10 ms·

The only device mandates that should be taking place is for the default installations of web clients should be checking to see if parental controls are enabled.

by Bender 5mo ago

The only device mandates that should be taking place is for the default installations of web clients should be checking to see if parental controls are enabled. This only impacts the major browsers. An intern at each browser company could add this check in minutes. If they are enabled and the person logged in is on a regular account (not admin or power user of sorts) then the base installation of web clients must check for an RTA header [1]. If present, prompt for a override password and also give the option for the admin to approve-list the domain at that time. That's it. Not perfect, nothing is or will be. The only thing server, platform, website, service providers should be doing is setting an RTA header if the content could possibly be adult or user-contributed content that could dynamically become adult, moderation aside. This knocks out two issues with one fix. Small children don't see much if any adult content and they are kept off social media until the admin (parent or legal guardian) approves it. If a site is not adding the RTA header then progressively fine them into oblivion. If they accept the fines as the cost of doing business then seize everything and put everyone in GenPop. An intern could enable the header in 5 minutes. All legislation regarding age verification must revolve around this otherwise people must reject it as an abusive form of tracking and privacy invasion. The focus should be on small children as teen share porn, warez, movies and such within Rated-G games. [1] - https://news.ycombinator.com/item?id=47950091 https://news.ycombinator.com/item?id=47950091

