Seriously ready to fully drop google emails and services, i'm using vivaldi + personal email for a while now, the migration was slow a bit painful but complete.
Only the phone is still attached to play store and google, but i'm 100% ready to switch to the fully supported Chinese variant of ColorOS and flush Google into the toilet once and for all. But my next phone will 100% be a Sailfish again.
Companies have show that they are incapable or unwilling to address the problems they cause. And market forces are not working to correct things. It’s also pretty obvious that saying “parent should take responsibility” is also not working. Just observe the world around you to know it’s a non starter.
This is where regulation is supposed to come in.
At the same time, companies have shown that they will abuse any personal information that is shared with them and we are now giving them more details about ourselves…
I don't want the market solving this. If we are going to do age checks it should be based on public key cryptography, be open source, and handled by the government. You verify with the government (or don't since they already know your age), you get some form of cryptographic attestation, present said attestation to websites/apps.
I'm not a fan of age verification in the first place, but I am extremely not a fan of random third parties doing the verifying.
This is scary though too. If the gov managed a key server like this, almost all companies would start requiring it. But this effectively gives the gov a very easy way to lock you out of everything.
This is really nothing new and has always be the case
It's not possible to tech yourself out of a political problem.
So if there is something being done we should choose a solution that has at least some accountability to the general public (through elected representatives).
The alternative is Google, Apple etc where almost anyone has exactly zero influence and the government can still block as they like.
This will be possible if done by third parties anyway, it will just be apple, google and maybe meta, a single phone call is enough to cut you off.
At least if the government is doing it, the app doesn't get your id.
If it has to happen, this is exactly how it should. Please feel for those of us in the UK who are currently denied access to some pretty significant services unless we send our passport to a random third party.
And, that public key of yours must be used only on given platforms. You want to participate on Facebook or Reddit, then you use that public key to prove who you are. Which platforms require verification is another issue.
But it should still be legal and allowed to access conventional forums, Usenet , tor accessible discord servers without having to prove who you are.
Otherwise , the right to organize is over and we effectively live in an authoritarian regime .
The difference here is that in a functioning democracy people have some control over their government. All the institutions are specifically built to be transparent and work for the public good, at least, in some sense of the word. A corporation, especially a monopoly doesn't care what you think, you have no control over it and the only thing that really matters to them is their bottom line. Are governments perfect? Of course not. Are random corpos better? Again, of course not.
>It’s also pretty obvious that saying “parent should take responsibility” is also not working. Just observe the world around you to know it’s a non starter.
Then who should? Government, where each implementation strips away rights to privacy - which in some countries, including mine, are a constitutional right? Where it expands powers of government to track everyone's activity online - and remember we're one election away from total policy shift(just like with latest US elections)?
Free market? The profitable solution is, depending on environment - either ignore the problem(profit from ads served to children, no extra work necessary), or strip away all privacy (to filter out bots and get paid more per ad).
The sad reality is that "parent should take responsibility" is least bad option available, and takes into the account individual development of a child.
Even creation of a highly regulated child only internet creates more problems - as now that becomes a highly profitable target for bad actors(both individual abusers, and companies trying to serve ads)
The EU actually has a very good, privacy protecting way of doing this based on zero knowledge proofs.
Unfortunately they completely botched it by having the proof-of-concept app rely on Apple & Googles integrity APIs - which a bunch of countries copied.
ZKPs may as well just be unencrypted HTTP headers which would be way simpler and easier to implement. All a ZKP proves is that at least one person in the world is over 18.
With ZKP, if you make a business out of reselling tokens you get with your own identity, eventually they will see that you use orders of magnitude more tokens than normal people.
So with ZKP it's more difficult to cheat. Not impossible, just less accessible.
Each individual proof is zero knowledge, but downloading a _bunch_ of them is an indicator, yes. There's no real way to work around this with the current ZKP scheme. I'd argue ZKP is, in theory, the least worse option of all current age verification scheme.
My personal opinion is that age verification itself is a bad idea, but if we're going to go ahead with it, I'd much rather we use ZKP for it than the current mess of "upload your passport and picture of yourself to dodgy 3rd parties that likely now have your browsing traffic associated with your real name"...
I have a feeling that, in order to protect privacy, those regulations must fall on the parents too. It is their primary responsibility to take care of their children. Maintaining your kids digital hygiene should be important to the lawmakers and the child protections services.
