5 ms·

The main problem with the "report your age to the website" proposals is that they're backwards. You shouldn't be leaking your age to the service. Instead, the

The main problem with the "report your age to the website" proposals is that they're backwards. You shouldn't be leaking your age to the service. Instead, the service should be telling your device the nature of the content. Then, if the content is for adults and you're not one, your parents can configure your device not to display it.

ray_v 8mo ago
It may often times be trickier than that - content often mixed of course. My 10 y/o hit me with a request yesterday to play Among Us where the age verification system wanted my full name, address, email, AND the last 4 digits of my SSN. I refused.
- AnthonyMouse 8mo ago
  > It may often times be trickier than that - content often mixed of course. So put the content tag at the granularity of the content.
  - valleyer 8mo ago
    Honestly, <span content-filter-level="adult">fuck</span> that.
  - onli 8mo ago
    Awesome. Now you have a system where every blog entry, every Facebook post needs a lawyer consultation. Around 20 years ago, Germany actually made a law that would have enforced such a system. I still have a chart in my blog that explained it, https://www.onli-blogging.de/1026/JMStV-kurz-erklaert.html https://www.onli-blogging.de/1026/JMStV-kurz-erklaert.html. Content for people over 16 would have to be marked accordingly or be put offline before 22:00, plus, if your site has a commercial character - which according to german courts is every single one in existence - you would need to hire a someone responsible for protecting teenagers and children (Jugenschutzbeauftragten). Result: It was seen as a big censor machine and I saw many sites and blogs shut down. You maybe can make that law partly responsible for how far behind german internet enterprises still are. Only a particular kind of bureaucrat wants to make business in an environment that makes laws such as this. Later the law wasn't actually followed. Only state media still has a system that blocks films for adults (=basically every action movie) from being accessed without age verification if not past 22:00.
    - AnthonyMouse 8mo ago
      > Now you have a system where every blog entry, every Facebook post needs a lawyer consultation. You have that with any form of any of these things. They're almost certainly going to be set up so that you get in trouble for claiming that adult content isn't but not for having non-adult content behind the adult content tag. Then you would be able to avoid legal questions by labeling your whole site as adult content, with the obvious drawback that then your whole site is labeled as adult content even though most of it isn't. But using ID requirements instead doesn't get you out of that. You'd still need to either identify which content requires someone to provide an ID before they can view it, or ID everyone. That's an argument for not doing any of these things, but not an argument for having ID requirements instead of content tags.
      - onli 8mo ago
        Funnily enough, marking content that's harmless as only for adults was also punishable, though that might have been in context of a different law. That would be censorship, blocking people under 18 from accessing legal content, was the reasoning. Welcome to German bureaucracy. But you are right. It's an argument that the "just mark content accordingly" is also not a better solution, not that ID requirements are in any way better. The only solution is not to enable this censorship infrastructure, because no matter which way it's done, it will always function as one.
        AnthonyMouse 8mo ago
        > Funnily enough, marking content that's harmless as only for adults was also punishable, though that might have been in context of a different law. That would be censorship, blocking people under 18 from accessing legal content, was the reasoning. Welcome to German bureaucracy. That's how you get the thing where instead of using different equipment to process the food with and without sesame seeds, they just put sesame seeds in everything on purpose so they can accurately label them as containing sesame seeds.
        LinXitoW 8mo ago
- cwillu 8mo ago
  That's an argument for “let the service inform the parent and let the parent decide”, not against it.
- alexfoo 8mo ago
  There's a good chance that they're never going to verify any of the information you give them, in which case it's another download for Mr M Mouse of 1375 E Buena Vista Dr, 32830, with a SSN that ends in 1234.
  - b112 8mo ago
    Giving fake info feeds the machine. It means you still consume, and a bad actor profits.
    - thbb123 8mo ago
      I disagree. Giving fake info adds noise to the mechanism, makes it useless. Ultimately I'm inclined to believe that privacy through noise generation is a solution. If I ever find some idle time, I'd like to make an agent that surfs the web under my identity and several fake ones, but randomly according to several fake personality traits I program. Then, after some testing and analysis of the generated patterns of crawl, release it as freeware to allow anyone to participate in the obfuscation of individuals' behaviors.