jahnu 5mo ago
Has this idea been discussed when drafting legislation? I mean are they aware of it but dismissed it for any reason or no stated reasons?
- Bender 5mo ago
  I've emailed politicians as have others but only received boilerplate thankyou's. I suspect the real reason is kick-backs but they will never admit it. No harm in people reaching out to their politicians state and federal. The more people that bring it up the better. Let them know your childrens data will not be shared and when the data is leaked you will hold the politicians accountable.
  - SilverElfin 5mo ago
    Yep, they get funding from companies like meta and their insiders
    - reddalo 5mo ago
      Exactly. More laws about internet services = less new competitors coming into the market, because the barriers to entry are too high.
      - Bender 5mo ago
        Well, if the concern is they might miss out on revenue from a small child accessing their site and they are not a child specific site then perhaps they should be pushed out of the market one way or another.
        reddalo 5mo ago
        No, what I mean is that adding a lot of laws to let websites be legal (age verification, GDPR, etc.) adds a huge burden and that prevents new small websites from even existing.
        Bender 5mo ago
        All I am proposing is that websites that may contain adult material add a header. That's hobby level effort. Small companies using a CDN or platform provider can either add the header in the CDN, check a box if this were to take off or open a ticket asking to add the header.
  - maccard 5mo ago
    I’m not in the US but assuming everyone who disagrees with you is receiving kickbacks is a bit much. I agree this is a terrible idea and doesn’t make sense past a few seconds of thinking but the reality is it’s very popular with an awful lot of people.
wizardforhire 5mo ago
Thats crazy talk, how are we gonna build a database of computers tied to physical identification of users by which we can monitor, control, and monetize… you’re saying parents should be responsible for their children? How is the state going to be able to exert more control if it doesn’t have ubiquitous surveillance of it’s population!? /s
themafia 5mo ago
> An intern at each browser company could add this check in minutes. An intern could also just delete the product which would also "solve" this "issue". The fact that it's easy or cheap is not significant to the problem at hand. > should be doing is setting an RTA header Many sites will just set the header by default. Now you've created a problem. > then progressively fine them into oblivion. This does nothing. See: Ofcom vs 4chan. > device mandates Mandate that the device provide an API for child protection software. Then it's up to individual parents to decide to install that software or not. Then we also get competition in this market rather than relying on whatever solution an intern cooked up one day.
- Bender 5mo ago
  On the topic of 4chan [1] Many sites will just set the header by default. Now you've created a problem. I am not seeing a problem. Kids need not access those sites unless the parent or legal guardian approves it. Sites meant for children would not be adding the header. [1] - https://news.ycombinator.com/item?id=47953096 https://news.ycombinator.com/item?id=47953096
  - themafia 5mo ago
    > Sites meant for children would not be adding the header. Is Wikipedia "meant for children?" Should they be fully denied access to it? Should Wikimedia be fined if they make a mistake? If they get fined often enough do you think they'll just turn the header on everywhere in order to avoid risk? Replace Wikipedia with any other mixed content site you prefer.
    - Bender 5mo ago
      Child specific sites would not add the header. Anyone else could. I add it to my hobby sites. Some porn sites already add it to their sites [1]. Shodan can't reach my sites. I do not want small children on my blogs. Add it to any site not specifically meant for children, that is totally fine. [1] - https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-RTA https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-R... [ Follow Links At Your Own Peril ]
pessimizer 5mo ago
Absolutely trivial and totally comprehensive solution, enabling adult content blocking at the account level, device level, network level, and the ISP level. Could even be expanded to any sort of content blocking, if you want to allow households to restrict access to vaccine critique or criticism of the king without violating the First Amendment or rooting everyone's devices. The problem is that the point is to root everyone's devices. Anyone explaining how easy this is would be pushed out of the conversation as fast as if they were advocating for single-payer healthcare. edit: I've been advocating the nearly identical but opposite solution - restricted access sites shouldn't respond to requests that lack an appropriate age/content restriction header. If they do, jail them. They're literally going to have to do this anyway. Rooting people's devices to force them to lie about their age when they install their operating system is an absolutely fake pretendy solution; the only way it works is if you have to verify your age with some government agency when you install an operating system, in order to make that OS age official. The point is the identification.
- salawat 5mo ago
  No. That requires information disclosure to a third party. The point is enabling device admins better control over local device behavior. We're trying to keep conscientious parents able to do their thing. Not further enable the ability to manage the populace with official registries. If a kid can figure out how to install their own OS without their parent's help, odds are the kid is with it enough to start dipping their toes in the deep end. Or at least until they out themselves in front of their parents. In that case though it's a home problem, not a rest of the Internet problem. It's still a stupid unconstitutional law, but I see what the aim is, even without strawmanning it.
- Bender 5mo ago
  Imagine having to police the OS installations at everyone's home. It's dangerous enough to serve warrants to known felons at known locations. I would not want to be the paramilitary officer going door to door having to be ready to flashbang the family or worse. I don't know if there are even words to describe the PTSD that all the enforcers and families would have. Someone in North Korea probably has the words to describe this.
skybrian 5mo ago
I largely agree, but the RTA header doesn't seem to be good enough for most websites to use. When a website wants to block browsers with parental controls on, but it isn't porn and it shouldn't be blocked by SafeSearch, what do they do? https://webmasters.stackexchange.com/questions/140733/how-to-give-a-website-a-content-rating-beyond-just-adult https://webmasters.stackexchange.com/questions/140733/how-to...
- Bender 5mo ago
  what do they do? They stop trying to put everything in a different category and treat RTA as the person under the age of consent must get approval from their parent or legal guardian. Keep it simple.
  - skybrian 5mo ago
    That's too simple to get much adoption. It's unreasonable to expect websites to drop out of Google search.
    - Bender 5mo ago
      Google and others can adapt. RTA header? Added to potential adult or user-contributed category.
      - lazyasciiart 5mo ago
        Right, no news sites for kids.
        Bender 5mo ago
        Right, no news sites for kids. Correct. Until parent or guardian puts in password next to the text that says "Approve this site, forever." You gave me an idea. Maybe there could be categories similar in concept to those that exist in corporate firewalls today that say things like: - News Category (Known to be SFW) - News Category (That may be NSFW) - Child friendly sites - Social media sites ... and so on. This could be crowd sourced, ideally in a way that can not be gamed. The masses could flag/report false claims. That, or just keep it simple. ad-hoc input of permitted sites by parent.
delusional 5mo ago
A) Aren't you targeting a completely different problem than this law? It's my understanding that this law targets the collection of the age from the user. What the user agent does with that signal is a different problem, and seems to already be solved, except for the definition of "actual knowledge" which they are trying to establish here. B) How would your RTA header intersect with content rating in different jurisdictions? What if the content is illegal for children in Turkey but legal for children in Kentucky?
- Bender 5mo ago
  For topic (A) I am suggesting to negate this behavior all together. No more sharing personal data. That evil-pattern must be stopped. For topic (B) companies can set or not set the header based on GeoIP. Not perfect but GeoIP is already used in load balancers, web servers and applications.
  - delusional 5mo ago
