Don't get me wrong, I'm all for privacy. But between setting up the birthdate when creating my children's local account on their computers, and having to send a copy of their ID to every platform under the sun, I'd easily chose the former.

I'd even agree to a simple protocol (HTTP X-Over-18 / X-Over-21 headers?) to that.

OS defined does seem the best way, but I would prefer it wasn't legislated. The people writing these rules have no clue about the real world, so they end up doing stupid things.

You aren't setting up your childrens accounts. You're setting up your accounts to show that you're not a child. And suddenly, every single thing you use, from apps to websites, is gatekept behind an API that is controlled by the government. If checking age on social media is all it ever does, then sure, whatever. But that isn't all it will ever do. It will creep further and further, and the details you need to provide will increase, one shitty government term at a time. And then one day, they'll able able to decide that people in your country shouldn't be able to see safe sex information, or abortion information, and the framework to deny the whole country access is already there, and just one small tweak away from locking you out of information that is deemed inappropriate.

I don't necessarily have an issue with that - as long as it can truly be done in a way where the only information the platform gets about me is whether I'm of age (they don't even need to know my exact age). But I don't have faith that it can actually be done like that, and I see it as a slippery slope toward even more surveillance.

They can have one bit. I'm ok with one bit.

As soon as they ask for a byte, they are gathering too much information about me.

I can accept that this is a significant issue, and if knowing that I'm an adult is required for certain online activities, I'll go along, but we all know damned well this will creep.

What ever elements need to verify who I am stay private client side, and they can have a single flag that verifies I'm what I claim to be.

If checking age on social media is all it ever does, then sure, whatever.

You're forgetting an important detail: you submitted an official ID to prove your age. Which means your face, address, and legal name are also on record. So every time you get age-verified, you're basically checking in with your full legal identity, leaving a breadcrumb path across the Internet of everything you do. That data can be used to track your online activities and build a database on who you are as a person, based on the things you access.

THIS is why age verification is a terrifying thing for computer access. It's a form of government tracking that should be illegal. Cops can't legally barge into your home anytime they want and go through your stuff. They can't take your computer and scan it for data collection. Not without a court order.

With age verification embedded within your OS, it won't matter if there's a court order or not. If your computer is connected to the Internet, you've just publicly broadcast all your data to the world, and anyone - cops or not - can tap into that data and build a profile on you. You don't even need to be browsing the Internet; if your OS is verifying your age, it could also be broadcasting that verification for every program you use locally on your computer. None of your data is safe; it's all tied to your legal identity and trackable.

Will you be allowed to lie about the age? If yes, then it's a pointless law. If no, then whoever is checking needs to have more control over your device than you do, DRM style. That's gives them an entry point through which they can put whatever they want without you being able to control it.

Thats not what the current OS-level age gating is though. Its literally pick what age the account user is on account creation. You could set yourself to be 120 and that would be valid.

OS age verification would effectively make some, if not most, linux distributions (or other less-popular operating systems) illegal. Because many linux distributions are made by small team of volunteers. In some cases a linux distribution might be maintained by literally one person. So these people likely do not have the time or money to include something like age verification into the operating system.

That said, there are some technically possible ways where this could be done to reduce the load on developers (perhaps with access codes, and a government maintained database) but the way age verification had is being done right now (face scanning, etc) would be a real headache to implement and quite possibly cost or time prohibitive.

It would be a shame if age verification laws effectively made open source operating systems illegal. It would suck if these laws inadvertently made it legally required that we need to support big tech companies like Apple or Microsoft in order to use a computer.

So you're ok about your official ID being broadcast everywhere you go on the internet? Every step you take can be tracked by the government, google, Meta and more? No more fucking privacy what so ever?

It can be done like that, but then it'd be (trivially) fake-able by anyone with root permissions on their own computer. But then, my point is that kids shouldn't be root of their computers, so let's just parents vouch for children's age, and leave everything more complicated out.

From what I understood, the rules (in California?) would be :
a) Every operating system provider must collect the user’s age or date of birth during the initial account setup process.
b) The OS must classify the user into one of the four defined age brackets: under 13 years old, 13–15 years old, 16–17 years old, or 18 years and older.
c) This information must be made available to application developers through a real-time API as soon as an application is launched or downloaded.

Unless I've missed something, I could definitely live with that. I haven't seen anything more acceptable when it comes to age verification. Point a) doesn't need to prove age or date of birth.

Now there is a small issue that came to my mind since my first post, which might be quite problematic : if ANY website is able to tell whether ANY user is a child, it'll be as easy to keep children out of certain sites that it'll be easy to keep adults out of others.

