6 ms·

I agree wholeheartedly with the argument raised in this github issue, but I think people are wrong to be skeptical about the concept of a government-issued age

I agree wholeheartedly with the argument raised in this github issue, but I think people are wrong to be skeptical about the concept of a government-issued age verification app. Thing is, the status quo is absolutely worse. My 13yo son likes making Roblox games. Suddenly, some months ago, Roblox made a change where you’re not allowed to share your games with friends unless you do “age verification”, apparently in some misguided bid to beat the pedos. In Roblox’ case, this means sharing your 3D likeness with some sketchy American business who pinky promises to delete said data after. I don’t want random American tech companies to have my kids’ biometric info like that, able to sell it to whoever asks. Nor my passport or anything like that. I’d much prefer a government supplied app, that’s guaranteed to protect my privacy, and has no business incentive to sell my data, where I can see what data about me (or my son) is shared with Roblox or whichever sleazy business wants it. Obviously this only makes sense if the government is less sleazy than the average American tech business, but for all its faults, I think that currently holds for the EU (and most of its member countries). There’s plenty precedent of EU governments doing privacy-conscious apps right (the Dutch covid tracking app comes to mind). I hope they see reason and fix this here issue.

knorker 3mo ago
Funny you use Netherlands as a good example, considering that famously, their existing unusually thorough registry was super helpful for the Nazis rounding up jews later. I don't think it's Godwin's Law when you are so spot on, exactly describing the worst case.
- tikkabhuna 3mo ago
  Why would an age verification app need to know your ethnicity/religion? Governments likely already know your name, age, place of birth, so having an app with a standard API for verifying users isn't giving the government additional data.
  - snottynose 3mo ago
    It is one extra attack vector. There is a data leak reported every week, and it is now apparent we cannot trust any organization to handle any datum securely, at all. It has gotten to the point where I now consider every piece of information compromised and sold on the dark web as soon as I am forced to transfer it to a third party. Because those are the odds.
    - soco 3mo ago
      It's also replacing all the personal information stores from thousand applications and websites you have previously registered, or would have to. So arguably it's thousand attack vectors less.
    - kspacewalk2 3mo ago
      Doing absolutely everything useful with that data is "one extra attack vector". That is not any kind of a persuasive argument in itself.
  - lstodd 3mo ago
    "government" age verification app will be made and maintan ed by some corp anyways. so it will gather extra data, sell it sideways and leak like hell. (as they already do with all the data they already have)
    - roundabout-host 3mo ago
      Since it requires Android or iOS, Google/Apple can gather the same data too.
      - lstodd 3mo ago
        They did this from the beginning, still one can not cease trying to limit the exposure.
    - alistairSH 3mo ago
      I'm imagining something like recreation.gov in the US - it's the portal for booking campsites and other activities at national parks. It's run by BAH at great profit - most of the fees we pay aren't going to the national park service, it almost all goes to our corporate overlords.
  - chopin 3mo ago
    Governments will track with whom you verify. Much worse.
    - microtonal 3mo ago
      Can we not spread nonsense narratives? One of the explicit requirements of the EU age verification system is that they cannot: https://digital-strategy.ec.europa.eu/en/factpages/blueprint-age-verification-solution-help-protect-minors-online https://digital-strategy.ec.europa.eu/en/factpages/blueprint... First, the user downloads the app onto their phone and sets it up by certifying their age. This can be done with a biometric passport/ID card, a national eID (e.g. national ID Card or other electronic identification mean), a pre-installed third-party app (e.g. a banking app), or in person (e.g. at the post office). Only the information confirming that the user is over the age will be saved in the app. No name, no birthday, or any other data is saved. After completing this step, the communication between the app and the provider certifying the user’s age (e.g. eID, third-party app) ends. No further data is exchanged. https://digital-strategy.ec.europa.eu/en/faqs/eu-age-verification-solution https://digital-strategy.ec.europa.eu/en/faqs/eu-age-verific...
      - chopin 3mo ago
        The app will likely have access to a bunch of unique identifiers on the phone. At least on Android whichs core concept is spying on the user. For me, it's enough that your activity could be linked to any unique identity. I don't want mandatory government apps on my phone, that's very chinese. We should strive for better. Edited to add: your linked FAQ conveniently leaves open how the communication between the web site and the app happens. There are myriad of ways that ones behaviour leaks in this step.
  - impure-aqua 3mo ago
    It may not record your ethnicity or religion, but ID documents certainly record your sex, and plenty of authoritarians seem interested in identifying individuals for whom this database column has been updated.
- snottynose 3mo ago
  Not necessary to hearken back so far in history. In our present age the intelligence services consistently do not respect privacy rights of citizens, even when they are legally bound to. https://www-bitsoffreedom-nl.translate.goog/2026/07/06/aivd-en-mivd-hebben-hun-processen-nog-steeds-niet-op-orde/?_x_tr_sl=nl&_x_tr_tl=en&_x_tr_hl=nl&_x_tr_pto=wapp https://www-bitsoffreedom-nl.translate.goog/2026/07/06/aivd-...
  - knorker 3mo ago
    Sure, but the poster was not just wrong, but wrong like "peace in our time" wrong. "Adolf? What a charming name" wrong. Amusingly fantastically wrong. NL may have its own issues like you linked to, but more uniquely had their collected data abused more than other countries in probably the worst event in history.
- trashb 3mo ago
  Additionally there was a leak of the personal information of covid patients, the official tracking app was not affected as far as I can tell. However even if the app is secure the storage and handling of the information is a different matter and it has been shown that care is not always taken.
- skrebbel 3mo ago
  I don’t follow. The Dutch tax office has substantially more complete records right now. Even if they don’t track race or religion as explicitly as they did in the 40s, your hypothetical invading Nazis can run some local AI over people’s last names and get close enough. How is, of all things, an age verification app going to make that worse? I mean I understand your argument in principle but it seems you’re arguing against ~every present-day functional government and not against an age verification app.
  - knorker 3mo ago