      - noam_k 8mo ago
        You might want to take a look at differential privacy. It takes an unintuitive amount of noise to make the system useless. You also need to account for how "easy" it is to de-anonymize a profile. (Sorry I don't have links to sources handy.)
        aleph_minus_one 8mo ago
        > You might want to take a look at differential privacy Differential privacy is just a bait to make surveillance more socially acceptable and to have arguments to silence critics ("no need to worry about the dangers - we have differential privacy"). :-(
      - fsflover 8mo ago
        Sounds a bit like AdNauseam Firefox extension.
- iso1631 8mo ago
  It feels to me that parental controls are seen as another profit centre. If we want to put laws in place, we should be putting in laws to empower parents.
- VLM 8mo ago
  I would assume its fake and an attempt at identify theft at some level of the system. Is their PC infected at the OS level or just a fraudulent browser extension or something more like a popup ad masquerading as a system dialogue? A less trusting person would assume any request made by a computer is totally non-fraudulent and would gladly submit any requested private information. "Dad, I can't do my math homework, a pop up says you need to provide a copy of your bank statement, your mom's maiden name, and a copy of your birth certificate, SS card, and drivers license, and can you hurry up Dad, my homework is due tomorrow morning." And people will fall for this once they get used to the system being absurd enough. The fraud machine must be kept fed...
- just6979 8mo ago
  If the content is mixed, it makes even more sense to have the content supply the age data. This is how it has worked with broadcast media pretty much forever. TV shows and movies gain their ratings based on the worst case on display. IE: a show doesn't have to consist entirely of swearing to gain a "language" warning, it just has to have some. Definitively mixed content. I think your example exemplifies this. Among Us is not inherently adult-only, but since it's multiplayer, they don't control what other player say and do. Definitively mixed content. They should not be asking you to verify, they should be telling you and letting you decide if your kid can play. I kinda can't beleive their lawyers decided to go that route and assume all the PII responsibility that comes with collecting that data, instead of just making the "it's online and there might be d-bags on our servers" rating much more obvious and explicit.
  - autoexec 8mo ago
    They can profit off of the personal data they collect, so it's no surprise they'd take any opportunity and use any available excuse to collect more of it. From their perspective there is effectively zero responsibility to secure that data properly and handle it safely because there are effectively zero consequences for companies when they fail to.
tuetuopay 8mo ago
Heh that's already what parental controls do (granted, the website don't report the content, and it's based on blacklists), but they are trivial to bypass. Even the article mention it: > The child can install a virtual machine, create an account on the virtual machine and set the age to 18 or over It's precisely how I worked around the parental control my parents put on my computer when I was ~12. Get Virtualbox, get a Kubuntu ISO, and voilà! The funniest is, I did not want to access adult content, but the software had thepiratebay on its blacklist, which I did want. In the end, I proudly showed them (look ma!), and they promptly removed the control from the computer, as you can't fight a motivated kid.
- AnthonyMouse 8mo ago
  > but they are trivial to bypass. That's assuming the parental controls allow the kid to create a virtual machine. And then that the kid knows how to create a virtual machine, which is already at the level of difficulty of getting the high school senior who is already 18 to loan you their ID. None of this stuff is ever going to be Fort Knox. Locks are for keeping honest people honest.
  - Ntrails 8mo ago
    If the kid knows how to ask an llm, they can do whatever technical hacks are required
    - autoexec 8mo ago
      Would that make the LLM (or the company who made it) liable under the DMCA for showing someone how to work around a digital lock that controls access to a copyrighted work.
  - tuetuopay 8mo ago
    We could argue on the technical feasability all day, as non-kvm qemu does not need any special permission to run a VM (albeit dog slow). I honestly don't really agree on the difficulty, as if this becomes a commonplace way to bypass such laws, you can expect tiktok to be full of videos about how to do it. People will provide already-installed VMs in a turnkey solution. It's not unlike how generations of kids playing minecraft learnt how to port forward and how to insatll VPNs for non-alleged-privacy reasons: something that was considered out of a kid's reach became a commodity. > None of this stuff is ever going to be Fort Knox. Locks are for keeping honest people honest. On that we agree, and it makes me sad. The gap between computer literate and illiterate will only widen a time passes. Non motivated kids will learn less, and motivated ones will get a kickstart by going around the locks.