Imagine a bulletin board with highly disturbing/predatory content which would ONLY show to kids? Whenever mom or dad checks, website is all normal. And that would be real bad, probably worse than our current, no age verified situation.

Yes. That's exactly what I'm saying.

No. As soon as you're sending in your official ID your entire online presence will be tracked to your ID by the government, Google, Meta and the likes. Privacy is totally gone by then...

Including an age flag field in user data on Linux is fairly trivial, and I've seen several proposals for it. Once that's in place it's up to browsers, "app stores", or anything else that needs it to request the data and use it.

This is why I consider it regulatory capture in a trench coat.

The Califirnia law, at least, states the age flag should be set when the account is created, presumably by the controller of the computer, and holds that controller responsible for setting it correctly, and the developer responsible for ensuring it's set and works correctly, at least, that's my reading of it. If it's your computer, that makes you resoonsible for setting your age and that of accounts you create for your children.

Including an age flag field in user data on Linux is fairly trivial, and I’ve seen several proposals for it

What would these systems look like? Im curious.

My concern is that, even if these systems are technically possible, the law will settle on using lucky inefficient methods of age verification such as using AI to scan someone’s face.

Just because one option is better than another, doesn't mean it's good.

OS level age check applies to everyone, not just children. Some legislations require strong age checking, which means you need to send some identification to some service. You won't be able to know how the information is handled, for how long it's stored and for what purposes it's used beside age checking. And because this applies to everyone, and is required to be able to use your computer, everything you do with your computer and phone is tied to your user account, and as such to you as an individual and identifiable human being.

Some of these legislations uses age ranges, and the OS is required to inform applications, and such, whether the user is, for example, below 13 years old, or 13 to 16 years old, etc. Consider this simple scenario: Some user uses some application, and the OS reports the user's age as below 13. The user uses the same app the next day, but now the OS reports the user's age as 13 to 16 years old. Can you figure out the user's exact birthday and age? If that application is part of some kind of larger network of advertisers and whatnots, they will now forever know the user's exact age without the OS reporting anything else.

These can also be used to make some software illegal, especially free and open source software. If you can replace Windows with Linux, Photoshop with Gimp, etc. it hurts the bottom line of those companies. Those companies can't prevent you from using the open source alternative, but it would be in their interest if those pieces of software becomes illegal to use and distribute. If age checking functionality is added to some open source software, the age checking can simply be removed by the user. You only need to correctly form the age checking law and that entire software is now illegal, and must be removed from the internet.

While the intention of these laws might to be to protect children, they cause too much harm for little good. The age checking can be circumvented in some situations, meaning the children aren't protected. And the entire thing is a huge privacy mess (data leaks, etc.) for every single computer user.

What would you say if, to be allowed to open your fridge (the one you own and purchased with your money) in order to pick something to eat out of it, you were required to make a blood test (say through some mechanism included in the door handle) to prove that you don't have any serious disease preventing you from, say, eating a slice of that delicious cake, or whatever?

The idea might not be completely stupid (one with some serious disease should not not eat what can harm them) but the implementation is not right. It's considering 100% of the population as suspects by default; just because they exist and have a fridge.

Replace 'fridge' with computer, 'cake' with online content, and 'disease' with 'being a minor'. That's how sad that is.

What is a computer? My microwave has a computer in it. My car. My printer. My smartwatch. My TV. My treadmill. My security cameras. Many many things have little embedded systems running linux. Some are Internet connected, some aren't. This feels terribly invasive for something that allegedly protects kids (doubtful). What if i don't have any kids in my household? Would this have stopped Trump and his friends? How about the government focus on real problems instead of requiring cameras be installed on my toaster and a credit card to be able to watch TV.

“current” is not what the lawmakers are thinking of though.

and to prove its not actually about safety and instead about control: parents are already responsible for what kids do online and could be charged using existing laws. but… where is the overreach in that?!

and to prove its not actually about safety and instead about control: parents are already responsible for what kids do online and could be charged using existing laws. but… where is the overreach in that?!

It one of the reasons I like the way the California bill has been written, it's very clear that you set the flag, or provide a date, and not only makes no mention of verifying it in any way, but also requires that anything using it trusts it and may not perform any other checking. A service using that data is also explicitly not liable if it's wrong, so they have no insentive check any further.

It is, obviously, possibly that laws will change in future, but it seems to me that having something like this in place actually makes it harder to implement anything more intrusive later.

and to prove its not actually about safety and instead about control: parents are already responsible for what kids do online and could be charged using existing laws. but… where is the overreach in that?!