    I'm not even saying your conclusion is wrong. But choosing Netherlands about how information control is safe in the hands of the government is a bit of an own goal. Like if I was the boss of a train company I would probably not put up a photo of Mussolini as a motivational poster. Well… maybe I would, but only ironically. > How is, of all things, an age verification app going to make that worse? What are you arguing for, here? If everything were perfectly anonymous, maybe. But NOT ONCE in history has governments decided to not abuse power. It'd be so easy to just put a tracker in there or something. All these "think of the children" arguments are ALWAYS red herrings. Literally any action, any freedom denied, can be justified in the fight against CSAM. And so they get rushed through and abused. The EU DNS filter (CSAADF) was literally IMMEDIATELY abused to block other things too. "It's just age verification". Is it, though? How do you verify age without verifying identity? How do you verify its use, without tracking. Provably without tracking. Provably without what's called "turnkey tyranny"? I think if your argument, which is an extremely common argument, is "I just want to block children's access to bad stuff on the Internet", then you cannot possibly have been paying attention to this debate that's been going on since at least the mid 1990s. Were you even born when this was being discussed? If that's your argument then you have about 30 years of catching up to do before you should speak. [1] yes, I know Mussolini did not in fact make the trains run on time.
    - dzjkb 3mo ago
      >how do you verify age without verifying identity zero-knowledge proofs
- izacus 3mo ago
  > Funny you use Netherlands as a good example, considering that famously, their existing unusually thorough registry was super helpful for the Nazis rounding up jews later. To avoid rounding up the jews you... create a government that doesn't round up jews. You don't fight arbitraty useful tools which then end up in bizarre situations like in US where people can't vote because of this bizarre idea that government shouldn't track voter lists. EU governments mostly have a list of registered citizens with their birth dates and their adresses. And noone has been rounding up anyone for almost a century... something we can't say for another world country which apparently doesn't keep records of their voters (useful to prevent people of colors from voting!) and somehow is rounding up people on the streets right now.
  - knorker 3mo ago
    Yup, "just don't do that, then" is better. But I have to point out that NL gov did not round up jews, but the bad outcome arrived anyway, from outside the system. So in the example we're talking about, that was not a solution. Other than that, I agree.
choo-t 3mo ago
You can (and should) be mad at the government and at Roblox at the same time. Also, don't use Roblox, you can freely share games made with PICO-8, Löve, Godot, Rpgmaker, Game maker and the like, no need to go to the hell scape that is Roblox and its dark patern and locked down ecosystem.
- pibaker 3mo ago
  None of the engines you mentioned are nearly as approachable as roblox when it comes to making a 3D game with little programming or art skills. Don't get me wrong. I agree roblox is a very shady operation, but that does not erase the fact that their platform is unmatched when it comes to letting kids make games.
  - choo-t 3mo ago
    RpgMaker is really approachable for a 13yo. There also Luanti, the new name of MineTest, which is closer to the Roblox experience (in the sense that there already a playable game there, and creating new stuff is closing to modding than to game making).
    - pibaker 3mo ago
      The Roblox experience also includes a huge existing player base who may come and play your game without having to install anything new on their machines. I'd say this social factor actually matters a lot for Roblox where many if not most games are multiplayer. The only thing close is minecraft, which from what I heard already has similar restrictions on in game chat, plus other shady maneuvers from Microsoft.
      - choo-t 3mo ago
        Of course Roblox have more player, but does your child really need millions of players? It's the same network effect with other megacorp, we could argue the same about X/Instagram/Mastodon, the question could be changed to: Do you want your children to be groomed to use closed source ecosystem from shady companies or do you prefer they gain experience in using relatively open ecosystem ? Luanti let you make multiplayer games/mods too. For Minecraft there way to play outside of Microsoft sanctioned versions and servers.
pjc50 3mo ago
> a government supplied app, that’s guaranteed to protect my privacy This is a bit of a 64,000 euro question, though. Look very closely at what the government exemptions for GDPR are.
- mnky9800n 3mo ago
  What are they?
  - pjc50 3mo ago
    https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/sharing-personal-data-with-law-enforcement-authorities/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... for example. (Yes I know about Brexit, but this is basically identical to when the UK was in the EU and subject to the Directive)
em500 3mo ago
Government issued versus corporate issued age verification is a false dichotomy. There are other options, such as refusing games that require them. (Yes, we do have a teen, and yes we did exactly that with Roblox.)
- jstummbillig 3mo ago
  Pretending that those options are equal is a false dichotomy. Not participating is an option up to a point, and then it is increasingly limiting all other options.
  - hnisnotbenign 3mo ago
    [flagged]
    - ____mr____ 3mo ago
      We will see how optional it is to not participate in age verification when software used for interfacing with the world (such as bank apps or similar) require you to use age verification. On top of this, barring your children from apps requiring it is just going to socially isolate them from their peers. The fact of the matter is that if we want companies to be accountable for the pedophiles on their platform, they simply have to enforce some privacy invasive policies.
      - hnisnotbenign 3mo ago
        [dead]
- joe_mamba 3mo ago
  >There are other options, such as refusing games that require them. How about the option of the state not being so tyrannical in meddling about what people anonymously do online in their free time?
  - zeta0134 3mo ago
roundabout-host 3mo ago
The "app" could be a good solution, if it didn't require attested Android or iOS. It could, for example, have me plug my ID chip into my GNU/Linux system and expose it with a standard protocol. That would be no problem. The problem is that they do not want such a way. In any case, I think that age gating would not be needed if the platforms were regulated to remove addictive recommendation algorithms.
- yorwba 3mo ago
  Using an ID card reader is already possible. See here for a list of Linux repos supporting German IDs: https://www.ausweisapp.bund.de/en/open-source https://www.ausweisapp.bund.de/en/open-source Finding a working hardware/software combination for your ID card is up to you. The app is an alternative for people who don't want to buy or carry around a card reader, but who already have a smartphone.
  - roundabout-host 3mo ago
    It is possible for e-signatures and similar variants. However, there is no sign that the "age verification" will support this variant. If you go to the demo <https://cinema.ageverification.dev https://cinema.ageverification.dev>, no option is given other than the Android/iOS app. So it seems that the app is only an alternative in the case of government portals, but it is not an alternative for "age verification".
    - lern_too_spel 3mo ago
      The German implementation already allows it. The GitHub issue you linked to explains multiple times that it is a reference implementation, as have several previous HN comment threads linking to this page. It is not the actual implementation that any country plans to use.
      - roundabout-host 3mo ago