    For (A) we have nothing to talk about. I think we fundamentally disagree about how society functions, and we aren't going to knock that out over hackernews. For (B), your proposal requires the website have a database over current rules in every country they would be accessible from. Would a website then, in your opinion, be responsible for the accuracy of this database? We have to presuppose an official GeoIP source that would then be legally binding and under democratic control, but given such a database, would a website serving a wrong header to an IP associated with a specific country then be committing a crime in that country? What would the punishment be?
    - Bender 5mo ago
      For (A) I guess you are right, we won't agree. I do like your username however. For (B) this is already a thing. Porn sites and already doing this. Instead of blocking a region I am proposing to stop blocking and instead the law permit them to just add a header. The only people I can imagine apposing this are commercial VPN providers.
iamalizard 5mo ago
No such mandates should take place at all.
- Bender 5mo ago
  I agree fundamentally and ideologically but we are past that point. The toothpaste is already out of the tube as they say. There will be restrictions so all I can do is suggest more sensible restrictions that keep the control on the client side and do not share data. Any data shared can and will be abused, leaked, sold, stolen without consequence.
  - yetta 5mo ago
    No we aren't. Also you can put toothpaste in tubes or it wouldn't be in there. Hope that helps!
  - AdrianB1 5mo ago
    I heard that lie about "sensible restrictions" so many times, now I am waiting for "sensible violence", "sensible beating to death" and so on. It is a false argument that "there will be restrictions so all I can do is suggest more sensible restrictions", what you can do is recognize that "no restrictions is an option". It is like negotiating with a terrorist that wants to kill you and this is his starting position and then he wants to agree on some compromise, like seriously beating you. There is no negotiation.
    - Bender 5mo ago
      No harm in pushing for no restrictions at all. I support this idea.
    - fc417fc802 5mo ago
      > now I am waiting for "sensible violence" That exists and is called "self defense", no?
  - shevy-java 5mo ago
    We are not past the point at all. Any democracy can ultimately decide on laws and regulation. Why would you wish to insinuate otherwise here? California could easily decide to not implement such laws, for instance. That data leaks out is always a given. So, gather less data. Ideally none. But this is not a discussion about data. This is a discussion as to what state actors think they are allowed to do. It is an attack on private life of people. See the combined strike against VPNs.
ekr____ 5mo ago
> The only device mandates that should be taking place is for the default installations of web clients should be checking to see if parental controls are enabled. This only impacts the major browsers. An intern at each browser company could add this check in minutes. If they are enabled and the person logged in is on a regular account (not admin or power user of sorts) then the base installation of web clients must check for an RTA header [1]. If present, prompt for a override password and also give the option for the admin to approve-list the domain at that time. That's it. Not perfect, nothing is or will be. It's useful to contrast this with the various device-based mandates that have been created in order to get a sense of what legislators seem to be trying to do. With that in mind, a few points: * What you are proposing allows parents to opt in via parental controls, but age assurance mandates (both device-side and server-side) tend to require positive action to enter unrestricted modes. In some cases (CA AB 1043, for instance), this is just a matter of entering your age. In others, you actually need to demonstrate your age via some technical mechanism. * While many age assurance mandates focus on adult content, which is primarily consumed via the Web, others (e.g., Australia's Social Media Minimum Age) focus on social networking, which is primarily consumed via apps, so anything that is Web only will not be effective. * Site-level granularity isn't really fine enough in some cases. For example, the New York SAFE for Kids act prohibits certain behaviors such as algorithmic recommendations when a user is a minor, but doesn't require blocking minor usage entirely. It's potentially possible to implement this with something like RTA, but it would have to at minimum be at much finer granularity. Section VI of https://kgi.georgetown.edu/wp-content/uploads/2026/01/Age_Assurance_Online_Technical-Assessment_Report_KGI.pdf https://kgi.georgetown.edu/wp-content/uploads/2026/01/Age_As... goes into quite a bit more detail about various architectures (disclaimer, I'm an author). None of this is an endorsement of age assurance techniques; I'm just trying to help flesh out the situation. > All legislation regarding age verification must revolve around this otherwise people must reject it as an abusive form of tracking and privacy invasion. It's a bit late for that, given that around half of US states already have some kind of age assurance mandate.
- Bender 5mo ago
  It's a bit late for that, given that around half of US states already have some kind of age assurance mandate. Perhaps late to solve this globally but parents can still install parental control software if they so desire and can still intervene locally to prevent sharing data with 3rd parties. At worst this means small children might not get to visit social media and other assorted sites and I am fine with that. I think a number of parents would be fine with that as well. Sites can voluntarily label as some do. It just means that parental controls would have to default to blocking everything until approved and while sub-optimal maybe that's what people will have to do in order to avoid the evil pattern of sharing data with all the websites that will ultimately leak, or "leak", be sold, stolen, etc... Good parents will not participate in the evil patterns of sharing their children's personally identifiable information. When the PII of children is ultimately shared with evil people the children once adults will resent their parents for not protecting them. - To all parents here, your children have no idea what risks are out there including devious companies that want their data. They will one day be adults if all goes well. Protect your children as corporations and governments will not. They will thank you when they find out all their friends data was shared, leaked or otherwise abused forever.
codedokode 5mo ago
I think the header/metatag is designed poorly. The RTA proposal is that every operator of every site must verify the content and add the header to mark the site as "safe" or "unsafe". This is unnecessary burden that they have to bear if this proposal is given a green light and this is wrong. Instead, the default should be, that if there is no header or it cannot be parsed, then the content is unsafe. And if there is a header, it describes the page rating, like what kind of dangerous content it may contain. The header may be added to any displayable content like HTML, text, images, audio or videos, but not to machine-readable content like JS files or AJAX responses. So only those who wants their site to be accessible by minors, have to add headers. For social networks, the user might have an option to mark his content as "safe". This means that with my proposal existing site operators need not to do anything to mark their sites as "unsafe" - all sites are "unsafe" by default. This means that millions of site operators need to spend 0 dollars to adapt their sites. How great is that? The browser on a device with parent mode, should not allow displaying any content which doesn't have a header or that is marked as unsafe, or that contains header with invalid value. The parents may whitelist some sites. There should be a reponsibility for intentionally marking unsafe content as "safe". We should also think what to do with foreign operators, intentionally putting invalid headers for unsafe content. Maybe they should be added to some kind of blacklist that the browsers would periodically update. Search engines like Google could work by default in "safe" mode, but add "unsafe" header if the user wants to turn off restrictions. > If a site is not adding the RTA header then progressively fine them into oblivion. I think my proposal is better because it requires only fining those who intentionally misrepresent content safety.
- Bender 5mo ago
  For what its worth this header has been around for a very long time. It's actually the second iteration and much simpler than it's predecessor. Parents today can accomplish what you are suggesting by installing parental control software and only allowing access to things they explicitly approve. This can also be done via headers explicit blocking of all the things and was suggested in another thread. [1] Some people liked the idea. [1] - https://news.ycombinator.com/item?id=47952999 https://news.ycombinator.com/item?id=47952999