Just because they are responsible doesn't mean the have the means to exert their responsibility. Demanding birth-date upon (local) account creation would allow them to better exert that responsiblity.

no it wont. kids get around shit easier than ever especially with luddite parents.

if the gov actually cared they’d take to charging using existing laws.

It's techno-fascism

Whilst parents absolutely should be guiding and helping the kids determine where they go online, and what they look at, I'm trying to envision where, or how, parents would be liable for them looking at something inappropriately "adult", barring actual child neglect.

A system like this would actually help parents be more confident that little Johnny wasn't going to stumble across something in appropriate, because, yes, in a way this is about control. It's about controlling what kids are exposed to before they are intellectually ready for it. Yes, there are potentially serious issues around that, such as limiting access to LGBTQ+ or other helpful material for young adults, but that should be a discussion around what information is needed at each age, rather than how to indicate that age.

Age gating on the open internet will happen, I don't see any way that it wont, what matters is how it is implemented. We know that submitting government issued ID to every site with potentially contentious content is a terrible idea; this neatly sidesteps the need for that, and actually forbids it.

for ex: if you let your kid look at porn, in the US, the parents are absolutely liable for various forms of “risk of injury to a child “ laws.

Well, the problem is less setting up the birthdate and more whether the birthdate needs to be verified.

Plenty of OSs already query for a birthdate, particularly on gaming devices. And yes, they will provide age-based protections already.

The question is, does the parent/account creator need to enter an accurate birthdate or not, and how does the system know?

If they don't, then whatever, it's the same self-declaration we already have all over the Internet. No biggie. Everybody was born in 1901 and we're all chill about it. It still makes for an absurd situation where you HAVE to have a personal profile for every user on every computer, which a ton of computers aren't expecting, so it's still dumb on top of being useless, but it's a solvable problem.

If they do, then you know have one of the biggest cryptographic and data management challenges in computing history. How do you have every single device across the entire planet interface with every single piece of software and server to authenticate a piece of personal data and safely store it so you don't have to constantly re-check? It's insane. Plus it removes a parent's ability to enable their children to engage with content at whatever speed they see fit. And there are potentially different regulations in different areas, where both the server and user location may change the required behavior, so the whole thing is an absolute mess from the concept up.

My calculator doesn't need to know how old anyone is. Nor does my refrigerator. I suppose a case could be made for a router if you are all onboard for age gating everything privacy and freedom be damned. An OS isn't just Mac or Windows... the CA law is just so so dumb as written that I have zero faith in anything from Silicon valley.

let's follow the argument this is to protect children: why does is seem like a good idea to let everybody on the internet know what age your child is?

so if it is not to protect the children, what else could it be?

Yep. This is pretty much it. Require having popular operating systems to have child accounts as an option would be reasonably ok. But regular accounts shouldn't need any verification. ID checks wouldn't need to be anywhere near this either. Its on the parents, they didn't setup a child account? They are to blame.

most homes don't run their computers in multi-user mode. Even when they do most kids will learn the admin password because parents don't select good passwords.

Kids are not stupid. Even if some are, there are many kids in school and so any bypass will spread kid to kid fast. For each of the following reread this paraghraph to remind yourself all kids will know this.

kids can install linux /bsd on a raspberry pi or old/cheap computer - this is something I want to encourage. that of course means they are root and can claim whatever age. They can likewise do it in a vm.

if there is any security flaw kids can use it to change their age.

many programs will not check when they should. Kids will install/use these instead. this is a likely exploit vector of actors (in foriegn counties) that target kids - release a new program that does what the kids wants while also doing what they want. (Websites have done bitcoin in javascript while you read them)

who will check? onlyfans probably will, but small web sites spring up all the time, and they won't bother - many are already illegal (either copyright or illegal content).

Meanwhile many programs that we want kids to use won't bother to check. why would things autocad check - they target professionals but kids can use them and may even have to.

the above is not a complete list!

Age is useful for 'buy cigerettes' that is illegal for kids in some way.

However most of what parents care about isn't automatically bad and I know plenty of panents who are frusterated because we can't controll things how we need to without being a helicopter parent (bad). Playing video games is fine in moderation - AFTER YOUR HOMEWORK IS DONE - but we don't get an easy way to enforce that. My teens are old enough to stay home alone and do homework - but they will not do their homework when they can do something else (this problem has been around since school)

my kids phones have parental controls that I turn on. However they lack a way to enforce homework vs play vs sleep time. There is likely more, this is just what frusterated me yesterday. some things are not gated - my kids have got up at 3am, and connected their school device (under school control not me) to their phone hotspot (turned on who knows when - I can't block that at all) to play a game that the school will block next week when they figure out it is one kids are playing but they shouldn't.

people are proposing age verification because they have no idea what else they can do and are frusterated at how bad things are.

