I've honestly been shocked at how many people are okay with these laws. They are a privacy nightmare, and people are freely welcoming the government into their lives. Note that I say that as a...
Exemplary
I've honestly been shocked at how many people are okay with these laws.
They are a privacy nightmare, and people are freely welcoming the government into their lives. Note that I say that as a "The Squad"-supporting leftie. This is also a law treating a symptom and not the root-cause, which is the modus operandi of social networks. Social networks are awful because it's profitable to be so.
Instead of regulating citizens and diminishing their freedoms, the government should regulate the "social network industry." There has got to be a way to codify some guidelines that make the promotion of hateful and divisive content for the sake of "engagement" illegal or at least subject to heavy fines.
My most recent personal example was a YouTube search. They know my political leanings. I had some channels floated to me recently that demonstrate this. I wanted to watch some Ted Lasso clips. And they wanted to serve me Matt Walsh. Every now and again they try to sneak some far-right drivel or other conspiracy-theory BS into my feed and I end up having block more channels and ads. It's not that I want to shut out other viewpoints. But they're never good faith arguments, it's rage-bait. And YouTube goes out of its way to show me content they know I will have a strong reaction to. They want that "engagement."
So, take a kid that doesn't have much experience, generally speaking, throw them on a social network that was designed to feed them toxic sludge (even without a precursor), and bad things will happen. And people are celebrating laws that restrict the kid? That's backwards.
Why is the choice binary? That's artificial. And toxic sludge need not be in quotes. I regularly block at least half a dozen pages every time I check in to my Facebook. I've had to cull people...
Why is the choice binary? That's artificial. And toxic sludge need not be in quotes. I regularly block at least half a dozen pages every time I check in to my Facebook. I've had to cull people because of the literally batshit stuff they spew.
Seeing things as "good" or "bad" only and refusing to acknowledge the massive chasm of grey in between is disingenuous. It also ignores my point that this law is going after a symptom, allowing the disease to continue unabated.
So I have to ask what the point of this question is? If I say it's a good thing, I go against the empirical data of how awful social networks are, especially for young people. If I say it's a bad thing, I'm going against my earlier point. This just seems like a poor trap.
For example, should a kid be thrown blind into the deep end of anything? I imagine the answer to that is 'No.' Now, say the kid has had a couple conversations with their parents about what to look out for on a social network, and an open invitation to ask the parents about anything that seems shady. Say you even get the kid to agree to audits. What's the answer then? It's not a 'yes' or 'no,' it's still a maybe. No one could say for sure except the parents, and even that's prone to error.
But my point is that for the question "Should the government be the decider and gatekeeper in this," my answer is a hard no.
Consider other things that are empirically bad for people. Like lead, asbestos, or CFCs. In those cases, the right thing was done and the use of the "bad things" was regulated, not the people who used them. Now, I'm not advocating that social networks cease to exist. I'm advocating that the intentional rage-baiting and (in the case of Snapchat) connecting of predators to minors be regulated.
This is a problem I will be facing myself in a few years. My take is that this is a parenting issue, and the solution must be a suitable one for each family. I want some government intervention, but absolutely not like this.
I'll certainly take "it all depends" as an answer (it's my answer). But I don't know why you are so strongly against this regulation and what other regulations would be better? It seems like this...
I'll certainly take "it all depends" as an answer (it's my answer). But I don't know why you are so strongly against this regulation and what other regulations would be better? It seems like this law is in favor of parents watching over their kids since it requires parental consent to create an account from 14 to 15? Knowing which accounts your kids have seems kind of basic for watching over what they do online?
Some of your rhetoric seems rather libertarian for someone who's actually in favor of some regulation. Regulation is "freely welcoming the government into their lives." (I mean, it's already here. Lots of industries are heavily regulated.) The government is being the "decider" and "gatekeeper" about some things. (This is often justified as "the will of the people," though I think that's often a stretch.)
But, if you're not actually a libertarian or anti-government, why are you "shocked" that some people think this regulation might be a good one?
I don't have much of an answer here, but it seems to me that age verification is less intrusive than regulating content, particularly if it can be done in a privacy-preserving way, and I think it can.
What regulations would be better? I've stated as much already. I think they get reiterated throughout this post. The law is not in favor of parents. It tells parents what to do. There is a huge...
What regulations would be better? I've stated as much already. I think they get reiterated throughout this post.