Who? The lawmakers? I believe banning children up to a certain age from having Internet-enabled mobile devices is a good starting point, and both child protection services and law enforcement services should fully cooperate with parents in enforcing that ban. If you see a kid smoking a cigarette or taking drugs, you know parents have failed somewhere along the road and it would be preferable if the government could step in to help.
This is a reasonable perspective, but don't you think the internet has the potential to do good as well as evil? I remember seeing some interactive lever applet as a kid where you could move the fulcrum. (Slightly) educational stuff. Shouldn't that be allowed?
This is reasonable up to the point of lawmakers suddenly deeming rainbow flags just as bad as drugs (Russia as an example).
Your example may work in well intended countries but completely ignores that a country can VERY easily shift into a regime that does not have good ethics abusing these kinda laws.
There should be a law that forces social media companies to use a different algorithm for anyone under a certain age and be required to disclose it to the public. Possibly different algorithm depending on age group.
There should however be no force age verification. Social media companies already know how old you are or very close to it using the data they collect everyday. Using this data they should be required to use "best effort" to determine which algorithm you fall in. Nothing is 100% and we should stop pretending it is, sure some kids will find a way around but they would also if there is a age verification system.
> There should be a law that forces social media companies to use a different algorithm for anyone under a certain age and be required to disclose it to the public. Possibly different algorithm depending on age group.
Frankly, in that case I want the kids algorithm. It is preferable for me as an adult, I do not want the intentionally harmful one either.
This. Just give me the option to have pagination. Sweet, old, pagination. Like here on Hacker News. I can then review one or maybe 2 pages, and that is all. Like a physical magazine where there's a clear end.
I have the firm belief that infinite scrolling is one of the darkest pattern that was ever invented.
Hang on... Hacker News very clearly has a complex, opaque [1] algorithm that orders stuff. Maybe it's not user-specific, and maybe that's a good dividing line, but these are the kinds of factors we're going to have to think about if we want to introduce regulation around 'algorithms'.
Infinite scrolling is a very different issue (although it's definitely a contributor to the harm, I agree).
([1] Unless I'm being unfair here; maybe the algorithm is available somewhere, I just don't see it obviously linked anywhere)
You can often do that via settings. But we could do with a law that makes it a crime to override a user setting that has been explicitly set, without notifying the user.
I think you've done a great job identifying the three main options and why two of them (parents, censorship-by-default) just will not work. That leaves regulation; the only way we will prevent children—or anyone—from coming to harm is to stop companies from producing this harmful content in the first place.
> This is where regulation is supposed to come in.
Yes, agreed. However regulation does not necessarily have to mean age checks.
The most obvious low hanging fruit to start off with is open and interoperable content filtering infrastructure (ie parental controls) so that there's some common standard that literally everything supports out of the box. It needs to all work together - the current situation tends to be spotty and unreliable thus parents tend not to bother trying to use it.
Start with an extensible metadata format that enables websites to self-classify pages. Account for things like loading alternative resources on the same page. Mandate that all websites and app stores include such metadata and that all browsers and operating systems have some baseline functionality for making use of such data in a sensible manner.
Only after that has completely and utterly failed should we even begin to consider highly invasive measures such as mandating government ID checks.
The parenting argument is a complete cop-out. There's no universe where you can be shoulder hovering 24/7. This could've been solved years ago with robust parental controls. But companies like Google just didn't want to because they wanted to shove ads in kids' faces.
I think we can approach this from more than one angle. Yes, it cannot be entirely on parents, but parents should bear some responsibility to not just hand a device over to their children with unrestricted access to the entire internet.
Up until relatively recently you would have to install custom VPNs and maybe add Pihole into the mix to achieve anything close to that. Easy for us here, but we're in a small minority.
Parental controls have been part of mobile devices for years, but so have bypasses. For instance, you can bypass Google's parental control settings by opening the help page in the Google settings and clicking links until you get to the Google homepage.
I doubt it matters because nobody seems to configure the parental controls that are there, anyway. Only schools seem to try, and only because they're legally held responsible for what kids do on their computers.
Parental controls are complicated and obscure, IME. Setting up a child to play Minecraft through Microsoft was like setting up a web server with firewalls and reverse proxy... only less sensible. I'd appreciate that is so they can get parents to set accounts as 'adult' so Microsoft can exploit them.