        The German implementation allows it for some uses, but not for "age verification". The demo does not account for the fact that other options may exist.
zh3 3mo ago
As a purely tactical measure, we use the same older person (me) for age verification for all family members - zero failures so far and it poisons the well.
- a2128 3mo ago
  In the case of Roblox they have a horrible system where they estimate your age and only allow you to interact with people of a similar age, meaning if you verified your kid with your face then they'd only be able to interact with adults and not other kids. At least that's the theory. It doesn't take a lot of effort to figure out how a predator could misuse this system to their advantage (which is why I call it horrible) Reference: https://en.help.roblox.com/hc/en-us/articles/39143693116052-Understanding-Age-Checks-on-Roblox https://en.help.roblox.com/hc/en-us/articles/39143693116052-...
  - creaturemachine 3mo ago
    Predators have been using roblox since its inception, but I don't think they are doing age verification because of that. They're looking to expand into more adult experiences and, of all horrible ideas, dating.
    - intended 3mo ago
      I’ve seen Roblox invest and conduct child safety research for several years now. Maybe they are expanding into other industries, but the safety focus predates that.
    - microtonal 3mo ago
      I think it is much simpler: they are feeling regulatory pressure. In various countries there are increasingly strict laws that allow people to hold companies accountable for issues on their platform. By using age verification, they can increasingly move responsibility away.
- throw0101d 3mo ago
  > As a purely tactical measure, we use the same older person (me) for age verification for all family members - zero failures so far and it poisons the well. Is there a 'break glass' workflow in case you are not available (e.g., health incident)?
SoftTalker 3mo ago
We have had the need to prove age for hundreds of years. To buy alcohol. To drive a car. To vote. We depend on government-issued documents to do this. Not sure why anyone would really expect this to change just because it's online now.
- nkrisc 3mo ago
  Proving your age is a relatively new phenomenon. My grandmother, born in Chicago in the 1920s didn't even know her exact age. That is not at all uncommon for her generation.
- saltwatercowboy 3mo ago
  Very obviously because privacy advocates are concerned by the effects of mass deanonymization. I find it doubtful that you don't grasp that.
  - athrowaway3z 3mo ago
    I bought a bag of chips without having to show my ID. There is a big difference between: Government demands every website to have age verification, and government supported scheme by which service can opt into age verification. As of now, American private spyware is actively filling the demand. I get the feeling some privacy advocates are approaching the choice as a tier system, with government being the worst case. I don't see it. The only viable solution for the future of privacy is to not be dependent on the giant platforms in the first place.
    - SoftTalker 3mo ago
      Government is demanding age verification because the websites and platforms completely punted on the issue of keeping inappropriate content from children. Yes parents have a role here but we live in a society and we depend on/demand everyone doing their part. We (the tech sector) made our own bed here.
      - simoncion 3mo ago
casey2 3mo ago
Then get your kid off Roblox. I promise you that Roblox exploits more children in a single day than all sex offenders put together do in a year. Why is pedophilia such a problem on Roblox? It's because they heavily advertise towards children and one of the fastest ways for children to make money is asking their parents, then next is prostitution. Roblox is uniquely bad because they heavily advertise both products and the "self-made entrepreneur" image to children. Putting the blame on nebulous "predators" when the system itself is clearly to blame is the very tacit Roblox relies on. Look at vehicular manslaughter are drunk and distracted drivers solely to blame for deaths? Clearly not since there are just as many drunks and phones in Europe as in the US. When the system creates more predators than exist otherwise then you know it needs to change. If your son likes making games keep him on Godot. Your job as a parent is to find or build a good distribution system. you can see if he is generally interested or if he was pressured by an exploitative system grooming him into pumping out slop for the trough. Age verification is going to make the platform more exploitative in the business sense. Both in that it legitimizes bad practices and lets Roblox target their exploitative practices more effectively.
- stravant 3mo ago
  People don't want to make games, they want to make multiplayer games. Very few kids are going to go though the incredible difficulty of making multiplayer work in something like Godot.
  - rudy6912 3mo ago
    Check out Luanti. My son pulled off his own multiplayer game, by mixing some existing mods and writing a pinch of Lua. He is not into programming, and he did not even use LLM, do it was probably not all that hard. And the result was impressive, and I say that as a professional programmer.
- djaro 3mo ago
  This doesnt work when all of his friends are playing Roblox and play each others games on there
sajithdilshan 3mo ago
What you’re proposing works only if the government is always trustworthy and abiding by the rules. But there has been cases that ICE agents in US was able to track down people from their social media posts and in the past Nazis used the address registration lists to track down Jews for deportation to concentration camps. We don’t know what EU would become in 5 to 10 years in the future, and I would rather not have any identification information about me or family being stored by a government body or any other party that can track/link me or my family members
- wsng 3mo ago
  They have this information anyway if you have an EU passport or an identity card. The government app allows you to share selected properties of these documents with third parties.
  - sajithdilshan 3mo ago
    It’s not only government shares that info, the government can keep track on with which parties they shared that info and for what purpose. As an example if I’m obliged to share my ID data via government to open a twitter account how would I know that the government would not link my twitter account to my ID and later use that info keep track of me and prosecute? People would think that it would never happen, but not long ago that actually happened in East Germany. The Stasi kept track/files on almost every East German and this would be a digital version of the same thing
    - wsng 3mo ago
      The app is open source, and it doesn't do that. I agree that governments should minimize collection of their citizen's data. I just don't see where it is supposed to happen in this case.
      - sajithdilshan 3mo ago
        What would you do that, they start with open source app, make the online is mandatory and once it’s established and mandated, then they closed source the app and implement data collection? There is no guarantee that the app would stay open source and under public scrutiny forever. Governments have done way shady things in the past. Given the recent push for chat control, I would never trust anything put out by EU.
sva_ 3mo ago
I guess that is one way to manufacture consent.
- vrganj 3mo ago
  As another European, I agree with GP. I don't fully trust my government. But I definitely trust it more than any American tech company. I can also vote out my government. I can't do that for Big Tech.