The law is not in favor of parents. It tells parents what to do. There is a huge difference there. If parents didn't care before, this law won't get them to care. It's an extra step, and all you have to do is consent to share your identifying information to a central authority in order to use a web site. Not just kids. Everyone. That sounds nothing like Big Brother at all! By the terms and conditions of most social media sites, they are allowed to create an account when they're 13. Now the state has come in and said "No, you have to be 16."
Libertarian? How? Because I think the government intervention is aimed at the wrong group? All regulations are not equal, and the fact that I have to point this out seems ludicrous. Is your opinion of left vs. right in the US so reductive that you think I'd be for any and all regulations? And then the rest of that paragraph is taking my specific argument and straw-manning and generalizing it until it fits your rebuttal. Do you honestly think I don't know that industries are regulated? What is the point of pointing that out?
Then you just keep going off with your off-base assumption about me being a libertarian. Let me be clear. There is a huge difference between regulating an industry (what I want) and regulating the people. One is generally done to ensure a greater good is met and that wholesale harm is not done to communities (don't dump your waste into the water supply, etc.). The other is to ensure proper behavior of individuals in order to reduce harm to other members of the community (don't do murders, etc.).
This law only wants to stifle individuals to try and protect them from themselves. It limits the freedom of the individual for no real purpose. The government trying to protect you from yourself is generally a bad thing. The regulations I want would serve to better the community by stopping the flow of outrage to get clicks.
I'm essentially arguing that companies should not be allowed to dump their waste into the water supply. This law just is essentially equivalent to making you register your identify before you can drink the water. The problem is that if the water supply is still toxic, who are we helping?
And here is the issue. You think this age-verification can be handled well. I do not. At all. Aside from the data leaks waiting to happen, there is the eventual abuse by officials with this information who will target groups of people. Republicans are already going after minorities, women, the LGBTQ community, and drag queens. You think giving them more ammo to up their discrimination game is a good thing.
Consider all the big regulations that have been coming from the EU lately. They haven't targeted individuals, but have instead targeted companies in order to provide more freedoms to the people.
Maybe I missed something, but where does it target parents directly? It's a technical point, but I don't see this law as fundamentally different from what EU regulators are doing. It regulates...
Maybe I missed something, but where does it target parents directly? It's a technical point, but I don't see this law as fundamentally different from what EU regulators are doing. It regulates industry, which does change what people can do, but indirectly.
It seems quite similar to "know your customer" banking regulations. The government doesn't tell banks directly what their rules are, but it tells banks that they need to have rules and what they need to accomplish. They are "held accountable" if their rules are too lax.
I see content regulation as being fairly similar in implementation, but far more intrusive because the rules will be more vague and moderators wouldn't know specifically what to do to satisfy them. Opening an account happens once, and moderation happens all the time.
I don't know how social media companies can keep kids from getting targeted when they don't even know who's a kid. It seems like you are asking for advanced protections while saying that the basics are too intrusive?
Regarding age: apparently accounts can be opened at 14, but with restrictions. Regulations based on age are pretty crude (some kids are more mature than others), but we do have them for other things. Also, kids do things online at younger ages. But if they don't create the accounts themselves, it's more likely to be under supervision.
This commenters' last paragraph confused me for a second as well. They do agree that feeding kids toxic sludge is bad, they just want the government to force the companies to change the content...
This commenters' last paragraph confused me for a second as well. They do agree that feeding kids toxic sludge is bad, they just want the government to force the companies to change the content they provide so that this type of law would be unnecessary.
I don't hate the idea. But it can't be enforced without massive privacy issues. On the other hand, Facebook itself is a massive privacy issue, so maybe normal people don't care about that.
I don't hate the idea. But it can't be enforced without massive privacy issues.
On the other hand, Facebook itself is a massive privacy issue, so maybe normal people don't care about that.
Part of the real solution is enforcement for violations. There's a lot of things you cannot collect on children and cannot advertise to children. However "well they said they were 32 on the drop...
Part of the real solution is enforcement for violations. There's a lot of things you cannot collect on children and cannot advertise to children.
However "well they said they were 32 on the drop down box" apparently absolves them of this even when they use other data to confirm that "yeah this is a kid". If they have an analytics/marketing team that's in any way targeting under 18 that instantly should be red flags (see youtube...who's still doing it), but we don't do much other than slap on the wrist for this stuff.