tzs 5mo ago
> If they are enabled and the person logged in is on a regular account (not admin or power user of sorts) then the base installation of web clients must check for an RTA header [1]. Your cite is an earlier post of yours which says > The one and only method I will participate in is server operators setting a RTA header [1] and that cites a still earlier post of yours > I stand by my repeated statements of how this could have been solved simply using an RTA header [1] which finally actually cites¹ something that explains what the heck on RTA header is. It would be quite a bit more reader friendly to cite https://www.rtalabel.org/page.php https://www.rtalabel.org/page.php rather than make the reader traverse a linked list of comments to get there. ¹https://www.rtalabel.org/page.php https://www.rtalabel.org/page.php
lxe 5mo ago
Bold of you to assume that lawmakers have any common sense when it comes to technology legislation. It could have taken 3 interns 3 hours at each browser company to implement a cookie consent standard 15 years ago, yet here we are in cookie banner hell.
- Bender 5mo ago
  I was referring to the intern being able to add the header. Politicians need financial incentive. I don't have the resources to lobby them. I think that might require a philanthropist should there happen to be one that lurks on HN. There are some interesting people that lurk here that we sometimes learn about. They can't do anything today as it is a federal holiday but they could do something tomorrow.
- gsich 5mo ago
  DNT exists, not even that is honored by websites. There is no need for a cookie banner for technical cookies.
  - kube-system 5mo ago
    DNT is deprecated by W3C, and browsers have been removing it
- daemin 5mo ago
  Cookie banners exist because it is a dark pattern companies use to get you to opt into marketing cookies by making the easiest thing the worst choice. This could all be handled by settings in the browser, only if the sites themselves listened to the users' browser preferences.
  - vincnetas 5mo ago
    Agree. Its like in some countries you put a sticker on the mail box "no advertisement, please" and its illegal tor postman to deliver you ad brochures. Same could have been possible with browsers, but oh no, now you have to go out to each postman ant tell him explicitly that you do not want ads, and postman has no memory, if you tel him that you don't want ads. He can come back ten minutes later and you have to tell him again.
kelnos 5mo ago
How does this work for mixed-content sites? Like say a minor visits a video sharing or social media site and the default feed/recommendations list includes stuff that should be age-restricted, but is mostly stuff that shouldn't be. The entire site shouldn't be blocked; the browser needs a way to tell the website "my parental controls are enabled and I need to you to filter out age-restricted content". Alternatively, the RTA header/meta could include a parameter/attribute for an "alternate URL" to load when parental controls are enabled. This could be useful to allow sites to present a custom error-type response, but could also be used to automatically redirect the user to similar, but age-appropriate, content. Anyway, this all ignores the fact that "protect the children" isn't really the goal here: it's to slowly eat away at our ability to be anonymous (even read-only anonymous) on the internet. Age verification is just a watered-down way of saying they require positive identification, and eventually our hardware will have to cryptographically attest we are who we say we are. I really hope this isn't inevitable, but it's starting to feel that way.
- Ajedi32 5mo ago
  Once you have a content label header it's pretty easy to build more complicated systems on top of that. Like the site could send "compliant with x regulation" in the content labeling header, and then that would tell the kid's browser it doesn't have to completely block the page but can instead reload the page with a request header saying "filter out a, b, and c content" and expect that to be complied with. That could be a fingerprinting vector though so maybe depending on privacy settings it just blocks the page. Really these are all solvable problems that web standards orgs have dealt with before; you just need to create the incentive for such systems to exist.
idiotsecant 5mo ago
You make the mistake of solving the stated problem, and not the actual problem. This was never about children, or a solution like what you describe would be trivial.
pkphilip 5mo ago
However, this is not about age verification or protecting children. That is just the excuse they are using. If Meta, Google etc could easily have algorithms in place for determining the age of the person seeing the video - apart from having the override capability via a parental login as you have stated.. but these platforms have consistently refused to limit the type of content they are showing to children.
- maccard 5mo ago
  YouTube has this. It’s YouTube Kids. You can argue all day over whether it’s good enough but they do have this offering.
teekert 5mo ago
Well sure, such a solution may solve age verification elegantly, but does it serve the interests of the companies that pushed this bill?
raxxorraxor 5mo ago
That is the only real solution. It removes the lobbyists with their bad verification schemes and untrustworthy software. You don't need untrusty flaggers or untrustworthy official authorities. In no way can nations be responsible enough to not attempt constant sniffing attempts. My nation couldn't keep itself from spying of corona app users. This can also be broadly implemented, any other technical solution won't be widely spread anyway. I don't think authorities care about child protection though. They could have legislated malicious advertising practices and a lot of similar bad influences, but didn't.
bawolff 5mo ago
> The only thing server, platform, website, service providers should be doing is setting an RTA header if the content could possibly be adult or user-contributed content that could dynamically become adult, moderation aside....If a site is not adding the RTA header then progressively fine them into oblivion. Seems like this would incentivize just all sites to have the header regardless of if it meets the definition since you get fined if you dont but no fine if you have the header unneccesarily. Especially if your definition is contains user contributed content. That is all sites with a comment field. What really is left? I'm not sure i have even visited a site in the last month that wouldn't fall under this.
tardedmeme 5mo ago
That's basically what this law was though. Are you cheering for them removing the law that said exactly what you wanted?
kleiba2 5mo ago
This assumes that the goal is child protection, while the actual goal is user profiling and ad revenue.
miki123211 5mo ago
Three things: 1. This assumes that websites are under your jurisdiction and can be fined. This is not a valid assumption on the internet. If you want to do this, you need a framework to block noncompliant websites via ISP-side null-routing, putting pressure on payment processors and hosting companies which do operate in your country etc. 2. HTML tags and not HTTP headers. If just a small part of the site contains content which shouldn't be displayed, the web browser should just hide that part. 3. Sometimes, it is genuinely useful to know the user's restrictions ahead of time. Imagine you're a movie streaming site or game store. You have some content which is suitable for the user, no matter their age, but you need to know which bracket they're in to decide what to show them. Without that info, you either default-adult (which sucks for children) or default-child (which sucks for adults).
- raxxorraxor 5mo ago
  No, I don't think any of that follows from that. The header can be set in the initial communication attempt. It is even more specific than any other mechanism to verify your age, because this header can be set appropriately for any web resource. The problem of hosts in countries that don't give a shit is true for every solution aside from the great all blocking firewall no developed nation would want to have. So no to "ISP null routing" from me. ISPs provide infrastructure. They are not school teachers. Such a solution implemented today would be tunnelled yesterday and everyone should support evasion attempts.
- Bender 5mo ago
  Countries that do not follow it could in theory be BGP filtered or sanctioned. I doubt that would happen. Probably more like the country would be added to parental controls in the browsers and parents could de-select a checkbox that is checked by default saying to block that country. If that were a thing I think some people would be enabling parental controls on themselves just to filter out some shenanigans.