  - Eduard 3mo ago
    > I can also vote out my government. No.
  - joe_mamba 3mo ago
    [flagged]
    - vrganj 3mo ago
      The EU pricks that pushed Chat Control is... American oligarch Ashton Kutcher. https://edri.org/our-work/how-a-hollywood-star-lobbies-the-eu-for-more-surveillance/ https://edri.org/our-work/how-a-hollywood-star-lobbies-the-e...
      - joe_mamba 3mo ago
        [flagged]
        vrganj 3mo ago
        You're moving the goalposts from "pushing". It also leaves a bad taste in ones mouth that you brought up his Jewish background unprompted. I do wonder how your account is still active. Every time I see your name, it is in connection with you lowering the quality of conversation by introducing aggressive ad-hominems, dehumanizing language, insults and attempts to derail instead of engagement with points made. This time, it even has strong undertones of antisemitic Jewish world conspiracy theories. Is this level of discourse really what we should be striving for around here?
photios 3mo ago
> Roblox made a change where you’re not allowed to share your games with friends unless you do “age verification” My son had a similar "making games" interests and I just showed him the Godot engine. Roblox bosses are doing you a favor. Act now :D
clickety_clack 3mo ago
I hear you on the overall privacy issues related to age verification with US Corps. My concern with government registries of personal information is related to things like: - Netherlands, WWII: The Dutch civil registry meticulously recorded religion. It’s a major reason ~75% of Dutch Jews were killed, the highest rate in occupied Western Europe (vs ~25% in France, where records were poorer). - US, Japanese internment: The Census Bureau provided block-level data on Japanese Americans in 1942 despite confidentiality guarantees; 2007 research showed individual names and addresses were shared too. - Rwanda, 1994: Belgian colonial administrators had put ethnicity (Hutu/Tutsi) on national ID cards in the 1930s. Sixty years later those cards were the primary tool at genocide checkpoints. There’s loads more. Europe may be safe now so it feels safe to give government this information. However, as shown in all the instances above, the information was collected for one reason and used for a wholly different reason when times changed. Who knows what kinds of ethnicities, beliefs, behaviors or personal histories will be the focus of future regimes? It could be Roblox users, HN commenters, people who religiously repost x.com links as xcancel.com ones, anything. Whatever it is, they will have access to all the data on any system we allow them to record. This isn’t even a totally made up hypothetical from far away places, multiple governments in Europe were doing this kind of thing just decades ago. Historically speaking, we are all currently living in an unusually peaceful era, that will likely be temporary for many of us.
- iso1631 3mo ago
  > - Netherlands, WWII: The Dutch civil registry meticulously recorded religion. It’s a major reason ~75% of Dutch Jews were killed, the highest rate in occupied Western Europe (vs ~25% in France, where records were poorer). Records were poorer in France because René Carmille and the French resistance sabotaged the machines. Machines made by a large tech company which was a competitor to IBM. > Who knows what kinds of ethnicities, beliefs, behaviors or personal histories will be the focus of future regimes? Absolutely. But I do know who has that data -- big tech, and it's willing to sell it for a nominal price. No doubt that price will be higher for a deaparate government wanting to kill everyone with green eyes, but that just means a higher profit margin for facebook as they mine their shadow profiles.
mindslight 3mo ago
It doesn't have to be an either or dichotomy. For example, you could pass laws that make it illegal for an online game to demand age verification, identification, biometrics, etc. The main reason for any of this are some corporate attorneys justifying their own salaries based on "what if" and scaremongering. Regardless of how much personal information they succeed at demanding at this stage, or how [in]effective it is at addressing their claimed problems, they will be back again pushing for even more until they're actually told a hard "no".
generalizations 3mo ago
> a government supplied app, that’s guaranteed to protect my privacy [citation needed]
lifestyleguru 3mo ago
> this means sharing your 3D likeness with some sketchy American business who pinky promises to delete said data after. I don’t want random American tech companies to have my kids’ biometric info like that, able to sell it to whoever asks. Nor my passport or anything like that. Actually the market leader app for scanning faces and documents is an Israeli company. They encourage to use mobile for scanning, for your convenience. They promise they delete the data. Yeah, if they're lying you can sue them in Israel.
monksy 3mo ago
It's isreali as well: https://www.404media.co/id-verification-service-for-tiktok-uber-x-exposed-driver-licenses-au10tix/ https://www.404media.co/id-verification-service-for-tiktok-u...
doyouhearyrslf 3mo ago
[flagged]
- onetokeoverthe 3mo ago
  [dead]
jcattle 3mo ago
Same as for banks. Downloading some verification app with a confidence inspiring 1.2 rating on the app store, getting on a call with some random gig worker looking like they are taking the call in their living room and wiggling your ID around while giving a thumbs up is not the way I would like to prove my identity to a bank. But there's no alternative. The EU digital identity wallet would be the alternative. You control and exactly see, what kind of information the bank is getting from you and you can be sure that it doesn't flow through some sketchy third-party identification service.
fy20 3mo ago
Here in the Baltics we already have an app for that. It's used to login to banks and government websites. Recently one supermarket chain added it for age verification on their self-service checkouts (e.g. buying alcohol). The problem with this is you do not know what information they get, I guess the supermarket gets my full name, date of birth, personal code, etc. Their privacy policy says it will not be stored, but that means nothing. https://www.smart-id.com/ https://www.smart-id.com/
jsmith45 3mo ago
The original design intention of this approach was that wallet apps were independant and interchangable, with any wallet app able to talk to any attestation provider, to get age attestation tokens, and any site/app able to talk to any wallet. The wallet's job was merely to securely hold a bunch of attestations tokens, and dispense them to other sites/apps on request. So you could use an open source app, or government provided one, or one provided by your bank, whatever you trust the most to not be recording data about relying parties and sending it somewhere you don't want. The version of the document currently on GitHub has heavily deviated from that original intention. This is very unfortunate. Even so this version is supposed to still be incapable by design of sharing any data with a relying party other than "over 18" and was designed such that the only way for a relying party to determine your identity is to be colluding with the attestation provider, or by colluding with the wallet app. To attempt to address the first issue they have the unfortunately optional ZKP protocol. The original design assumed that users could find a wallet that they were certain would not collude with the RPs, and was considered a non-issue, but unfortunately it is a huge hole in the current version.