idle_zealot 8mo ago
> Instead, the service should be telling your device the nature of the content. Then, if the content is for adults and you're not one, your parents can configure your device not to display it. That makes sense for purely offline media playback, but how could that work for a game or application or website? Ship several versions of the app for the different brackets and let the OS choose which to run? Then specifically design your telemetry to avoid logging which version is running? You'd also not be reporting your age, you'd be sending a "please treat me like an adult" or "please treat me like a child" flag. That's hardly PII. More like a dark/light mode preference, or your language settings (which your browser does send).
- lavela 8mo ago
  The shifts between flags will correlate with date of birth though, or do you think someone turning 16 or 18 will wait a year or two to switch to more adult content for privacy? Also I'd guess the tech industry would push for more specific age buckets. Games already have PG ratings and similar in different countries, I don't see the issue there. Web content could set a age appropriateness header and let browsers deal with it, either for specific content or for the whole website if it relies on e.g. addictive mechanics. Applications is a wide field, but I'd be interested in specific examples where you think it wouldn't work.
  - idle_zealot 8mo ago
    > Applications is a wide field, but I'd be interested in specific examples where you think it wouldn't work. Sure. Take a game with voice chat. Child mode disables voice chat. How does the game, which presumably uses a load of telemetry, avoid incidentally leaking which users are children via the lack of voice telemetry data coming from the client? It's probably possible, but the fact is we're talking about third party code running on a computer, and the computer running different code paths based on some value. The third party code knows that value, and if it has internet access can exfiltrate it. In that sense, if there's an internet connection, there's not a meaningful difference between "the OS tells the service/app your age rating preference" and "the OS changes what it displays based on your age rating preference." Though while I'm throwing out fantasy policies we could solve this by banning pervasive surveillance outright.
panzi 8mo ago
Exactly. Except this way you can't build a complete biometric database if all citizen! Since it's so obvious how to do it correctly without creating such a database one could make the assumption the creation of such a database is the actual goal.
IndySun 8mo ago
Who decides the 'nature' of the content? Who decides what constitutes age appropriate? These questions of liberty are as old as the hills. And the keepers of the internet and virtually every single government past and present have repeatedly and endlessly shown themselves to be lying, conniving, self interested parties. When will 'we' ever learn? *who decides who 'we' are.
gzread 8mo ago
It's necessary if the page contains mixed content. Under your proposal, Google Search would need a separate search page that shows adult content, and that would be even worse for privacy - logs would show whether you accessed the adult search page - and adult sites (not only porn) would try quite hard to not be relegated to that second, less discoverable, search page.
- _heimdall 8mo ago
  What you're describing with Google Search already exists, search engines already offer their own search settings including "safe search" or whatever they call it which filters out adult images. Services can absolutely decide to provide their own content settings. It doesn't require a universal setting or OS requirements, and it doesn't require providing PII to every website or telling a central authority every site you visit.
avhception 8mo ago
I haven't even thought of this, I'm kinda surprised! This should be how it's done!
glitchc 8mo ago
Windows already allows this. Content can be set based on age in Microsoft Family. Set an age on a user's account and MS curates the store experience, regardless of which computer the user is logged into.
qzx_pierri 8mo ago
>Then, if the content is for adults and you're not one, your parents can configure your device not to display it. That would require people to be a responsible adult and actively parent their kids. It's ironic, because people in this country identify with how hard they grind at work, but refuse to put a fraction of that effort into being an involved parent. It's easier to just let the government ruin everyone else's good time online. In return, the parents: 1. Get the illusion that their kids are safer (they aren't) 2. Get a clear conscience, and feel better mentally equipped to run on their corporate hamster wheel
ethanwillis 8mo ago
My parents?