by Bender 5mo ago

jahnu 5mo ago

Has this idea been discussed when drafting legislation? I mean are they aware of it but dismissed it for any reason or no stated reasons?

Bender 5mo ago
I've emailed politicians as have others but only received boilerplate thankyou's. I suspect the real reason is kick-backs but they will never admit it. No harm in people reaching out to their politicians state and federal. The more people that bring it up the better. Let them know your childrens data will not be shared and when the data is leaked you will hold the politicians accountable.
- SilverElfin 5mo ago
  Yep, they get funding from companies like meta and their insiders
  - reddalo 5mo ago
    Exactly. More laws about internet services = less new competitors coming into the market, because the barriers to entry are too high.
    - Bender 5mo ago
      Well, if the concern is they might miss out on revenue from a small child accessing their site and they are not a child specific site then perhaps they should be pushed out of the market one way or another.
      - reddalo 5mo ago
        No, what I mean is that adding a lot of laws to let websites be legal (age verification, GDPR, etc.) adds a huge burden and that prevents new small websites from even existing.
        Bender 5mo ago
        All I am proposing is that websites that may contain adult material add a header. That's hobby level effort. Small companies using a CDN or platform provider can either add the header in the CDN, check a box if this were to take off or open a ticket asking to add the header.
- maccard 5mo ago
  I’m not in the US but assuming everyone who disagrees with you is receiving kickbacks is a bit much. I agree this is a terrible idea and doesn’t make sense past a few seconds of thinking but the reality is it’s very popular with an awful lot of people.

wizardforhire 5mo ago

Thats crazy talk, how are we gonna build a database of computers tied to physical identification of users by which we can monitor, control, and monetize… you’re saying parents should be responsible for their children? How is the state going to be able to exert more control if it doesn’t have ubiquitous surveillance of it’s population!? /s

themafia 5mo ago

> An intern at each browser company could add this check in minutes. An intern could also just delete the product which would also "solve" this "issue". The fact that it's easy or cheap is not significant to the problem at hand. > should be doing is setting an RTA header Many sites will just set the header by default. Now you've created a problem. > then progressively fine them into oblivion. This does nothing. See: Ofcom vs 4chan. > device mandates Mandate that the device provide an API for child protection software. Then it's up to individual parents to decide to install that software or not. Then we also get competition in this market rather than relying on whatever solution an intern cooked up one day.

Bender 5mo ago
On the topic of 4chan [1] Many sites will just set the header by default. Now you've created a problem. I am not seeing a problem. Kids need not access those sites unless the parent or legal guardian approves it. Sites meant for children would not be adding the header. [1] - https://news.ycombinator.com/item?id=47953096 https://news.ycombinator.com/item?id=47953096
- themafia 5mo ago
  > Sites meant for children would not be adding the header. Is Wikipedia "meant for children?" Should they be fully denied access to it? Should Wikimedia be fined if they make a mistake? If they get fined often enough do you think they'll just turn the header on everywhere in order to avoid risk? Replace Wikipedia with any other mixed content site you prefer.
  - Bender 5mo ago
    Child specific sites would not add the header. Anyone else could. I add it to my hobby sites. Some porn sites already add it to their sites [1]. Shodan can't reach my sites. I do not want small children on my blogs. Add it to any site not specifically meant for children, that is totally fine. [1] - https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-RTA https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-R... [ Follow Links At Your Own Peril ]

pessimizer 5mo ago

Absolutely trivial and totally comprehensive solution, enabling adult content blocking at the account level, device level, network level, and the ISP level. Could even be expanded to any sort of content blocking, if you want to allow households to restrict access to vaccine critique or criticism of the king without violating the First Amendment or rooting everyone's devices. The problem is that the point is to root everyone's devices. Anyone explaining how easy this is would be pushed out of the conversation as fast as if they were advocating for single-payer healthcare. edit: I've been advocating the nearly identical but opposite solution - restricted access sites shouldn't respond to requests that lack an appropriate age/content restriction header. If they do, jail them. They're literally going to have to do this anyway. Rooting people's devices to force them to lie about their age when they install their operating system is an absolutely fake pretendy solution; the only way it works is if you have to verify your age with some government agency when you install an operating system, in order to make that OS age official. The point is the identification.

salawat 5mo ago
No. That requires information disclosure to a third party. The point is enabling device admins better control over local device behavior. We're trying to keep conscientious parents able to do their thing. Not further enable the ability to manage the populace with official registries. If a kid can figure out how to install their own OS without their parent's help, odds are the kid is with it enough to start dipping their toes in the deep end. Or at least until they out themselves in front of their parents. In that case though it's a home problem, not a rest of the Internet problem. It's still a stupid unconstitutional law, but I see what the aim is, even without strawmanning it.
Bender 5mo ago
Imagine having to police the OS installations at everyone's home. It's dangerous enough to serve warrants to known felons at known locations. I would not want to be the paramilitary officer going door to door having to be ready to flashbang the family or worse. I don't know if there are even words to describe the PTSD that all the enforcers and families would have. Someone in North Korea probably has the words to describe this.

skybrian 5mo ago

I largely agree, but the RTA header doesn't seem to be good enough for most websites to use. When a website wants to block browsers with parental controls on, but it isn't porn and it shouldn't be blocked by SafeSearch, what do they do? https://webmasters.stackexchange.com/questions/140733/how-to-give-a-website-a-content-rating-beyond-just-adult https://webmasters.stackexchange.com/questions/140733/how-to...