knorker 3mo ago

Funny you use Netherlands as a good example, considering that famously, their existing unusually thorough registry was super helpful for the Nazis rounding up jews later. I don't think it's Godwin's Law when you are so spot on, exactly describing the worst case.

tikkabhuna 3mo ago
Why would an age verification app need to know your ethnicity/religion? Governments likely already know your name, age, place of birth, so having an app with a standard API for verifying users isn't giving the government additional data.
- snottynose 3mo ago
  It is one extra attack vector. There is a data leak reported every week, and it is now apparent we cannot trust any organization to handle any datum securely, at all. It has gotten to the point where I now consider every piece of information compromised and sold on the dark web as soon as I am forced to transfer it to a third party. Because those are the odds.
  - soco 3mo ago
    It's also replacing all the personal information stores from thousand applications and websites you have previously registered, or would have to. So arguably it's thousand attack vectors less.
  - kspacewalk2 3mo ago
    Doing absolutely everything useful with that data is "one extra attack vector". That is not any kind of a persuasive argument in itself.
- lstodd 3mo ago
  "government" age verification app will be made and maintan ed by some corp anyways. so it will gather extra data, sell it sideways and leak like hell. (as they already do with all the data they already have)
  - roundabout-host 3mo ago
    Since it requires Android or iOS, Google/Apple can gather the same data too.
    - lstodd 3mo ago
      They did this from the beginning, still one can not cease trying to limit the exposure.
  - alistairSH 3mo ago
    I'm imagining something like recreation.gov in the US - it's the portal for booking campsites and other activities at national parks. It's run by BAH at great profit - most of the fees we pay aren't going to the national park service, it almost all goes to our corporate overlords.
- chopin 3mo ago
  Governments will track with whom you verify. Much worse.
  - microtonal 3mo ago
    Can we not spread nonsense narratives? One of the explicit requirements of the EU age verification system is that they cannot: https://digital-strategy.ec.europa.eu/en/factpages/blueprint-age-verification-solution-help-protect-minors-online https://digital-strategy.ec.europa.eu/en/factpages/blueprint... First, the user downloads the app onto their phone and sets it up by certifying their age. This can be done with a biometric passport/ID card, a national eID (e.g. national ID Card or other electronic identification mean), a pre-installed third-party app (e.g. a banking app), or in person (e.g. at the post office). Only the information confirming that the user is over the age will be saved in the app. No name, no birthday, or any other data is saved. After completing this step, the communication between the app and the provider certifying the user’s age (e.g. eID, third-party app) ends. No further data is exchanged. https://digital-strategy.ec.europa.eu/en/faqs/eu-age-verification-solution https://digital-strategy.ec.europa.eu/en/faqs/eu-age-verific...
    - chopin 3mo ago
      The app will likely have access to a bunch of unique identifiers on the phone. At least on Android whichs core concept is spying on the user. For me, it's enough that your activity could be linked to any unique identity. I don't want mandatory government apps on my phone, that's very chinese. We should strive for better. Edited to add: your linked FAQ conveniently leaves open how the communication between the web site and the app happens. There are myriad of ways that ones behaviour leaks in this step.
- impure-aqua 3mo ago
  It may not record your ethnicity or religion, but ID documents certainly record your sex, and plenty of authoritarians seem interested in identifying individuals for whom this database column has been updated.
snottynose 3mo ago
Not necessary to hearken back so far in history. In our present age the intelligence services consistently do not respect privacy rights of citizens, even when they are legally bound to. https://www-bitsoffreedom-nl.translate.goog/2026/07/06/aivd-en-mivd-hebben-hun-processen-nog-steeds-niet-op-orde/?_x_tr_sl=nl&_x_tr_tl=en&_x_tr_hl=nl&_x_tr_pto=wapp https://www-bitsoffreedom-nl.translate.goog/2026/07/06/aivd-...
- knorker 3mo ago
  Sure, but the poster was not just wrong, but wrong like "peace in our time" wrong. "Adolf? What a charming name" wrong. Amusingly fantastically wrong. NL may have its own issues like you linked to, but more uniquely had their collected data abused more than other countries in probably the worst event in history.
trashb 3mo ago
Additionally there was a leak of the personal information of covid patients, the official tracking app was not affected as far as I can tell. However even if the app is secure the storage and handling of the information is a different matter and it has been shown that care is not always taken.
skrebbel 3mo ago
I don’t follow. The Dutch tax office has substantially more complete records right now. Even if they don’t track race or religion as explicitly as they did in the 40s, your hypothetical invading Nazis can run some local AI over people’s last names and get close enough. How is, of all things, an age verification app going to make that worse? I mean I understand your argument in principle but it seems you’re arguing against ~every present-day functional government and not against an age verification app.
- knorker 3mo ago
  I'm not even saying your conclusion is wrong. But choosing Netherlands about how information control is safe in the hands of the government is a bit of an own goal. Like if I was the boss of a train company I would probably not put up a photo of Mussolini as a motivational poster. Well… maybe I would, but only ironically. > How is, of all things, an age verification app going to make that worse? What are you arguing for, here? If everything were perfectly anonymous, maybe. But NOT ONCE in history has governments decided to not abuse power. It'd be so easy to just put a tracker in there or something. All these "think of the children" arguments are ALWAYS red herrings. Literally any action, any freedom denied, can be justified in the fight against CSAM. And so they get rushed through and abused. The EU DNS filter (CSAADF) was literally IMMEDIATELY abused to block other things too. "It's just age verification". Is it, though? How do you verify age without verifying identity? How do you verify its use, without tracking. Provably without tracking. Provably without what's called "turnkey tyranny"? I think if your argument, which is an extremely common argument, is "I just want to block children's access to bad stuff on the Internet", then you cannot possibly have been paying attention to this debate that's been going on since at least the mid 1990s. Were you even born when this was being discussed? If that's your argument then you have about 30 years of catching up to do before you should speak. [1] yes, I know Mussolini did not in fact make the trains run on time.
  - dzjkb 3mo ago
    >how do you verify age without verifying identity zero-knowledge proofs
izacus 3mo ago
> Funny you use Netherlands as a good example, considering that famously, their existing unusually thorough registry was super helpful for the Nazis rounding up jews later. To avoid rounding up the jews you... create a government that doesn't round up jews. You don't fight arbitraty useful tools which then end up in bizarre situations like in US where people can't vote because of this bizarre idea that government shouldn't track voter lists. EU governments mostly have a list of registered citizens with their birth dates and their adresses. And noone has been rounding up anyone for almost a century... something we can't say for another world country which apparently doesn't keep records of their voters (useful to prevent people of colors from voting!) and somehow is rounding up people on the streets right now.
- knorker 3mo ago
  Yup, "just don't do that, then" is better. But I have to point out that NL gov did not round up jews, but the bad outcome arrived anyway, from outside the system. So in the example we're talking about, that was not a solution. Other than that, I agree.