It seems like there ought be something like a captcha service where all it reveals to the website is that the user is over a certain age. Maybe some websites that already require ID verification...
It seems like there ought be something like a captcha service where all it reveals to the website is that the user is over a certain age. Maybe some websites that already require ID verification could offer such a thing?
I don't trust any website that requires government ID to keep that information secure. Could you imagine how tempting a target a universally used website that verifies ages for hundreds of...
I don't trust any website that requires government ID to keep that information secure. Could you imagine how tempting a target a universally used website that verifies ages for hundreds of millions of people would be for hackers or data brokers? It would be the mother lode.
Checking ID doesn’t mean they have to save the photo. Stripe has an ID verification service that costs $1.50 each. (Probably cheaper at scale) I wonder how they handle security? US regulations...
Checking ID doesn’t mean they have to save the photo.
Stripe has an ID verification service that costs $1.50 each. (Probably cheaper at scale) I wonder how they handle security?
US regulations require businesses to check ids when hiring employees. HR departments often do this in pretty insecure ways, by making photocopies using ordinary office equipment. Outsourcing this to someone competent would probably be a step up.
The US federal government has a free E-Verify service, required by federal agencies and some state governments. A few states require it of all employees. Adoption seems slow. Why is that?
Well, employers want someone to do the job, right? Some of them may not want to outsource to a service that’s too rigorous about this.
Much like captchas, it’s a speed bump. I think websites that require age verification would want to outsource to a service that checks the boxes to show that they’re doing it, but other than that, they will prefer a low-cost option that doesn’t turn away too many people, and how secure that service really is probably doesn’t matter too much, as long as it doesn’t embarrass them.
A company like Apple or Google would definitely be embarrassed if they had the kind of security hole you envision. Incentives are no guarantee that they won’t make a mistake, but they have competent security teams that try pretty hard.
The cheap, third-tier id verification service that some porn site outsources to? Maybe not so much.
Apple and Google constantly have breaches. Every large technology company does, and that's including the ones that do it well. The average for IT security is much lower than Apple or Google...
Apple and Google constantly have breaches. Every large technology company does, and that's including the ones that do it well.
The average for IT security is much lower than Apple or Google though.
Any company that everyone universally trusts to do this sort of service will eventually be breached, meaning real identities will eventually be tied to the most embarrassing online activity there is.
Google was hacked by China in 2009, and the Snowden leaks revealed that the NSA was intercepting unencrypted traffic between data centers. Internet security has improved quite a bit since then. I...
Google was hacked by China in 2009, and the Snowden leaks revealed that the NSA was intercepting unencrypted traffic between data centers. Internet security has improved quite a bit since then. I don't think it's accurate to say that Google "constantly" has breaches and I would be surprised if they showed up on have I been pwned any time soon.
New security bugs are often found and fixed in security updates, though, and individual accounts do get hacked.
A privacy-preserving, captcha-like service that just claims "this user is older than X" seems like an unlikely risk compared to all the other large-scale hacks out there. I think a bigger risk is the website itself getting hacked via alternate means. I haven't heard of anyone getting hacked through a captcha service, because a captcha isn't authentication. You don't know who solved the captcha. Neither would an age verification service be authentication, if done right.
Meanwhile, every bank and employer you do business with knows a lot more about you.
I may not be tech enough to understand it, but I have a few issues with that. First, it still means that my PII (personally identifying information) is in the database of some database connected...
I may not be tech enough to understand it, but I have a few issues with that.
First, it still means that my PII (personally identifying information) is in the database of some database connected to the internet, configured to provide portions of it in response to the right query. That database will be breached, and my information spread far and wide.
Second, whatever the "key" is to verify my ID, wearer it is a password, a QR code, am alphanumeric string, that thing is now my ID. If someone captures that, they can now verify themselves as me, anywhere the system is used.
Third, it brings a third party into what should be a two-party transacting. (Well, fourth into a three, if you count the government)
It depends how it's done. If the account contained a picture of your driver's license, or information from it, then leaking it would be bad. But a secure service could verify it and then throw...
It depends how it's done. If the account contained a picture of your driver's license, or information from it, then leaking it would be bad. But a secure service could verify it and then throw away the picture. The only thing left in the account would be a pass that says "I'm an adult." This would be like someone at an event who verifies your ID and then gives you a drink token. The drink token is not an ID; it's anonymous.