Bender 5mo ago
what do they do? They stop trying to put everything in a different category and treat RTA as the person under the age of consent must get approval from their parent or legal guardian. Keep it simple.
- skybrian 5mo ago
  That's too simple to get much adoption. It's unreasonable to expect websites to drop out of Google search.
  - Bender 5mo ago
    Google and others can adapt. RTA header? Added to potential adult or user-contributed category.
    - lazyasciiart 5mo ago
      Right, no news sites for kids.
      - Bender 5mo ago
        Right, no news sites for kids. Correct. Until parent or guardian puts in password next to the text that says "Approve this site, forever." You gave me an idea. Maybe there could be categories similar in concept to those that exist in corporate firewalls today that say things like: - News Category (Known to be SFW) - News Category (That may be NSFW) - Child friendly sites - Social media sites ... and so on. This could be crowd sourced, ideally in a way that can not be gamed. The masses could flag/report false claims. That, or just keep it simple. ad-hoc input of permitted sites by parent.

delusional 5mo ago

A) Aren't you targeting a completely different problem than this law? It's my understanding that this law targets the collection of the age from the user. What the user agent does with that signal is a different problem, and seems to already be solved, except for the definition of "actual knowledge" which they are trying to establish here. B) How would your RTA header intersect with content rating in different jurisdictions? What if the content is illegal for children in Turkey but legal for children in Kentucky?

Bender 5mo ago
For topic (A) I am suggesting to negate this behavior all together. No more sharing personal data. That evil-pattern must be stopped. For topic (B) companies can set or not set the header based on GeoIP. Not perfect but GeoIP is already used in load balancers, web servers and applications.
- delusional 5mo ago
  For (A) we have nothing to talk about. I think we fundamentally disagree about how society functions, and we aren't going to knock that out over hackernews. For (B), your proposal requires the website have a database over current rules in every country they would be accessible from. Would a website then, in your opinion, be responsible for the accuracy of this database? We have to presuppose an official GeoIP source that would then be legally binding and under democratic control, but given such a database, would a website serving a wrong header to an IP associated with a specific country then be committing a crime in that country? What would the punishment be?
  - Bender 5mo ago
    For (A) I guess you are right, we won't agree. I do like your username however. For (B) this is already a thing. Porn sites and already doing this. Instead of blocking a region I am proposing to stop blocking and instead the law permit them to just add a header. The only people I can imagine apposing this are commercial VPN providers.

iamalizard 5mo ago

No such mandates should take place at all.

Bender 5mo ago
I agree fundamentally and ideologically but we are past that point. The toothpaste is already out of the tube as they say. There will be restrictions so all I can do is suggest more sensible restrictions that keep the control on the client side and do not share data. Any data shared can and will be abused, leaked, sold, stolen without consequence.
- yetta 5mo ago
  No we aren't. Also you can put toothpaste in tubes or it wouldn't be in there. Hope that helps!
- AdrianB1 5mo ago
  I heard that lie about "sensible restrictions" so many times, now I am waiting for "sensible violence", "sensible beating to death" and so on. It is a false argument that "there will be restrictions so all I can do is suggest more sensible restrictions", what you can do is recognize that "no restrictions is an option". It is like negotiating with a terrorist that wants to kill you and this is his starting position and then he wants to agree on some compromise, like seriously beating you. There is no negotiation.
  - Bender 5mo ago
    No harm in pushing for no restrictions at all. I support this idea.
  - fc417fc802 5mo ago
    > now I am waiting for "sensible violence" That exists and is called "self defense", no?
- shevy-java 5mo ago
  We are not past the point at all. Any democracy can ultimately decide on laws and regulation. Why would you wish to insinuate otherwise here? California could easily decide to not implement such laws, for instance. That data leaks out is always a given. So, gather less data. Ideally none. But this is not a discussion about data. This is a discussion as to what state actors think they are allowed to do. It is an attack on private life of people. See the combined strike against VPNs.