You can set up, for example a child friendly DNS (Family version of OpenDNS) then Firefox come along and bypass it (DoH).
Probably, we need an OS level setting, per account, browsers would need to expose it to websites, apps installed would have to check and provide content according to local legislation/rules. Bypasses would have to be performed by an "adult" account.
The main issue is that adults would be able to set themselves as children and avoid negative commercial activity. That's a problem because it means FANG, etc, will lobby against it and then ensure their implementations are convoluted and broken.
Parents should take responsibility and not let their children smoke, and we still banned selling cigarets to children. Just because something should be some way, doesn't mean as a society we shouldn't do anything about it.
In any case, the story with parents and addictive devices is even harder for parents than e.g. cigarets. For example, a LOT of schools in the UK think that it's good to give childrens ipads to study, and there's nothing that parents can do to prevent this. In this specific situation saying that "parents should take responsibility" is unfair to parents, because their only option to avoid this is home schooling.
I was just saying yesterday that we (Finland) could take the bullet and create a luxury resort for all the zillionaires in the world.
Connect them with each other and populate their air-gapped "Internet" with like-minded authoritarian AI-bots and create special news like Don and Vladimir are being fed to keep them from tantrums. A win win for everyone!
Ooh, and mental health services. Plenty of mental health services as we're so poor of a race that even our richest can't afford enough therapy to feel alright!
I think it's the old that need to be protected more on the Internet since they disproportionately fall prey to online scams. So let's age-gate their access to online services too. If you are old and want to send money to someone, you get age-gating and second-factor authorization from a competent young person. If you want to watch porn online, believe it or not, age-gating and second-factor authorization.
Honestly, I wouldn't be opposed to that either. If we're protecting kids, we should also protect the old and feeble. Old people, people with developmental handicaps, you name it: they're being exposed to a world that can and will abuse you if you have any faith in humanity left and don't have the technical skills to identify things like fake domains and scam sites.
For some reason we're making sure no 12 year old can drive or run for any government positions, but a 90 year old can keep the driver's license that they've had since before the start of colour television, or make critical decisions affecting millions. We can't have it both ways.
I think this is actually a reaction to the over-reaching laws various governments are enacting. This is the way it should work - parents check a box that says "the user is 13 years old", and then apps and websites can see what the parent set.
This is much much better than having to do face scans and credit checks etc. to prove to some sketchy third party that you are over 18.
I think if Google had bothered to do this 5 years ago we might not be in the shitty situation we are now, but it's probably too late now.
I don't understand why apps need to know anything about a specific age. If we have to go down this road, which I really don't, why can't we just simply have verification whether or not an age fits within a range better yet a category. Yes, age can still be inferred, for example, under 21 or over 21.
> To request a user's age range and sharing status, you call the Play Age Signals API (beta) from your app at runtime. The default age ranges the API returns are 0-12, 13-15, 16-17, and 18+, but you can receive custom age ranges.
But I don't find it any better. I don't see any viable reason to provide identification to my phone's OS. If a parent buys a phone for their child, they can already set up parental controls before handing it over.
I wish Motorola all the best with their GrapheneOS partnership.
The rumored Motorola devices are even more expensive. It's the signature and some foldables, all in the 1000+ MSRP range. At least with pixels you can get the a series for as little as 400 on sale.
If you buy one of the Motorola Grapheneos phones, you're gonna be marked. You will stand out in the crowd. It has happened before and will happen more frequently as the world becomes more authoritarian.
On the other hand, privacy becomes a luxury. People love signaling their status and standing out from the crowd. Entire car and clothing brands exist solely because of that.
And if enough people stand out, it doesn't matter anymore.
If anything, I would imagine that Google's changes are motivated by driving traffic to their Google Play Store, where they make billions in commissions.
Once this framework is in place for the Google Play Store, perhaps they can lobby for strict age verification laws, and then tell developers who publish outside of Google Play that they are responsible for compliance themselves.
It's amazing how naive and gullible people are even after all the many thousands of examples of lies and gaslighting over many generations now. It seems to be a permanent characteristic of a certain subset of people, and seemingly a majority of people, at least in the west and at least in this era.
It always gives me the "he only beats me because he loves me" or "he wouldn't beat me if I knew how to behave better" vibes. It's not healthy, not sane, not rational.