So if someone breaks into the account, all they find in there is a pass that lets them open an account with a social network. Sure, some kids would want to steal one, but for most people, it's not valuable, because they can get their own, and they probably have social media accounts already.
Also, it doesn't hurt you if someone steals it. (This is a problem for keeping kids from getting in since there's no reason not to share accounts, but it's not a privacy problem.)
There are also ways to avoid revealing one website to another. With the right protocol, your browser could be in the middle.
That's just a sketch and there would be more to a real protocol, but I think it could be done while avoiding the problems you bring up.
(Whether the system gets designed properly is another question.)
Something I've wanted a few times (usually after dealing with young children popping into a discord server that usually leans towards adult conversations) is a government run oauth service that...
Something I've wanted a few times (usually after dealing with young children popping into a discord server that usually leans towards adult conversations) is a government run oauth service that provides a property with what age group the person is in.
If that were a thing, you wouldn't need to worry about each company's privacy/security policies around verifying IDs, you just need to login with that service and they'll have access to a few basic details about you that are listed before you approve the authorization.
I don't see Facebook spending the money to build a whole new age checking website just for Florida. I have a feeling they'll just leave the way PornHub has left Texas.
I don't see Facebook spending the money to build a whole new age checking website just for Florida. I have a feeling they'll just leave the way PornHub has left Texas.
The sweeping restrictions prohibit children 13 and younger from creating social media profiles, and requires parental consent for those between 14 and 15. Under the new law, social media platforms will be required to delete existing accounts for children younger than 14 — though account holders will have a 90-day period to dispute terminations. If platforms “knowingly or recklessly” violate the law, they can face up to $50,000 per violation in civil penalties. The bill also bans minors from “pornographic or sexually explicit” websites and requires age verification to access these sites.
Major social media platforms, including Instagram, Facebook and TikTok, require users to be at least 13 — a requirement that stems from the 1998 “Children’s Online Privacy Protection Rule,” which banned the collection of children’s personal data without parental consent. However, a survey published in 2022 by the nonprofit research organization Common Sense Media found an upswing in usage among children ages 8 to 12.
While the bill, H.B. 3, does not specify which social media platforms would be affected by the changes, its text states that it applies to sites where more than 10 percent “of the daily active users who are younger than 16 years of age spend on average 2 hours per day” — as well as those that have “addictive features” such as infinite scrolling and push alerts.
…
According to a tally by the National Conference of State Legislatures, more than 140 bills on the issue are pending this year across 30 states. Last year, 13 states passed 23 new laws on child safety — which included imposing verification requirements, granting greater parental oversight and limiting children’s social media usage, according to a report by the University of North Carolina’s Center on Technology Policy.
…
Like similar laws passed in other state legislatures, Florida’s new restrictions — which are set to take effect in January 2025 — are likely to face constitutional backlash over concerns they infringe on free speech and would push companies to collect even more data to verify that children are not accessing their sites. Federal judges temporarily halted similar laws in Arkansas and Ohio from going into effect, citing concerns they may run afoul of the First Amendment.
Don't most social media already not allow children 13 and younger? I know that that isn't exactly enforced, but this mostly seems like codifying already existing policy into law (not that that is...
prohibit children 13 and younger from creating social media profiles
Don't most social media already not allow children 13 and younger? I know that that isn't exactly enforced, but this mostly seems like codifying already existing policy into law (not that that is necessarily a good thing).
I'm somewhat torn on these laws, as I understand the downsides of social media in children/teens, but I'm also rather concerned about the privacy implications of websites needing to confirm your age. It's a much tougher issue to figure out where I stand on it than I would expect.
It boils down to the age-old "security vs liberty" argument. Striking a perfect balance between the two is essentially impossible, and a free society will always have strife and drama that results...
It's a much tougher issue to figure out where I stand on it than I would expect.
It boils down to the age-old "security vs liberty" argument. Striking a perfect balance between the two is essentially impossible, and a free society will always have strife and drama that results from the tension.
I've honestly been shocked at how many people are okay with these laws.
They are a privacy nightmare, and people are freely welcoming the government into their lives. Note that I say that as a "The Squad"-supporting leftie. This is also a law treating a symptom and not the root-cause, which is the modus operandi of social networks. Social networks are awful because it's profitable to be so.