At least my printer already has a scanner I can put my ID into. How am I going to tell my smart fridge, that I'm not too old for the snacks with cartoon characters on the wrapper?

Yeah I’ve heard of similar systems in Europe. It’s similar to two factor authentication. Hopefully something like this could also screen out bots, making influence campaigns more difficult. But regardless, however its implemented I hope it will be easy for not-for-profit operating systems (such as linux distros) to operate

Because they don't care about your age. They want to tie you to your ID, so everything you say and do online can be tracked and tied to you as a person.

Meanwhile the leader of one of their countries has raped women and teenagers and even a couple of children, but they don't do anything about it. But you can be jailed for decades for seeing a picture or video of it. But the actual act? They don't care about that. (I'm saying you can be jailed for simply seeing CSAM online, but if you're a billionaire actually doing the things, you won't be tried for the actual CSA being recorded.)

So as you can see, it's not your age, but your identity.

Most people think the Nazis only locked up Jews. Some realise they also locked up minorities. Historians know it was also anyone who disagreed with them. Anyone who spoke out against them. Anyone who wouldn't wear the armband. And they're afraid history will repeat. And they're right to be afraid.

Nice to see lots of downvotes for stating factually correct statements while the parent post is literally all conjecture based on "well they would do that wouldnt they?" but is upvoted.

If they were planning on doing ID verification for this why would they take this half step? It doesnt make it easier for them down the road, if anything it makes it harder as there's the ability to say "but we already have that". If the plan was to mandate face ID why wouldnt they just go straight for that like the UK and Australia have for porn?

Parents of current 8-18 year olds are gen X and millenials, who every survey shows are (on average) significantly more tech literate than gen Z and Alpha.

https://en.wikipedia.org/wiki/Boiling_frog

And there are several states that do have the age thing for porn here in the US, the biggest of which is Texas.

So exactly the same argument, while referencing an experiment where the frogs did jump out of the boiling water unless they were lobotomised. Very convincing.

Voice recognition with the latest brainrot phrases built in, grouped by generation.

"That's gnarly, bro" - Millennial

"Skibidi Ohio Toilet brah" - Gen Z

"6 7 6 7” - Gen Alpha

C'mon, don't be that dense, it's is a metaphor explaining that people are more likely to accept change if done gradually as opposed to all at once.

unless they were lobotomised.

Look around. Think of the average person, half of the people are below that person's intelligence and a good number of them vote.

As others have said

It has nothing to do with age checking, protecting the children, or security. NOTHING.

Lots of people are about to be born on 01-01-1900. I guess 01-01-2000 works now though. Man, I'm old.

But between setting up the birthdate when creating my children's local account on their computers, and having to send a copy of their ID to every platform under the sun, I'd easily chose the former.

This is how they move the goalpost. They changed the argument.

You currently can just create a local account - period. It's yours. No tracking. No personal info.

But now you're accepting that you're willing to give a third party information, even just a little.

The next argument is: "If giving your age is okay, why not your home address?"

This is what police do to fish information out of you.

I'd even agree to a simple protocol (HTTP X-Over-18 / X-Over-21 headers?) to that.

In a era where privacy conscious people don't even connect their TV to the internet... This is okay to you?

You went from "Why do they want my information?"

To

"I'm not concerned with sharing my age. But how should we do it?"

And that itself is the root issue.

I know its a metaphor, but you can come up with any metaphor you want its still just speculation based on nothing. It's precicily the same argument that conservatives made about gay marriage: this is just the thin end of the wedge, it starts with allowing people to marry people of the same sex and then they'll move on to incest and bestiality.

Its a crap argument, if you want to oppose something show how this wither makes things worse or how it makes worse things easier to happen in the future. A good example would be the freedom restricting legislation brought in after 9/11. Despite assurances at the time that it would just be used against "terrorists" there was nothing in it to garuntee that, at you could make the argument that the legislation with no further changes could be used to do harm. Lo and behold it was.

Just pointing at something and saying "slipperly slope" or "boiling the frog" is not an argument against something unless you can show how it makes the next step easier, and I havent seen any actually thought through argument how this does make mandatory identification easier.

C'mon, don't be that dense

I don't think it's "dense" to point out that your metaphor depends on a common misunderstanding of an experiment. An experiment where the true result actually is an argument against your point.

remember the ridiculous percentage of 1/6 insurrectionists they rooted out, based on social media posts

To be fair, that was mostly because those people are absolute fucking morons who posted videos of themselves and their buddies involved in, or actually committing, crimes.