One disagreement though; I don't even think they will lock people out of their devices outside of very narrow and specific instances or examples to "cut the grass" as the Israelis call it, to scare and remind people they are the slaves and the long arm of the tyranny can reach out and crush them if they don't self-censor and self-subjugate. Psychological and ideological control has very much proved itself far more effective than physical control in all circumstances. They want to be able to monitor and then use methods and technologies to control that have not really come to light in society even thought they were systematized through the Iraq war. You are now the "insurgents", are you old enough to remember those, those insurgents in their own country?
Laws have been written that mandate that applications and services treat various age ranges differently. You can't serve porn to kids, kids under 15/16 have very strict privacy regulations in some areas, and certain content age ratings are an industry standard only because that was the industry way of getting out of being regulated.
For kids this is a privacy risk because there are so many thresholds. Once you're above 18, all you need to care about is "are you a pensioner".
Kids have been lying about their age since the dawn of the internet and people have started catching on, so now we're getting actual restrictions rather than the assertion that nobody in their right mind would click "I am 18 or older" to access a website.
Californian law mandates that operating systems keep track of their users' age, so of course Android must follow. In all of the cases listed on Google's blog, though, the option to not share information and download an app that doesn't ask for your age range is still an option.
This isn't aimed at you specifically, but I think many technologists seem to innately misunderstand the slippery slope hypothesis which helps form the bedrock of American politics.
Too many seem to fall into the familiar problem-solving mode, ready to provide compromises or solutions while forgetting that once the infrastructure is in place, it can easily be modified later to undo the compromises which facilitated its acceptance in the first place. There is an inherent power asymmetry and it's not generally in favor of those building and using the infrastructure.
They also actively undermine the US constitution. Will be interesting to see whether the remaining judges have any power to change this or whether they were also integrated into the new dictatorship model.
They want to track everyone now. Age sniffing is just one additional step for forcing verification. This will continue - see how suspiciously many countries adopt new legislation. It is quite fascinating to me to see how easy it is to kill off democracies.
This is actually a step in the right direction. I don't want to share my id and selfie with every stupid social media app/site. I would much rather allow parents to configure their children's devices to share their age.
I'd be totally fine to solve this problem by banning children from the internet altogether. Not that I'd enforce this or anything. Just so no one other than the parents can be liable when things go wrong.
There's more and more evidence that internet access isn't healthy to have for children anyway.
But we don't put barbed wire on random sidewalks and then blame parents if a kid walks over it and gets hurt. There is the attractive nuisance doctrine, among other things.
You have a kid, you have responsibility for that kid. In Germany we have a term "Aufsichtspflicht" for this, which roughly translates to duty of supervision. Up to a certain age of the kid parents will be made responsible for damages your kid caused.
One pretty funny example of that was a kid spending 1000s of Euros on a MMORPG because the MMO offered a payment option that allowed people to pay through their phone bill. Parents could've easily prevented any of that happening, but in that generation it was pretty common that kids were tech savvy while parents couldn't be bothered to learn about computers, which imo already is problematic.
Nowadays there are many many ways to supervise your children's online access. And yes, there are also many many ways for kids to work around that too, but ultimately if you buy your kid a device with internet access, you should try to supervise that. Parents need to care more about what their children are up to, instead of silencing them with a tablet for a moment of personal silence.
A small example would be to set the device into "kiosk mode" which many companies use for their employee devices too. Prevent app installs, check what pages ur kids visit with their browsers and whatnot. Just make sure to be open about it so you don't hurt your kids by violating their privacy and trust towards you. Hell we even got parents having their kids take air tags with them so the parents know where they are.
What a pain reading this blog post. It's about them complying with recent regulations, but they never mention it once: they word it so it sounds like they are doing this out of the good of their hearts.
The words "law," "regulation," or "compliance" do not appear once, despite being the entire reason the post exists.
Also on the "privacy-preserving tool", technically apps get a bracket ("16–17") instead of a birthdate. But who holds the actual data? Google. The privacy improvement is against the developer only.
I couldn’t care less about children or about what is ultimately a parenting issue (keep your fucking kids off the internet). A problem that affects a subset of the population is not something that should be solved by subjecting the entire population to inconvenience. Just make it illegal to use the internet for under 18s or under 16s or whatever and let it be assumed that all users are of the appropriate age.