Instead of regulating citizens and diminishing their freedoms, the government should regulate the "social network industry." There has got to be a way to codify some guidelines that make the promotion of hateful and divisive content for the sake of "engagement" illegal or at least subject to heavy fines.
My most recent personal example was a YouTube search. They know my political leanings. I had some channels floated to me recently that demonstrate this. I wanted to watch some Ted Lasso clips. And they wanted to serve me Matt Walsh. Every now and again they try to sneak some far-right drivel or other conspiracy-theory BS into my feed and I end up having block more channels and ads. It's not that I want to shut out other viewpoints. But they're never good faith arguments, it's rage-bait. And YouTube goes out of its way to show me content they know I will have a strong reaction to. They want that "engagement."
So, take a kid that doesn't have much experience, generally speaking, throw them on a social network that was designed to feed them toxic sludge (even without a precursor), and bad things will happen. And people are celebrating laws that restrict the kid? That's backwards.
I’m confused about whether you think it’s a good or a bad thing when kids create social media accounts on services that serve them “toxic sludge.”
Why is the choice binary? That's artificial. And toxic sludge need not be in quotes. I regularly block at least half a dozen pages every time I check in to my Facebook. I've had to cull people because of the literally batshit stuff they spew.
Seeing things as "good" or "bad" only and refusing to acknowledge the massive chasm of grey in between is disingenuous. It also ignores my point that this law is going after a symptom, allowing the disease to continue unabated.
So I have to ask what the point of this question is? If I say it's a good thing, I go against the empirical data of how awful social networks are, especially for young people. If I say it's a bad thing, I'm going against my earlier point. This just seems like a poor trap.
For example, should a kid be thrown blind into the deep end of anything? I imagine the answer to that is 'No.' Now, say the kid has had a couple conversations with their parents about what to look out for on a social network, and an open invitation to ask the parents about anything that seems shady. Say you even get the kid to agree to audits. What's the answer then? It's not a 'yes' or 'no,' it's still a maybe. No one could say for sure except the parents, and even that's prone to error.
But my point is that for the question "Should the government be the decider and gatekeeper in this," my answer is a hard no.
Consider other things that are empirically bad for people. Like lead, asbestos, or CFCs. In those cases, the right thing was done and the use of the "bad things" was regulated, not the people who used them. Now, I'm not advocating that social networks cease to exist. I'm advocating that the intentional rage-baiting and (in the case of Snapchat) connecting of predators to minors be regulated.
This is a problem I will be facing myself in a few years. My take is that this is a parenting issue, and the solution must be a suitable one for each family. I want some government intervention, but absolutely not like this.
I'll certainly take "it all depends" as an answer (it's my answer). But I don't know why you are so strongly against this regulation and what other regulations would be better? It seems like this law is in favor of parents watching over their kids since it requires parental consent to create an account from 14 to 15? Knowing which accounts your kids have seems kind of basic for watching over what they do online?
Some of your rhetoric seems rather libertarian for someone who's actually in favor of some regulation. Regulation is "freely welcoming the government into their lives." (I mean, it's already here. Lots of industries are heavily regulated.) The government is being the "decider" and "gatekeeper" about some things. (This is often justified as "the will of the people," though I think that's often a stretch.)
But, if you're not actually a libertarian or anti-government, why are you "shocked" that some people think this regulation might be a good one?
I don't have much of an answer here, but it seems to me that age verification is less intrusive than regulating content, particularly if it can be done in a privacy-preserving way, and I think it can.
What regulations would be better? I've stated as much already. I think they get reiterated throughout this post.
The law is not in favor of parents. It tells parents what to do. There is a huge difference there. If parents didn't care before, this law won't get them to care. It's an extra step, and all you have to do is consent to share your identifying information to a central authority in order to use a web site. Not just kids. Everyone. That sounds nothing like Big Brother at all! By the terms and conditions of most social media sites, they are allowed to create an account when they're 13. Now the state has come in and said "No, you have to be 16."
Libertarian? How? Because I think the government intervention is aimed at the wrong group? All regulations are not equal, and the fact that I have to point this out seems ludicrous. Is your opinion of left vs. right in the US so reductive that you think I'd be for any and all regulations? And then the rest of that paragraph is taking my specific argument and straw-manning and generalizing it until it fits your rebuttal. Do you honestly think I don't know that industries are regulated? What is the point of pointing that out?
