5 ms·

People need to understand the difference between age indication and age verification. Two very different things. Age indication is a completely private and real

People need to understand the difference between age indication and age verification. Two very different things. Age indication is a completely private and realistically as-effective alternative to the invasive age verification. Age _indication_ means that when you set up your device or create a user account, you enter a date of birth for the user. The OS then provides a native API to return a user's age bracket (not full date-of-birth). If the user is a minor, the OS will require parental authentication in some way to modify the setting again. This can all be done completely offline. It works because parents almost always buy the devices used by children, and can enter the correct date-of-birth during setup. Age _verification_ means that some online service has to verify your age, and collects a bunch of (meta)data in the process. This is highly problematic for privacy, security, and the open internet.

ekr____ 7mo ago
I like the term "age indication". Thank you. If I may nitpick, the conventional term for systems which attempt to determine the user's age is "age assurance". This covers a variety of techniques, which are typically broken down into: * Age estimation, which is based on statistical models of some physical characteristic (e.g., facial age estimation). * Age verification, which uses identity documents such as driver's licenses. * Age inference, which tries to determine the user's age range from some identifier, e.g., by using your email address to see how old your account is. These distinctions aren't perfect by any means, and it's not uncommon to see "age verification" used for all three of these together but more typically people are using "age assurance".
EmbarrassedHelp 7mo ago
The issue though with "age indication" is that it creates an additional flag that can be used to fingerprint users. But it is infinitely preferable to any sort of age verification or age assurance.
heavyset_go 6mo ago
It's a distinction that hinges on one law from one state that doesn't reflect the reality of the dozens of laws in dozens of states, nor proposed federal legislation, that all require age verification via AI face scans and ID uploads. That's to say, this distinction is meaningless unless you're planning on blocking every jurisdiction outside of California so you can just adhere to its age verification laws and no one else's.
Havoc 6mo ago
That's just setting things up for a smoother slippery slope... As appealing as the private part sounds I genuinely think it may make the situation worse here by facilitating the transition & muddying the waters
- user3939382 6mo ago
  We all have opinions, mine is you’re just incredibly naïve if you don’t understand that these laws are a shim to establish an eventual chain that links TPM to your license to end anonymous Internet usage.
  - gzread 6mo ago
    And you're incredibly naive if you think the TPM-linked internet usage isn't a shim to put a camera in your toilet bowl.
    - user3939382 6mo ago
      First they say they need your age, then they say they need proof. We already have a huge sudden trend of online services requiring your license, so your absurd comparison is a ridiculous non-sequitur.
- kelseyfrog 6mo ago
  Why reach for a slippery slope fallacy when plenty of other fallacies will do? Have you considered reworking your argument to use proof by assertion or even the moralistic fallacy[1]? You might get better milage out of those. 1. https://en.wikipedia.org/wiki/List_of_fallacies https://en.wikipedia.org/wiki/List_of_fallacies
txrx0000 6mo ago
There are two things very very wrong with the California law, which you call "age indication". 1) The parental responsibility is given to the wrong people. You're basically being forced by law to give all apps and websites your child's age on request, and then trusting those online platforms to serve the right content (lol). It should be the other way around. The apps and websites should broadcast the age rating of their content, and the OS fetches that age rating, and decides whether the content is appropriate by comparing the age rating to the user's age. The user's age, or age bracket, or any information about the user at all, should not leave the user's computer. 2) The age API is not "completely private". It's a legally-mandated data point that can be used to track a user across apps and websites. We must reject all legally-mandated tracking data points because it sets the precedent for even more mandatory tracking to be added in the future. We should not be providing an API that makes it easier for web platforms to get their hands on user data! For many years, certain tech companies, SIGs, and governments have fought against technologies that could enable real digital parenting, all while claiming to do the opposite and "protecting children". They craft a narrative to convince you that top-down digital surveillance and access-control is for your own good, but it's time we reject that and flip their narrative upside down: https://news.ycombinator.com/item?id=47472805 https://news.ycombinator.com/item?id=47472805
- heavyset_go 6mo ago
  > For many years, certain tech companies, SIGs, and governments have fought against technologies that could enable real digital parenting, all while claiming to do the opposite and "protecting children". They craft a narrative to convince you that top-down digital surveillance and access-control is for your own good, but it's time we reject that and flip their narrative upside down The EFF has a good series related to this[1]. [1] https://www.eff.org/deeplinks/2026/03/rep-finke-was-right-age-gating-isnt-about-kids-its-about-control https://www.eff.org/deeplinks/2026/03/rep-finke-was-right-ag...
- Ferret7446 6mo ago
  > The apps and websites should broadcast the age rating of their content, and the OS fetches that age rating, and decides whether the content is appropriate by comparing the age rating to the user's age. How would you make that happen? Many websites would not be subject to your jurisdiction.
ddtaylor 6mo ago
A pointless slippery slope to attempt to stand on that points directly at the Overton Window being drawn around this.
- dzikimarian 6mo ago
  Is it? A lot of parents uses Family Link and similar solutions, which are way more invasive than that.
  - ddtaylor 6mo ago
    Those are examples of software people choose to use voluntarily. The context here is government removing that choice and forcing you to use something under the conditions they set. I'm sure there are parental controls for many that go too far or not far enough. A reminder of why the government trying to solve parenting problems is likely to fail like most of their other attempts, such as failing to stop people from growing plants.
    - dzikimarian 6mo ago
      I agree to some extent, but who should make parental controls reasonable then? What corporations deliver is both invasive and ineffective.
      - ddtaylor 6mo ago
        The market decides. Google and Apple both compete and there are other disruptors. I worked on an education product in 2018 and it would contact third-party services like Khan Academy or Duolingo. And if a child had not earned enough measurable results, they would be unable to access non-educational content.
        dzikimarian 6mo ago
        Market is two companies who do not compete in this area at all, because Google literally earns on monetizing attention and Apple since Jobs era uses children as part of the strategy to lock you down in their ecosystem (see emails they had to make available to the court). There are zero serious disruptors and chance they'll appear gets smaller, because of push for device attestation being required for more and more apps. Making children do an hour of Duolingo before they access open internet is hardly the goal. It's more about limiting their exposure to brain rot content. Existing tool would require you to block it domain-by-domain. Honestly I can't see less invasive solution for that tool to work than page broadcasting age-rating with http response and device being aware it's owned by minor and refusing to display it.
shevy-java 6mo ago
In both cases the operating system stores information it has zero business with.
- gzread 6mo ago
  The operating system already stores your full name. Isn't that a problem?
  - MarsIronPI 6mo ago
    Not necessarily your real full name. Plus on Unix systems full name is not a required field in /etc/passwd.
    - gzread 6mo ago
      Not necessarily your real age. Plus on Unix systems age is not a required field in /etc/passwd.
cmovq 6mo ago
> The OS then provides a native API to return a user's age bracket (not full date-of-birth) Call the API every day, when the age bracket changes you can infer the date-of-birth.
rixed 6mo ago
Most importantly, people need to understand how indication leads to verification.
fasterik 6mo ago
The distinction doesn't matter in this case. The fundamental question is whether a government can compel a decentralized open-source project to change its codebase. If you believe code is speech, it's a violation of the right to free expression. Even if you think adding "age indication" to a project is harmless, you have to consider the precedent this is setting for compelled speech in the future, potentially by regimes that you are not politically aligned with.