choo-t 3mo ago

You can (and should) be mad at the government and at Roblox at the same time. Also, don't use Roblox, you can freely share games made with PICO-8, Löve, Godot, Rpgmaker, Game maker and the like, no need to go to the hell scape that is Roblox and its dark patern and locked down ecosystem.

pibaker 3mo ago
None of the engines you mentioned are nearly as approachable as roblox when it comes to making a 3D game with little programming or art skills. Don't get me wrong. I agree roblox is a very shady operation, but that does not erase the fact that their platform is unmatched when it comes to letting kids make games.
- choo-t 3mo ago
  RpgMaker is really approachable for a 13yo. There also Luanti, the new name of MineTest, which is closer to the Roblox experience (in the sense that there already a playable game there, and creating new stuff is closing to modding than to game making).
  - pibaker 3mo ago
    The Roblox experience also includes a huge existing player base who may come and play your game without having to install anything new on their machines. I'd say this social factor actually matters a lot for Roblox where many if not most games are multiplayer. The only thing close is minecraft, which from what I heard already has similar restrictions on in game chat, plus other shady maneuvers from Microsoft.
    - choo-t 3mo ago
      Of course Roblox have more player, but does your child really need millions of players? It's the same network effect with other megacorp, we could argue the same about X/Instagram/Mastodon, the question could be changed to: Do you want your children to be groomed to use closed source ecosystem from shady companies or do you prefer they gain experience in using relatively open ecosystem ? Luanti let you make multiplayer games/mods too. For Minecraft there way to play outside of Microsoft sanctioned versions and servers.

pjc50 3mo ago

> a government supplied app, that’s guaranteed to protect my privacy This is a bit of a 64,000 euro question, though. Look very closely at what the government exemptions for GDPR are.

mnky9800n 3mo ago
What are they?
- pjc50 3mo ago
  https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/sharing-personal-data-with-law-enforcement-authorities/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... for example. (Yes I know about Brexit, but this is basically identical to when the UK was in the EU and subject to the Directive)

em500 3mo ago

Government issued versus corporate issued age verification is a false dichotomy. There are other options, such as refusing games that require them. (Yes, we do have a teen, and yes we did exactly that with Roblox.)

jstummbillig 3mo ago
Pretending that those options are equal is a false dichotomy. Not participating is an option up to a point, and then it is increasingly limiting all other options.
- hnisnotbenign 3mo ago
  [flagged]
  - ____mr____ 3mo ago
    We will see how optional it is to not participate in age verification when software used for interfacing with the world (such as bank apps or similar) require you to use age verification. On top of this, barring your children from apps requiring it is just going to socially isolate them from their peers. The fact of the matter is that if we want companies to be accountable for the pedophiles on their platform, they simply have to enforce some privacy invasive policies.
    - hnisnotbenign 3mo ago
      [dead]
joe_mamba 3mo ago
>There are other options, such as refusing games that require them. How about the option of the state not being so tyrannical in meddling about what people anonymously do online in their free time?
- zeta0134 3mo ago

roundabout-host 3mo ago

The "app" could be a good solution, if it didn't require attested Android or iOS. It could, for example, have me plug my ID chip into my GNU/Linux system and expose it with a standard protocol. That would be no problem. The problem is that they do not want such a way. In any case, I think that age gating would not be needed if the platforms were regulated to remove addictive recommendation algorithms.

yorwba 3mo ago
Using an ID card reader is already possible. See here for a list of Linux repos supporting German IDs: https://www.ausweisapp.bund.de/en/open-source https://www.ausweisapp.bund.de/en/open-source Finding a working hardware/software combination for your ID card is up to you. The app is an alternative for people who don't want to buy or carry around a card reader, but who already have a smartphone.
- roundabout-host 3mo ago
  It is possible for e-signatures and similar variants. However, there is no sign that the "age verification" will support this variant. If you go to the demo <https://cinema.ageverification.dev https://cinema.ageverification.dev>, no option is given other than the Android/iOS app. So it seems that the app is only an alternative in the case of government portals, but it is not an alternative for "age verification".
  - lern_too_spel 3mo ago
    The German implementation already allows it. The GitHub issue you linked to explains multiple times that it is a reference implementation, as have several previous HN comment threads linking to this page. It is not the actual implementation that any country plans to use.
    - roundabout-host 3mo ago
      The German implementation allows it for some uses, but not for "age verification". The demo does not account for the fact that other options may exist.

zh3 3mo ago

As a purely tactical measure, we use the same older person (me) for age verification for all family members - zero failures so far and it poisons the well.