Then you just keep going off with your off-base assumption about me being a libertarian. Let me be clear. There is a huge difference between regulating an industry (what I want) and regulating the people. One is generally done to ensure a greater good is met and that wholesale harm is not done to communities (don't dump your waste into the water supply, etc.). The other is to ensure proper behavior of individuals in order to reduce harm to other members of the community (don't do murders, etc.).
This law only wants to stifle individuals to try and protect them from themselves. It limits the freedom of the individual for no real purpose. The government trying to protect you from yourself is generally a bad thing. The regulations I want would serve to better the community by stopping the flow of outrage to get clicks.
I'm essentially arguing that companies should not be allowed to dump their waste into the water supply. This law just is essentially equivalent to making you register your identify before you can drink the water. The problem is that if the water supply is still toxic, who are we helping?
And here is the issue. You think this age-verification can be handled well. I do not. At all. Aside from the data leaks waiting to happen, there is the eventual abuse by officials with this information who will target groups of people. Republicans are already going after minorities, women, the LGBTQ community, and drag queens. You think giving them more ammo to up their discrimination game is a good thing.
The companies need to be made accountable. Here's an anecdote. Here's a rundown of Snapchat that literally states "Snapchat is the preferred app of sexual predators.". Here's an application of that statement. But you're saying the companies should continue to be allowed to do as they please, and the laws should instead regulate the people. It's backwards.
Consider all the big regulations that have been coming from the EU lately. They haven't targeted individuals, but have instead targeted companies in order to provide more freedoms to the people.
Maybe I missed something, but where does it target parents directly? It's a technical point, but I don't see this law as fundamentally different from what EU regulators are doing. It regulates industry, which does change what people can do, but indirectly.
It seems quite similar to "know your customer" banking regulations. The government doesn't tell banks directly what their rules are, but it tells banks that they need to have rules and what they need to accomplish. They are "held accountable" if their rules are too lax.
I see content regulation as being fairly similar in implementation, but far more intrusive because the rules will be more vague and moderators wouldn't know specifically what to do to satisfy them. Opening an account happens once, and moderation happens all the time.
I don't know how social media companies can keep kids from getting targeted when they don't even know who's a kid. It seems like you are asking for advanced protections while saying that the basics are too intrusive?
Regarding age: apparently accounts can be opened at 14, but with restrictions. Regulations based on age are pretty crude (some kids are more mature than others), but we do have them for other things. Also, kids do things online at younger ages. But if they don't create the accounts themselves, it's more likely to be under supervision.
I think they think it’s a bad thing that companies are allowed to make services and algos that serve up toxic sludge to kids in the first place.
This commenters' last paragraph confused me for a second as well. They do agree that feeding kids toxic sludge is bad, they just want the government to force the companies to change the content they provide so that this type of law would be unnecessary.
I don't hate the idea. But it can't be enforced without massive privacy issues.
On the other hand, Facebook itself is a massive privacy issue, so maybe normal people don't care about that.
Part of the real solution is enforcement for violations. There's a lot of things you cannot collect on children and cannot advertise to children.
However "well they said they were 32 on the drop down box" apparently absolves them of this even when they use other data to confirm that "yeah this is a kid". If they have an analytics/marketing team that's in any way targeting under 18 that instantly should be red flags (see youtube...who's still doing it), but we don't do much other than slap on the wrist for this stuff.
It seems like there ought be something like a captcha service where all it reveals to the website is that the user is over a certain age. Maybe some websites that already require ID verification could offer such a thing?
I don't trust any website that requires government ID to keep that information secure. Could you imagine how tempting a target a universally used website that verifies ages for hundreds of millions of people would be for hackers or data brokers? It would be the mother lode.
Checking ID doesn’t mean they have to save the photo.
Stripe has an ID verification service that costs $1.50 each. (Probably cheaper at scale) I wonder how they handle security?
US regulations require businesses to check ids when hiring employees. HR departments often do this in pretty insecure ways, by making photocopies using ordinary office equipment. Outsourcing this to someone competent would probably be a step up.
The US federal government has a free E-Verify service, required by federal agencies and some state governments. A few states require it of all employees. Adoption seems slow. Why is that?
Well, employers want someone to do the job, right? Some of them may not want to outsource to a service that’s too rigorous about this.