ekr____ 5mo ago

> The only device mandates that should be taking place is for the default installations of web clients should be checking to see if parental controls are enabled. This only impacts the major browsers. An intern at each browser company could add this check in minutes. If they are enabled and the person logged in is on a regular account (not admin or power user of sorts) then the base installation of web clients must check for an RTA header [1]. If present, prompt for a override password and also give the option for the admin to approve-list the domain at that time. That's it. Not perfect, nothing is or will be. It's useful to contrast this with the various device-based mandates that have been created in order to get a sense of what legislators seem to be trying to do. With that in mind, a few points: * What you are proposing allows parents to opt in via parental controls, but age assurance mandates (both device-side and server-side) tend to require positive action to enter unrestricted modes. In some cases (CA AB 1043, for instance), this is just a matter of entering your age. In others, you actually need to demonstrate your age via some technical mechanism. * While many age assurance mandates focus on adult content, which is primarily consumed via the Web, others (e.g., Australia's Social Media Minimum Age) focus on social networking, which is primarily consumed via apps, so anything that is Web only will not be effective. * Site-level granularity isn't really fine enough in some cases. For example, the New York SAFE for Kids act prohibits certain behaviors such as algorithmic recommendations when a user is a minor, but doesn't require blocking minor usage entirely. It's potentially possible to implement this with something like RTA, but it would have to at minimum be at much finer granularity. Section VI of https://kgi.georgetown.edu/wp-content/uploads/2026/01/Age_Assurance_Online_Technical-Assessment_Report_KGI.pdf https://kgi.georgetown.edu/wp-content/uploads/2026/01/Age_As... goes into quite a bit more detail about various architectures (disclaimer, I'm an author). None of this is an endorsement of age assurance techniques; I'm just trying to help flesh out the situation. > All legislation regarding age verification must revolve around this otherwise people must reject it as an abusive form of tracking and privacy invasion. It's a bit late for that, given that around half of US states already have some kind of age assurance mandate.

Bender 5mo ago
It's a bit late for that, given that around half of US states already have some kind of age assurance mandate. Perhaps late to solve this globally but parents can still install parental control software if they so desire and can still intervene locally to prevent sharing data with 3rd parties. At worst this means small children might not get to visit social media and other assorted sites and I am fine with that. I think a number of parents would be fine with that as well. Sites can voluntarily label as some do. It just means that parental controls would have to default to blocking everything until approved and while sub-optimal maybe that's what people will have to do in order to avoid the evil pattern of sharing data with all the websites that will ultimately leak, or "leak", be sold, stolen, etc... Good parents will not participate in the evil patterns of sharing their children's personally identifiable information. When the PII of children is ultimately shared with evil people the children once adults will resent their parents for not protecting them. - To all parents here, your children have no idea what risks are out there including devious companies that want their data. They will one day be adults if all goes well. Protect your children as corporations and governments will not. They will thank you when they find out all their friends data was shared, leaked or otherwise abused forever.

codedokode 5mo ago

I think the header/metatag is designed poorly. The RTA proposal is that every operator of every site must verify the content and add the header to mark the site as "safe" or "unsafe". This is unnecessary burden that they have to bear if this proposal is given a green light and this is wrong. Instead, the default should be, that if there is no header or it cannot be parsed, then the content is unsafe. And if there is a header, it describes the page rating, like what kind of dangerous content it may contain. The header may be added to any displayable content like HTML, text, images, audio or videos, but not to machine-readable content like JS files or AJAX responses. So only those who wants their site to be accessible by minors, have to add headers. For social networks, the user might have an option to mark his content as "safe". This means that with my proposal existing site operators need not to do anything to mark their sites as "unsafe" - all sites are "unsafe" by default. This means that millions of site operators need to spend 0 dollars to adapt their sites. How great is that? The browser on a device with parent mode, should not allow displaying any content which doesn't have a header or that is marked as unsafe, or that contains header with invalid value. The parents may whitelist some sites. There should be a reponsibility for intentionally marking unsafe content as "safe". We should also think what to do with foreign operators, intentionally putting invalid headers for unsafe content. Maybe they should be added to some kind of blacklist that the browsers would periodically update. Search engines like Google could work by default in "safe" mode, but add "unsafe" header if the user wants to turn off restrictions. > If a site is not adding the RTA header then progressively fine them into oblivion. I think my proposal is better because it requires only fining those who intentionally misrepresent content safety.

Bender 5mo ago
For what its worth this header has been around for a very long time. It's actually the second iteration and much simpler than it's predecessor. Parents today can accomplish what you are suggesting by installing parental control software and only allowing access to things they explicitly approve. This can also be done via headers explicit blocking of all the things and was suggested in another thread. [1] Some people liked the idea. [1] - https://news.ycombinator.com/item?id=47952999 https://news.ycombinator.com/item?id=47952999

tzs 5mo ago

> If they are enabled and the person logged in is on a regular account (not admin or power user of sorts) then the base installation of web clients must check for an RTA header [1]. Your cite is an earlier post of yours which says > The one and only method I will participate in is server operators setting a RTA header [1] and that cites a still earlier post of yours > I stand by my repeated statements of how this could have been solved simply using an RTA header [1] which finally actually cites¹ something that explains what the heck on RTA header is. It would be quite a bit more reader friendly to cite https://www.rtalabel.org/page.php https://www.rtalabel.org/page.php rather than make the reader traverse a linked list of comments to get there. ¹https://www.rtalabel.org/page.php https://www.rtalabel.org/page.php

lxe 5mo ago

Bold of you to assume that lawmakers have any common sense when it comes to technology legislation. It could have taken 3 interns 3 hours at each browser company to implement a cookie consent standard 15 years ago, yet here we are in cookie banner hell.