a2128 3mo ago
In the case of Roblox they have a horrible system where they estimate your age and only allow you to interact with people of a similar age, meaning if you verified your kid with your face then they'd only be able to interact with adults and not other kids. At least that's the theory. It doesn't take a lot of effort to figure out how a predator could misuse this system to their advantage (which is why I call it horrible) Reference: https://en.help.roblox.com/hc/en-us/articles/39143693116052-Understanding-Age-Checks-on-Roblox https://en.help.roblox.com/hc/en-us/articles/39143693116052-...
- creaturemachine 3mo ago
  Predators have been using roblox since its inception, but I don't think they are doing age verification because of that. They're looking to expand into more adult experiences and, of all horrible ideas, dating.
  - intended 3mo ago
    I’ve seen Roblox invest and conduct child safety research for several years now. Maybe they are expanding into other industries, but the safety focus predates that.
  - microtonal 3mo ago
    I think it is much simpler: they are feeling regulatory pressure. In various countries there are increasingly strict laws that allow people to hold companies accountable for issues on their platform. By using age verification, they can increasingly move responsibility away.
throw0101d 3mo ago
> As a purely tactical measure, we use the same older person (me) for age verification for all family members - zero failures so far and it poisons the well. Is there a 'break glass' workflow in case you are not available (e.g., health incident)?

SoftTalker 3mo ago

We have had the need to prove age for hundreds of years. To buy alcohol. To drive a car. To vote. We depend on government-issued documents to do this. Not sure why anyone would really expect this to change just because it's online now.

nkrisc 3mo ago
Proving your age is a relatively new phenomenon. My grandmother, born in Chicago in the 1920s didn't even know her exact age. That is not at all uncommon for her generation.
saltwatercowboy 3mo ago
Very obviously because privacy advocates are concerned by the effects of mass deanonymization. I find it doubtful that you don't grasp that.
- athrowaway3z 3mo ago
  I bought a bag of chips without having to show my ID. There is a big difference between: Government demands every website to have age verification, and government supported scheme by which service can opt into age verification. As of now, American private spyware is actively filling the demand. I get the feeling some privacy advocates are approaching the choice as a tier system, with government being the worst case. I don't see it. The only viable solution for the future of privacy is to not be dependent on the giant platforms in the first place.
  - SoftTalker 3mo ago
    Government is demanding age verification because the websites and platforms completely punted on the issue of keeping inappropriate content from children. Yes parents have a role here but we live in a society and we depend on/demand everyone doing their part. We (the tech sector) made our own bed here.
    - simoncion 3mo ago

casey2 3mo ago

Then get your kid off Roblox. I promise you that Roblox exploits more children in a single day than all sex offenders put together do in a year. Why is pedophilia such a problem on Roblox? It's because they heavily advertise towards children and one of the fastest ways for children to make money is asking their parents, then next is prostitution. Roblox is uniquely bad because they heavily advertise both products and the "self-made entrepreneur" image to children. Putting the blame on nebulous "predators" when the system itself is clearly to blame is the very tacit Roblox relies on. Look at vehicular manslaughter are drunk and distracted drivers solely to blame for deaths? Clearly not since there are just as many drunks and phones in Europe as in the US. When the system creates more predators than exist otherwise then you know it needs to change. If your son likes making games keep him on Godot. Your job as a parent is to find or build a good distribution system. you can see if he is generally interested or if he was pressured by an exploitative system grooming him into pumping out slop for the trough. Age verification is going to make the platform more exploitative in the business sense. Both in that it legitimizes bad practices and lets Roblox target their exploitative practices more effectively.

stravant 3mo ago
People don't want to make games, they want to make multiplayer games. Very few kids are going to go though the incredible difficulty of making multiplayer work in something like Godot.
- rudy6912 3mo ago
  Check out Luanti. My son pulled off his own multiplayer game, by mixing some existing mods and writing a pinch of Lua. He is not into programming, and he did not even use LLM, do it was probably not all that hard. And the result was impressive, and I say that as a professional programmer.
djaro 3mo ago
This doesnt work when all of his friends are playing Roblox and play each others games on there

sajithdilshan 3mo ago

What you’re proposing works only if the government is always trustworthy and abiding by the rules. But there has been cases that ICE agents in US was able to track down people from their social media posts and in the past Nazis used the address registration lists to track down Jews for deportation to concentration camps. We don’t know what EU would become in 5 to 10 years in the future, and I would rather not have any identification information about me or family being stored by a government body or any other party that can track/link me or my family members

wsng 3mo ago
They have this information anyway if you have an EU passport or an identity card. The government app allows you to share selected properties of these documents with third parties.
- sajithdilshan 3mo ago
  It’s not only government shares that info, the government can keep track on with which parties they shared that info and for what purpose. As an example if I’m obliged to share my ID data via government to open a twitter account how would I know that the government would not link my twitter account to my ID and later use that info keep track of me and prosecute? People would think that it would never happen, but not long ago that actually happened in East Germany. The Stasi kept track/files on almost every East German and this would be a digital version of the same thing
  - wsng 3mo ago
    The app is open source, and it doesn't do that. I agree that governments should minimize collection of their citizen's data. I just don't see where it is supposed to happen in this case.
    - sajithdilshan 3mo ago
      What would you do that, they start with open source app, make the online is mandatory and once it’s established and mandated, then they closed source the app and implement data collection? There is no guarantee that the app would stay open source and under public scrutiny forever. Governments have done way shady things in the past. Given the recent push for chat control, I would never trust anything put out by EU.

sva_ 3mo ago

I guess that is one way to manufacture consent.