ekr____ 7mo ago

I like the term "age indication". Thank you. If I may nitpick, the conventional term for systems which attempt to determine the user's age is "age assurance". This covers a variety of techniques, which are typically broken down into: * Age estimation, which is based on statistical models of some physical characteristic (e.g., facial age estimation). * Age verification, which uses identity documents such as driver's licenses. * Age inference, which tries to determine the user's age range from some identifier, e.g., by using your email address to see how old your account is. These distinctions aren't perfect by any means, and it's not uncommon to see "age verification" used for all three of these together but more typically people are using "age assurance".

EmbarrassedHelp 7mo ago

The issue though with "age indication" is that it creates an additional flag that can be used to fingerprint users. But it is infinitely preferable to any sort of age verification or age assurance.

heavyset_go 6mo ago

It's a distinction that hinges on one law from one state that doesn't reflect the reality of the dozens of laws in dozens of states, nor proposed federal legislation, that all require age verification via AI face scans and ID uploads. That's to say, this distinction is meaningless unless you're planning on blocking every jurisdiction outside of California so you can just adhere to its age verification laws and no one else's.

Havoc 6mo ago

That's just setting things up for a smoother slippery slope... As appealing as the private part sounds I genuinely think it may make the situation worse here by facilitating the transition & muddying the waters

user3939382 6mo ago
We all have opinions, mine is you’re just incredibly naïve if you don’t understand that these laws are a shim to establish an eventual chain that links TPM to your license to end anonymous Internet usage.
- gzread 6mo ago
  And you're incredibly naive if you think the TPM-linked internet usage isn't a shim to put a camera in your toilet bowl.
  - user3939382 6mo ago
    First they say they need your age, then they say they need proof. We already have a huge sudden trend of online services requiring your license, so your absurd comparison is a ridiculous non-sequitur.
kelseyfrog 6mo ago
Why reach for a slippery slope fallacy when plenty of other fallacies will do? Have you considered reworking your argument to use proof by assertion or even the moralistic fallacy[1]? You might get better milage out of those. 1. https://en.wikipedia.org/wiki/List_of_fallacies https://en.wikipedia.org/wiki/List_of_fallacies

