
- latentsea 8mo ago
  Your last point is the only one I partially agree with. The rest... will make no practical difference to what is going on in the world today. I genuinely think the only two solutions to this problem that are workable are "zero privacy, zero freedom" or "fuck the children, we don't care". Now, to be fair... there is a middle-ground that is neither of those options that I believe would be much more effective and allow us to retain our freedom and privacy and keep kids a lot safer. It's called education. But... no one will go for it, because I think for it to truly be effective you'd have to go as far as showing very young kids all the darkness that's out there and lay it out in paintstaking detail exactly how it works and deeply drill it into them. Ain't a snowballs chance in hell anyone would go for that, BUT... would it work? I'd bet you bottom dollar it would. The current extent of this education in public schools is a half hour visit from a police offer to the classroom and handing out a sheet to the kids and giving a 'good touch' / 'bad touch' talk. What's needed is a full length university level course on the whole topic from end to end. If you're in an adversarial relationship and need to defend yourself the best thing you can do is "know your enemy". But no... "they're too young to learn about that stuff, we need to shield them from it - think of the children!" is the reasoning people throw back at you when you suggest it. It hands down has to be the number one thing that could actually move the dial significantly, and it's just completely unpalatable to the majority of the populace.

iugtmkbdfil834 8mo ago

Sadly, the only real response here is non-compliance. Recently, credit card company wanted me to provide ID upon login ( I was amused -- while my setup may not be common, it has not changed for years now ). So I didn't and just ignored it. I checked on it this month and it suddenly was fine. But then.. one has to be willing to take a hit to their credit and whatnot. The point remains though. They have zero way to enforce it if we choose to not comply. Just saying.

idle_zealot 8mo ago
They have plenty of ways to enforce it. It's a law, they can take you to court. I guess it's easy to forget these days but laws do still apply to some people. If you're going to host a service, I guess consider using Tor or something.
- iugtmkbdfil834 8mo ago
  Friend. On this very forum, you will normally see me argue that further deterioration of civil society is bad and we should be doing everything to maintain society as is. However, as with most things, there is a limit. That limit varies from person to person, but it is getting harder and harder to argue that laws apply ( especially once you recognize they don't quite apply across the board ). << If you're going to host a service, I guess consider using Tor or something. That one confused me. What do you mean?
  - hellojesus 8mo ago
    I think the person meant that if you don't comply there may be civil or criminal consequences, so if you want to knowingly provide a non compliant website or app, you should host it on tor to prevent your person from being the subject of the state. I know the CA law is civil only, so I don't think there is much CA can do if you publish an OS and don't make money from CA folks, but other implementations may decide to impose criminal penalties.
    - iugtmkbdfil834 8mo ago

Alan_Writer 8mo ago

Totally agree, but I think we are heading to a full intrusion system in every aspect. And this is just the beginning. Even decentralized identity systems are not that decentralized, of course.

tsukikage 8mo ago

My objection to all this stuff is the requirement to share government ID / biometrics / credit card info etc with arbitrary third party sites, their 228 partners who value my privacy and need all my data for legitimate interest, and whatever criminals any of those leak everything to, and also give the government an easily searchable history of what I read when those sites propagate the info back. Any scheme that doesn’t require this won’t get pushback from me. As an alternative: I already have government-issued ID and that branch of government already has my private info; have it give me a cryptographic token I can use to prove my age bracket to the root of trust module in my computer; then allow the OS to state my age to third parties when it needs to with a protocol that proves it has seen the appropriate government token but reveals nothing else about my identity. Other alternatives are possible.

biofox 8mo ago
That would require technical know-how. It's much easier for clueless lawmakers to write "the computer check the age", and make it everyone else's problem.

Xelbair 8mo ago

Exactly the same way as i do now for such laws. It's pointless, does not increase security, does increase complexity of every interaction, and introduces a lot of weird edge cases. What i want is full anonymity enshrined in law, while at the same time giving parents, not governments, but parents, options to limit what their children can do on the internet.

soulofmischief 8mo ago

A cornerstone philosophy behind the American legal system is that we must view every single increase in State power as a potential slippery slope, and must prove that it isn't. In this case, it's a slippery slope; if we're normalized to this, what other incursions into our 1A rights to free speech, religious freedom and public gathering will we allow? And I say religious freedom, because these kinds of laws are largely peddled by religious folk or people who otherwise have been deeply influenced by early American Puritan religious culture. I, nor my children, should be forced to subject to such religiously-motivated laws. I can decide for myself and for my child what is appropriate. I, nor my children, cannot be compelled to enter personal information into a machine created by someone who is also illegally compelled to require it. I, nor my children, can be compelled to avoid publicly gathering on the internet just because we don't want to show identification and normalize chilling surveillance capitalism. I thought this was fucking America.

jprjr_ 8mo ago

I think a better approach would be incentives versus punishments. Like - you don't make it illegal to not do age attestations, but you provide a mechanism to encourage it. You get a certification you can slap on your website and devices stating you meet the requirements of a California Family-Friendly Operating System or whatever. Maybe that comes with some kind of tax break, maybe it provides absolution in the case of some law being broken while using your OS, maybe it just means you get listed on a website of state-recommended operating systems. That certification wouldn't necessarily have to deal with age attestation at all. It could just mean the device/OS has features for parents - built-in website filtering, whatever restrictions they need. Parents could see the label and go "great, this label tells me I can set this up in a kid-safe way." Hell, maybe it is all about age certification/attestation. Part of that certification could be when setting it up, you do have to tell it a birthdate and the OS auto-applies some restrictions. Tells app stores your age, whatever. The point is an OS doesn't want to participate they don't have to. Linux distros etc would just not be California Family-Friendly Certified™. I wouldn't have to really care if California Family-Friendly Certified™ operating systems are scanning faces, IDs, birth certificates, collecting DNA, whatever. I'd have the choice to use a different operating system that suits my needs.

pc86 8mo ago

> I also agree with S76 that some laws regarding how an operating system intended for wide use should function are acceptable. The only laws the government should pass regulating software running on someones computer are laws protecting those consumers from the companies writing that software. For example, anti-malware/anti-spyware. The government has no business telling a random company that their software needs to report my age, whether it's unverified and self-reported or not.

idle_zealot 8mo ago
> protecting those consumers from the companies writing that software Of course, but that's exactly the framing of the verification laws. Protecting underage computer users from products/services unsuitable for them. If you want protection to be effective then it needs to be on by default, but also needs to ultimately be controlled by the user, and it's that second part that ID checks and the like fail.

ApolloFortyNine 8mo ago

>I ask because I feel like if we don't do something, the trajectory is that ~every website and app is going to either voluntarily or compulsorily do face scans, AI behavior analysis, and ID checks for their users, and I really don't want to live in that world. The only reason they'd _have_ to do that is government laws making them do so. When the law is vague around what age verification is, if one company decided to do ID verification, now any site that doesn't might not be doing 'enough' in the eyes of the law (it'd come down to a court case if not specifically defined). Though it may seem more convenient to just do it at the os level (though really the browser level would make more sense with a required header/cookie no?), I'd be shocked if you don't see it expanded in the future to be more than a checkbox.

Hizonner 8mo ago

> You get to pick it, it isn't mandatory that it be checked, and it doesn't need to be a date, just the bucket. Is that still too onerous? Yes, because (a) it wouldn't do anything, and (b) it would take about 5 seconds for the morons who push this stuff to start whining about that fact, and using the fact that "Society(TM) has mandated this and people are avoiding it" to demand effective verification, which would be a huge disaster. They won't be placated by anything short of total victory, and if you give them anything, you're just enouraging them.