ray_v 8mo ago

It may often times be trickier than that - content often mixed of course. My 10 y/o hit me with a request yesterday to play Among Us where the age verification system wanted my full name, address, email, AND the last 4 digits of my SSN. I refused.

AnthonyMouse 8mo ago
> It may often times be trickier than that - content often mixed of course. So put the content tag at the granularity of the content.
- valleyer 8mo ago
  Honestly, <span content-filter-level="adult">fuck</span> that.
- onli 8mo ago
  Awesome. Now you have a system where every blog entry, every Facebook post needs a lawyer consultation. Around 20 years ago, Germany actually made a law that would have enforced such a system. I still have a chart in my blog that explained it, https://www.onli-blogging.de/1026/JMStV-kurz-erklaert.html https://www.onli-blogging.de/1026/JMStV-kurz-erklaert.html. Content for people over 16 would have to be marked accordingly or be put offline before 22:00, plus, if your site has a commercial character - which according to german courts is every single one in existence - you would need to hire a someone responsible for protecting teenagers and children (Jugenschutzbeauftragten). Result: It was seen as a big censor machine and I saw many sites and blogs shut down. You maybe can make that law partly responsible for how far behind german internet enterprises still are. Only a particular kind of bureaucrat wants to make business in an environment that makes laws such as this. Later the law wasn't actually followed. Only state media still has a system that blocks films for adults (=basically every action movie) from being accessed without age verification if not past 22:00.
  - AnthonyMouse 8mo ago
    > Now you have a system where every blog entry, every Facebook post needs a lawyer consultation. You have that with any form of any of these things. They're almost certainly going to be set up so that you get in trouble for claiming that adult content isn't but not for having non-adult content behind the adult content tag. Then you would be able to avoid legal questions by labeling your whole site as adult content, with the obvious drawback that then your whole site is labeled as adult content even though most of it isn't. But using ID requirements instead doesn't get you out of that. You'd still need to either identify which content requires someone to provide an ID before they can view it, or ID everyone. That's an argument for not doing any of these things, but not an argument for having ID requirements instead of content tags.
    - onli 8mo ago
      Funnily enough, marking content that's harmless as only for adults was also punishable, though that might have been in context of a different law. That would be censorship, blocking people under 18 from accessing legal content, was the reasoning. Welcome to German bureaucracy. But you are right. It's an argument that the "just mark content accordingly" is also not a better solution, not that ID requirements are in any way better. The only solution is not to enable this censorship infrastructure, because no matter which way it's done, it will always function as one.
      - AnthonyMouse 8mo ago
        > Funnily enough, marking content that's harmless as only for adults was also punishable, though that might have been in context of a different law. That would be censorship, blocking people under 18 from accessing legal content, was the reasoning. Welcome to German bureaucracy. That's how you get the thing where instead of using different equipment to process the food with and without sesame seeds, they just put sesame seeds in everything on purpose so they can accurately label them as containing sesame seeds.
        LinXitoW 8mo ago
cwillu 8mo ago
That's an argument for “let the service inform the parent and let the parent decide”, not against it.
alexfoo 8mo ago
There's a good chance that they're never going to verify any of the information you give them, in which case it's another download for Mr M Mouse of 1375 E Buena Vista Dr, 32830, with a SSN that ends in 1234.
- b112 8mo ago
  Giving fake info feeds the machine. It means you still consume, and a bad actor profits.
  - thbb123 8mo ago
    I disagree. Giving fake info adds noise to the mechanism, makes it useless. Ultimately I'm inclined to believe that privacy through noise generation is a solution. If I ever find some idle time, I'd like to make an agent that surfs the web under my identity and several fake ones, but randomly according to several fake personality traits I program. Then, after some testing and analysis of the generated patterns of crawl, release it as freeware to allow anyone to participate in the obfuscation of individuals' behaviors.
    - noam_k 8mo ago
      You might want to take a look at differential privacy. It takes an unintuitive amount of noise to make the system useless. You also need to account for how "easy" it is to de-anonymize a profile. (Sorry I don't have links to sources handy.)
      - aleph_minus_one 8mo ago
        > You might want to take a look at differential privacy Differential privacy is just a bait to make surveillance more socially acceptable and to have arguments to silence critics ("no need to worry about the dangers - we have differential privacy"). :-(
    - fsflover 8mo ago
      Sounds a bit like AdNauseam Firefox extension.
iso1631 8mo ago
It feels to me that parental controls are seen as another profit centre. If we want to put laws in place, we should be putting in laws to empower parents.
VLM 8mo ago
I would assume its fake and an attempt at identify theft at some level of the system. Is their PC infected at the OS level or just a fraudulent browser extension or something more like a popup ad masquerading as a system dialogue? A less trusting person would assume any request made by a computer is totally non-fraudulent and would gladly submit any requested private information. "Dad, I can't do my math homework, a pop up says you need to provide a copy of your bank statement, your mom's maiden name, and a copy of your birth certificate, SS card, and drivers license, and can you hurry up Dad, my homework is due tomorrow morning." And people will fall for this once they get used to the system being absurd enough. The fraud machine must be kept fed...
just6979 8mo ago
If the content is mixed, it makes even more sense to have the content supply the age data. This is how it has worked with broadcast media pretty much forever. TV shows and movies gain their ratings based on the worst case on display. IE: a show doesn't have to consist entirely of swearing to gain a "language" warning, it just has to have some. Definitively mixed content. I think your example exemplifies this. Among Us is not inherently adult-only, but since it's multiplayer, they don't control what other player say and do. Definitively mixed content. They should not be asking you to verify, they should be telling you and letting you decide if your kid can play. I kinda can't beleive their lawyers decided to go that route and assume all the PII responsibility that comes with collecting that data, instead of just making the "it's online and there might be d-bags on our servers" rating much more obvious and explicit.
- autoexec 8mo ago
  They can profit off of the personal data they collect, so it's no surprise they'd take any opportunity and use any available excuse to collect more of it. From their perspective there is effectively zero responsibility to secure that data properly and handle it safely because there are effectively zero consequences for companies when they fail to.