Bender 5mo ago
I was referring to the intern being able to add the header. Politicians need financial incentive. I don't have the resources to lobby them. I think that might require a philanthropist should there happen to be one that lurks on HN. There are some interesting people that lurk here that we sometimes learn about. They can't do anything today as it is a federal holiday but they could do something tomorrow.
gsich 5mo ago
DNT exists, not even that is honored by websites. There is no need for a cookie banner for technical cookies.
- kube-system 5mo ago
  DNT is deprecated by W3C, and browsers have been removing it
daemin 5mo ago
Cookie banners exist because it is a dark pattern companies use to get you to opt into marketing cookies by making the easiest thing the worst choice. This could all be handled by settings in the browser, only if the sites themselves listened to the users' browser preferences.
- vincnetas 5mo ago
  Agree. Its like in some countries you put a sticker on the mail box "no advertisement, please" and its illegal tor postman to deliver you ad brochures. Same could have been possible with browsers, but oh no, now you have to go out to each postman ant tell him explicitly that you do not want ads, and postman has no memory, if you tel him that you don't want ads. He can come back ten minutes later and you have to tell him again.

kelnos 5mo ago

How does this work for mixed-content sites? Like say a minor visits a video sharing or social media site and the default feed/recommendations list includes stuff that should be age-restricted, but is mostly stuff that shouldn't be. The entire site shouldn't be blocked; the browser needs a way to tell the website "my parental controls are enabled and I need to you to filter out age-restricted content". Alternatively, the RTA header/meta could include a parameter/attribute for an "alternate URL" to load when parental controls are enabled. This could be useful to allow sites to present a custom error-type response, but could also be used to automatically redirect the user to similar, but age-appropriate, content. Anyway, this all ignores the fact that "protect the children" isn't really the goal here: it's to slowly eat away at our ability to be anonymous (even read-only anonymous) on the internet. Age verification is just a watered-down way of saying they require positive identification, and eventually our hardware will have to cryptographically attest we are who we say we are. I really hope this isn't inevitable, but it's starting to feel that way.

Ajedi32 5mo ago
Once you have a content label header it's pretty easy to build more complicated systems on top of that. Like the site could send "compliant with x regulation" in the content labeling header, and then that would tell the kid's browser it doesn't have to completely block the page but can instead reload the page with a request header saying "filter out a, b, and c content" and expect that to be complied with. That could be a fingerprinting vector though so maybe depending on privacy settings it just blocks the page. Really these are all solvable problems that web standards orgs have dealt with before; you just need to create the incentive for such systems to exist.

idiotsecant 5mo ago

You make the mistake of solving the stated problem, and not the actual problem. This was never about children, or a solution like what you describe would be trivial.

pkphilip 5mo ago

However, this is not about age verification or protecting children. That is just the excuse they are using. If Meta, Google etc could easily have algorithms in place for determining the age of the person seeing the video - apart from having the override capability via a parental login as you have stated.. but these platforms have consistently refused to limit the type of content they are showing to children.

maccard 5mo ago
YouTube has this. It’s YouTube Kids. You can argue all day over whether it’s good enough but they do have this offering.

teekert 5mo ago

Well sure, such a solution may solve age verification elegantly, but does it serve the interests of the companies that pushed this bill?

raxxorraxor 5mo ago

That is the only real solution. It removes the lobbyists with their bad verification schemes and untrustworthy software. You don't need untrusty flaggers or untrustworthy official authorities. In no way can nations be responsible enough to not attempt constant sniffing attempts. My nation couldn't keep itself from spying of corona app users. This can also be broadly implemented, any other technical solution won't be widely spread anyway. I don't think authorities care about child protection though. They could have legislated malicious advertising practices and a lot of similar bad influences, but didn't.

bawolff 5mo ago

> The only thing server, platform, website, service providers should be doing is setting an RTA header if the content could possibly be adult or user-contributed content that could dynamically become adult, moderation aside....If a site is not adding the RTA header then progressively fine them into oblivion. Seems like this would incentivize just all sites to have the header regardless of if it meets the definition since you get fined if you dont but no fine if you have the header unneccesarily. Especially if your definition is contains user contributed content. That is all sites with a comment field. What really is left? I'm not sure i have even visited a site in the last month that wouldn't fall under this.

tardedmeme 5mo ago

That's basically what this law was though. Are you cheering for them removing the law that said exactly what you wanted?

kleiba2 5mo ago

This assumes that the goal is child protection, while the actual goal is user profiling and ad revenue.

miki123211 5mo ago

Three things: 1. This assumes that websites are under your jurisdiction and can be fined. This is not a valid assumption on the internet. If you want to do this, you need a framework to block noncompliant websites via ISP-side null-routing, putting pressure on payment processors and hosting companies which do operate in your country etc. 2. HTML tags and not HTTP headers. If just a small part of the site contains content which shouldn't be displayed, the web browser should just hide that part. 3. Sometimes, it is genuinely useful to know the user's restrictions ahead of time. Imagine you're a movie streaming site or game store. You have some content which is suitable for the user, no matter their age, but you need to know which bracket they're in to decide what to show them. Without that info, you either default-adult (which sucks for children) or default-child (which sucks for adults).

raxxorraxor 5mo ago
No, I don't think any of that follows from that. The header can be set in the initial communication attempt. It is even more specific than any other mechanism to verify your age, because this header can be set appropriately for any web resource. The problem of hosts in countries that don't give a shit is true for every solution aside from the great all blocking firewall no developed nation would want to have. So no to "ISP null routing" from me. ISPs provide infrastructure. They are not school teachers. Such a solution implemented today would be tunnelled yesterday and everyone should support evasion attempts.
Bender 5mo ago
Countries that do not follow it could in theory be BGP filtered or sanctioned. I doubt that would happen. Probably more like the country would be added to parental controls in the browsers and parents could de-select a checkbox that is checked by default saying to block that country. If that were a thing I think some people would be enabling parental controls on themselves just to filter out some shenanigans.