vrganj 3mo ago
As another European, I agree with GP. I don't fully trust my government. But I definitely trust it more than any American tech company. I can also vote out my government. I can't do that for Big Tech.
- Eduard 3mo ago
  > I can also vote out my government. No.
- joe_mamba 3mo ago
  [flagged]
  - vrganj 3mo ago
    The EU pricks that pushed Chat Control is... American oligarch Ashton Kutcher. https://edri.org/our-work/how-a-hollywood-star-lobbies-the-eu-for-more-surveillance/ https://edri.org/our-work/how-a-hollywood-star-lobbies-the-e...
    - joe_mamba 3mo ago
      [flagged]
      - vrganj 3mo ago
        You're moving the goalposts from "pushing". It also leaves a bad taste in ones mouth that you brought up his Jewish background unprompted. I do wonder how your account is still active. Every time I see your name, it is in connection with you lowering the quality of conversation by introducing aggressive ad-hominems, dehumanizing language, insults and attempts to derail instead of engagement with points made. This time, it even has strong undertones of antisemitic Jewish world conspiracy theories. Is this level of discourse really what we should be striving for around here?

photios 3mo ago

> Roblox made a change where you’re not allowed to share your games with friends unless you do “age verification” My son had a similar "making games" interests and I just showed him the Godot engine. Roblox bosses are doing you a favor. Act now :D

clickety_clack 3mo ago

I hear you on the overall privacy issues related to age verification with US Corps. My concern with government registries of personal information is related to things like: - Netherlands, WWII: The Dutch civil registry meticulously recorded religion. It’s a major reason ~75% of Dutch Jews were killed, the highest rate in occupied Western Europe (vs ~25% in France, where records were poorer). - US, Japanese internment: The Census Bureau provided block-level data on Japanese Americans in 1942 despite confidentiality guarantees; 2007 research showed individual names and addresses were shared too. - Rwanda, 1994: Belgian colonial administrators had put ethnicity (Hutu/Tutsi) on national ID cards in the 1930s. Sixty years later those cards were the primary tool at genocide checkpoints. There’s loads more. Europe may be safe now so it feels safe to give government this information. However, as shown in all the instances above, the information was collected for one reason and used for a wholly different reason when times changed. Who knows what kinds of ethnicities, beliefs, behaviors or personal histories will be the focus of future regimes? It could be Roblox users, HN commenters, people who religiously repost x.com links as xcancel.com ones, anything. Whatever it is, they will have access to all the data on any system we allow them to record. This isn’t even a totally made up hypothetical from far away places, multiple governments in Europe were doing this kind of thing just decades ago. Historically speaking, we are all currently living in an unusually peaceful era, that will likely be temporary for many of us.

iso1631 3mo ago
> - Netherlands, WWII: The Dutch civil registry meticulously recorded religion. It’s a major reason ~75% of Dutch Jews were killed, the highest rate in occupied Western Europe (vs ~25% in France, where records were poorer). Records were poorer in France because René Carmille and the French resistance sabotaged the machines. Machines made by a large tech company which was a competitor to IBM. > Who knows what kinds of ethnicities, beliefs, behaviors or personal histories will be the focus of future regimes? Absolutely. But I do know who has that data -- big tech, and it's willing to sell it for a nominal price. No doubt that price will be higher for a deaparate government wanting to kill everyone with green eyes, but that just means a higher profit margin for facebook as they mine their shadow profiles.

mindslight 3mo ago

It doesn't have to be an either or dichotomy. For example, you could pass laws that make it illegal for an online game to demand age verification, identification, biometrics, etc. The main reason for any of this are some corporate attorneys justifying their own salaries based on "what if" and scaremongering. Regardless of how much personal information they succeed at demanding at this stage, or how [in]effective it is at addressing their claimed problems, they will be back again pushing for even more until they're actually told a hard "no".

generalizations 3mo ago

> a government supplied app, that’s guaranteed to protect my privacy [citation needed]

lifestyleguru 3mo ago

> this means sharing your 3D likeness with some sketchy American business who pinky promises to delete said data after. I don’t want random American tech companies to have my kids’ biometric info like that, able to sell it to whoever asks. Nor my passport or anything like that. Actually the market leader app for scanning faces and documents is an Israeli company. They encourage to use mobile for scanning, for your convenience. They promise they delete the data. Yeah, if they're lying you can sue them in Israel.

monksy 3mo ago

It's isreali as well: https://www.404media.co/id-verification-service-for-tiktok-uber-x-exposed-driver-licenses-au10tix/ https://www.404media.co/id-verification-service-for-tiktok-u...

doyouhearyrslf 3mo ago

[flagged]

onetokeoverthe 3mo ago
[dead]

jcattle 3mo ago

Same as for banks. Downloading some verification app with a confidence inspiring 1.2 rating on the app store, getting on a call with some random gig worker looking like they are taking the call in their living room and wiggling your ID around while giving a thumbs up is not the way I would like to prove my identity to a bank. But there's no alternative. The EU digital identity wallet would be the alternative. You control and exactly see, what kind of information the bank is getting from you and you can be sure that it doesn't flow through some sketchy third-party identification service.

fy20 3mo ago

Here in the Baltics we already have an app for that. It's used to login to banks and government websites. Recently one supermarket chain added it for age verification on their self-service checkouts (e.g. buying alcohol). The problem with this is you do not know what information they get, I guess the supermarket gets my full name, date of birth, personal code, etc. Their privacy policy says it will not be stored, but that means nothing. https://www.smart-id.com/ https://www.smart-id.com/

jsmith45 3mo ago

The original design intention of this approach was that wallet apps were independant and interchangable, with any wallet app able to talk to any attestation provider, to get age attestation tokens, and any site/app able to talk to any wallet. The wallet's job was merely to securely hold a bunch of attestations tokens, and dispense them to other sites/apps on request. So you could use an open source app, or government provided one, or one provided by your bank, whatever you trust the most to not be recording data about relying parties and sending it somewhere you don't want. The version of the document currently on GitHub has heavily deviated from that original intention. This is very unfortunate. Even so this version is supposed to still be incapable by design of sharing any data with a relying party other than "over 18" and was designed such that the only way for a relying party to determine your identity is to be colluding with the attestation provider, or by colluding with the wallet app. To attempt to address the first issue they have the unfortunately optional ZKP protocol. The original design assumed that users could find a wallet that they were certain would not collude with the RPs, and was considered a non-issue, but unfortunately it is a huge hole in the current version.