tuetuopay 8mo ago

Heh that's already what parental controls do (granted, the website don't report the content, and it's based on blacklists), but they are trivial to bypass. Even the article mention it: > The child can install a virtual machine, create an account on the virtual machine and set the age to 18 or over It's precisely how I worked around the parental control my parents put on my computer when I was ~12. Get Virtualbox, get a Kubuntu ISO, and voilà! The funniest is, I did not want to access adult content, but the software had thepiratebay on its blacklist, which I did want. In the end, I proudly showed them (look ma!), and they promptly removed the control from the computer, as you can't fight a motivated kid.

AnthonyMouse 8mo ago
> but they are trivial to bypass. That's assuming the parental controls allow the kid to create a virtual machine. And then that the kid knows how to create a virtual machine, which is already at the level of difficulty of getting the high school senior who is already 18 to loan you their ID. None of this stuff is ever going to be Fort Knox. Locks are for keeping honest people honest.
- Ntrails 8mo ago
  If the kid knows how to ask an llm, they can do whatever technical hacks are required
  - autoexec 8mo ago
    Would that make the LLM (or the company who made it) liable under the DMCA for showing someone how to work around a digital lock that controls access to a copyrighted work.
- tuetuopay 8mo ago
  We could argue on the technical feasability all day, as non-kvm qemu does not need any special permission to run a VM (albeit dog slow). I honestly don't really agree on the difficulty, as if this becomes a commonplace way to bypass such laws, you can expect tiktok to be full of videos about how to do it. People will provide already-installed VMs in a turnkey solution. It's not unlike how generations of kids playing minecraft learnt how to port forward and how to insatll VPNs for non-alleged-privacy reasons: something that was considered out of a kid's reach became a commodity. > None of this stuff is ever going to be Fort Knox. Locks are for keeping honest people honest. On that we agree, and it makes me sad. The gap between computer literate and illiterate will only widen a time passes. Non motivated kids will learn less, and motivated ones will get a kickstart by going around the locks.