txrx0000 6mo ago

There are two things very very wrong with the California law, which you call "age indication". 1) The parental responsibility is given to the wrong people. You're basically being forced by law to give all apps and websites your child's age on request, and then trusting those online platforms to serve the right content (lol). It should be the other way around. The apps and websites should broadcast the age rating of their content, and the OS fetches that age rating, and decides whether the content is appropriate by comparing the age rating to the user's age. The user's age, or age bracket, or any information about the user at all, should not leave the user's computer. 2) The age API is not "completely private". It's a legally-mandated data point that can be used to track a user across apps and websites. We must reject all legally-mandated tracking data points because it sets the precedent for even more mandatory tracking to be added in the future. We should not be providing an API that makes it easier for web platforms to get their hands on user data! For many years, certain tech companies, SIGs, and governments have fought against technologies that could enable real digital parenting, all while claiming to do the opposite and "protecting children". They craft a narrative to convince you that top-down digital surveillance and access-control is for your own good, but it's time we reject that and flip their narrative upside down: https://news.ycombinator.com/item?id=47472805 https://news.ycombinator.com/item?id=47472805

heavyset_go 6mo ago
> For many years, certain tech companies, SIGs, and governments have fought against technologies that could enable real digital parenting, all while claiming to do the opposite and "protecting children". They craft a narrative to convince you that top-down digital surveillance and access-control is for your own good, but it's time we reject that and flip their narrative upside down The EFF has a good series related to this[1]. [1] https://www.eff.org/deeplinks/2026/03/rep-finke-was-right-age-gating-isnt-about-kids-its-about-control https://www.eff.org/deeplinks/2026/03/rep-finke-was-right-ag...
Ferret7446 6mo ago
> The apps and websites should broadcast the age rating of their content, and the OS fetches that age rating, and decides whether the content is appropriate by comparing the age rating to the user's age. How would you make that happen? Many websites would not be subject to your jurisdiction.

ddtaylor 6mo ago

A pointless slippery slope to attempt to stand on that points directly at the Overton Window being drawn around this.

dzikimarian 6mo ago
Is it? A lot of parents uses Family Link and similar solutions, which are way more invasive than that.
- ddtaylor 6mo ago
  Those are examples of software people choose to use voluntarily. The context here is government removing that choice and forcing you to use something under the conditions they set. I'm sure there are parental controls for many that go too far or not far enough. A reminder of why the government trying to solve parenting problems is likely to fail like most of their other attempts, such as failing to stop people from growing plants.
  - dzikimarian 6mo ago
    I agree to some extent, but who should make parental controls reasonable then? What corporations deliver is both invasive and ineffective.
    - ddtaylor 6mo ago
      The market decides. Google and Apple both compete and there are other disruptors. I worked on an education product in 2018 and it would contact third-party services like Khan Academy or Duolingo. And if a child had not earned enough measurable results, they would be unable to access non-educational content.
      - dzikimarian 6mo ago
        Market is two companies who do not compete in this area at all, because Google literally earns on monetizing attention and Apple since Jobs era uses children as part of the strategy to lock you down in their ecosystem (see emails they had to make available to the court). There are zero serious disruptors and chance they'll appear gets smaller, because of push for device attestation being required for more and more apps. Making children do an hour of Duolingo before they access open internet is hardly the goal. It's more about limiting their exposure to brain rot content. Existing tool would require you to block it domain-by-domain. Honestly I can't see less invasive solution for that tool to work than page broadcasting age-rating with http response and device being aware it's owned by minor and refusing to display it.

shevy-java 6mo ago

In both cases the operating system stores information it has zero business with.

gzread 6mo ago
The operating system already stores your full name. Isn't that a problem?
- MarsIronPI 6mo ago
  Not necessarily your real full name. Plus on Unix systems full name is not a required field in /etc/passwd.
  - gzread 6mo ago
    Not necessarily your real age. Plus on Unix systems age is not a required field in /etc/passwd.

cmovq 6mo ago

> The OS then provides a native API to return a user's age bracket (not full date-of-birth) Call the API every day, when the age bracket changes you can infer the date-of-birth.

rixed 6mo ago

Most importantly, people need to understand how indication leads to verification.

fasterik 6mo ago

The distinction doesn't matter in this case. The fundamental question is whether a government can compel a decentralized open-source project to change its codebase. If you believe code is speech, it's a violation of the right to free expression. Even if you think adding "age indication" to a project is harmless, you have to consider the precedent this is setting for compelled speech in the future, potentially by regimes that you are not politically aligned with.