Much like captchas, it’s a speed bump. I think websites that require age verification would want to outsource to a service that checks the boxes to show that they’re doing it, but other than that, they will prefer a low-cost option that doesn’t turn away too many people, and how secure that service really is probably doesn’t matter too much, as long as it doesn’t embarrass them.
A company like Apple or Google would definitely be embarrassed if they had the kind of security hole you envision. Incentives are no guarantee that they won’t make a mistake, but they have competent security teams that try pretty hard.
The cheap, third-tier id verification service that some porn site outsources to? Maybe not so much.
Apple and Google constantly have breaches. Every large technology company does, and that's including the ones that do it well.
The average for IT security is much lower than Apple or Google though.
Any company that everyone universally trusts to do this sort of service will eventually be breached, meaning real identities will eventually be tied to the most embarrassing online activity there is.
It's not a good path to go down.
Google was hacked by China in 2009, and the Snowden leaks revealed that the NSA was intercepting unencrypted traffic between data centers. Internet security has improved quite a bit since then. I don't think it's accurate to say that Google "constantly" has breaches and I would be surprised if they showed up on have I been pwned any time soon.
New security bugs are often found and fixed in security updates, though, and individual accounts do get hacked.
A privacy-preserving, captcha-like service that just claims "this user is older than X" seems like an unlikely risk compared to all the other large-scale hacks out there. I think a bigger risk is the website itself getting hacked via alternate means. I haven't heard of anyone getting hacked through a captcha service, because a captcha isn't authentication. You don't know who solved the captcha. Neither would an age verification service be authentication, if done right.
Meanwhile, every bank and employer you do business with knows a lot more about you.
Ask trivia questions like Leisure Suit Larry. If the kid is smart enough to cheat, they can handle the consequences.
I may not be tech enough to understand it, but I have a few issues with that.
First, it still means that my PII (personally identifying information) is in the database of some database connected to the internet, configured to provide portions of it in response to the right query. That database will be breached, and my information spread far and wide.
Second, whatever the "key" is to verify my ID, wearer it is a password, a QR code, am alphanumeric string, that thing is now my ID. If someone captures that, they can now verify themselves as me, anywhere the system is used.
Third, it brings a third party into what should be a two-party transacting. (Well, fourth into a three, if you count the government)
It depends how it's done. If the account contained a picture of your driver's license, or information from it, then leaking it would be bad. But a secure service could verify it and then throw away the picture. The only thing left in the account would be a pass that says "I'm an adult." This would be like someone at an event who verifies your ID and then gives you a drink token. The drink token is not an ID; it's anonymous.
So if someone breaks into the account, all they find in there is a pass that lets them open an account with a social network. Sure, some kids would want to steal one, but for most people, it's not valuable, because they can get their own, and they probably have social media accounts already.
Also, it doesn't hurt you if someone steals it. (This is a problem for keeping kids from getting in since there's no reason not to share accounts, but it's not a privacy problem.)
There are also ways to avoid revealing one website to another. With the right protocol, your browser could be in the middle.
That's just a sketch and there would be more to a real protocol, but I think it could be done while avoiding the problems you bring up.
(Whether the system gets designed properly is another question.)
Something I've wanted a few times (usually after dealing with young children popping into a discord server that usually leans towards adult conversations) is a government run oauth service that provides a property with what age group the person is in.
If that were a thing, you wouldn't need to worry about each company's privacy/security policies around verifying IDs, you just need to login with that service and they'll have access to a few basic details about you that are listed before you approve the authorization.
I don't see Facebook spending the money to build a whole new age checking website just for Florida. I have a feeling they'll just leave the way PornHub has left Texas.
From the article:
…
…
Don't most social media already not allow children 13 and younger? I know that that isn't exactly enforced, but this mostly seems like codifying already existing policy into law (not that that is necessarily a good thing).
I'm somewhat torn on these laws, as I understand the downsides of social media in children/teens, but I'm also rather concerned about the privacy implications of websites needing to confirm your age. It's a much tougher issue to figure out where I stand on it than I would expect.
It boils down to the age-old "security vs liberty" argument. Striking a perfect balance between the two is essentially impossible, and a free society will always have strife and drama that results from the tension.
Nothing reduces behavior in children (humans) like adults (authority) telling them they can’t do something.
Mirror, for those hit by the paywall:
https://archive.is/UzbAy