idle_zealot 8mo ago

> Instead, the service should be telling your device the nature of the content. Then, if the content is for adults and you're not one, your parents can configure your device not to display it. That makes sense for purely offline media playback, but how could that work for a game or application or website? Ship several versions of the app for the different brackets and let the OS choose which to run? Then specifically design your telemetry to avoid logging which version is running? You'd also not be reporting your age, you'd be sending a "please treat me like an adult" or "please treat me like a child" flag. That's hardly PII. More like a dark/light mode preference, or your language settings (which your browser does send).

lavela 8mo ago
The shifts between flags will correlate with date of birth though, or do you think someone turning 16 or 18 will wait a year or two to switch to more adult content for privacy? Also I'd guess the tech industry would push for more specific age buckets. Games already have PG ratings and similar in different countries, I don't see the issue there. Web content could set a age appropriateness header and let browsers deal with it, either for specific content or for the whole website if it relies on e.g. addictive mechanics. Applications is a wide field, but I'd be interested in specific examples where you think it wouldn't work.
- idle_zealot 8mo ago
  > Applications is a wide field, but I'd be interested in specific examples where you think it wouldn't work. Sure. Take a game with voice chat. Child mode disables voice chat. How does the game, which presumably uses a load of telemetry, avoid incidentally leaking which users are children via the lack of voice telemetry data coming from the client? It's probably possible, but the fact is we're talking about third party code running on a computer, and the computer running different code paths based on some value. The third party code knows that value, and if it has internet access can exfiltrate it. In that sense, if there's an internet connection, there's not a meaningful difference between "the OS tells the service/app your age rating preference" and "the OS changes what it displays based on your age rating preference." Though while I'm throwing out fantasy policies we could solve this by banning pervasive surveillance outright.

panzi 8mo ago

Exactly. Except this way you can't build a complete biometric database if all citizen! Since it's so obvious how to do it correctly without creating such a database one could make the assumption the creation of such a database is the actual goal.

IndySun 8mo ago

Who decides the 'nature' of the content? Who decides what constitutes age appropriate? These questions of liberty are as old as the hills. And the keepers of the internet and virtually every single government past and present have repeatedly and endlessly shown themselves to be lying, conniving, self interested parties. When will 'we' ever learn? *who decides who 'we' are.

gzread 8mo ago

It's necessary if the page contains mixed content. Under your proposal, Google Search would need a separate search page that shows adult content, and that would be even worse for privacy - logs would show whether you accessed the adult search page - and adult sites (not only porn) would try quite hard to not be relegated to that second, less discoverable, search page.

_heimdall 8mo ago
What you're describing with Google Search already exists, search engines already offer their own search settings including "safe search" or whatever they call it which filters out adult images. Services can absolutely decide to provide their own content settings. It doesn't require a universal setting or OS requirements, and it doesn't require providing PII to every website or telling a central authority every site you visit.

avhception 8mo ago

I haven't even thought of this, I'm kinda surprised! This should be how it's done!

glitchc 8mo ago

Windows already allows this. Content can be set based on age in Microsoft Family. Set an age on a user's account and MS curates the store experience, regardless of which computer the user is logged into.

qzx_pierri 8mo ago

>Then, if the content is for adults and you're not one, your parents can configure your device not to display it. That would require people to be a responsible adult and actively parent their kids. It's ironic, because people in this country identify with how hard they grind at work, but refuse to put a fraction of that effort into being an involved parent. It's easier to just let the government ruin everyone else's good time online. In return, the parents: 1. Get the illusion that their kids are safer (they aren't) 2. Get a clear conscience, and feel better mentally equipped to run on their corporate hamster wheel

ethanwillis 8mo ago

My parents?