If I a child is on the internet without adult supervision, that’s a parenting problem, not an issue for the state or other people to solve.
By the way, this also explains one reason why Google shut down third
party access/applications recently on Android. Android (if one uses
the Google software) becomes the ultimate spy tool on people. At the
same time you see several countries force age sniffing on people -
this is the beginning of the end of the free web. It will happen in
various steps; the next one is Microsoft adding this to their software.
Linux is also ready to support age verification through systemd. Luckily, there are still distros without it, like Void Linux. I switched to it recently and now my media PC boots faster than my TV takes to turn on.
Age checks are inevitable sadly. No one would tolerate “adult” services and goods rendered directly to children without age check.
The main argument is that there is an assumption this data is not stored in the real world, which is only sometimes true. Some places like airports and some concerts, shows, bars, etc. scan identification with digital readers whose data is presumably retained. One reason for this is because fake identification is a thing so defense against this converges to the same solution as digital verification.
Imo best to spend energy thinking of the appropriate solution that minimizes privacy violation than conceptual fighting against the idea.
If you don't even try to use simple available measures to prevent your own child from vaping then it's unfair to say you have zero tolerance for children vaping.
This smells like Soviet Union. The next step will be a requirement to confirm your identity - trying to justify it with a wicked manipulation tactic "we need to know your are not lying when selecting your age". No one asked for it to begin with. Android is normalising totalitarianism and mass spying on citizens, one step at a time. This is a very bad feature and a very bad development.
Its the same thing with Europe allowing scans of private chats now. Nobody would tolerate a person opening the letters from ur physical mail box and reading through each of them just to see if you do [insert illegal activity]. But once this stuff happens digitally, people seem to simply tolerate it.
If I remember correctly, in 2019 there were huge protests against upload filters were people actually protested on the streets in Europe. Now there is almost NOTHING for chat scans, NOTHING for age verifications, NOTHING for making Android less open. Its really frightening what the general public tolerates nowadays.
The authorities open letters all the time. Try sending a letter to prison without it getting scanned.
The problem with this comparison is that the authorities can open a letter if they need to for various well-intended reasons, but they cannot open an encrypted message. Either the authorities can scan all messages, or they can scan no messages, there's no inbetween.
The mandate to verify age before selling alcohol has been around forever. This is not a new idea. The biggest restriction until now has been that there was no good way to do these kinds of age verification, but that problem has been solved. You can still debate whether or not age verification is a good idea for specific subjects, but selling 10 year olds alcohol or porn has been illegal for much longer than the internet has existed.
Last time I checked an Android phone was not selling me alcohol or porn. It requires specific deliberate actions to get access to anything like this with a phone. Any checks could be justified on the store or web-site level, not on the phone level. Treating every citizen as a child or even worse a potential criminal who needs to be constantly checked at numerous checkpoints the state so kindly put everywhere is exactly the stinking smells of the Soviet Union I'm talking about.
It would make for a good alternative, but so would any app that doesn't implement scanning. If they can force Signal to implement client-side scanning or ban it entirely, they can do the same to PGP software. In theory you could do RSA by hand, but it would require a lot of hard work.
I think you're misinformed, they didn't have age checks on smartphones in Soviet Union.
But there're countries where that already exists. They usually get labelled as a threat to democracy. Isn't it ironic? It's as if our own governments are the greatest threat to our way of life.
Seriously ready to fully drop google emails and services, i'm using vivaldi + personal email for a while now, the migration was slow a bit painful but complete. Only the phone is still attached to play store and google, but i'm 100% ready to switch to the fully supported Chinese variant of ColorOS and flush Google into the toilet once and for all. But my next phone will 100% be a Sailfish again.
I find myself stuck on the fence with age checks.
Companies have show that they are incapable or unwilling to address the problems they cause. And market forces are not working to correct things. It’s also pretty obvious that saying “parent should take responsibility” is also not working. Just observe the world around you to know it’s a non starter.
This is where regulation is supposed to come in.
At the same time, companies have shown that they will abuse any personal information that is shared with them and we are now giving them more details about ourselves…
I don't want the market solving this. If we are going to do age checks it should be based on public key cryptography, be open source, and handled by the government. You verify with the government (or don't since they already know your age), you get some form of cryptographic attestation, present said attestation to websites/apps.
I'm not a fan of age verification in the first place, but I am extremely not a fan of random third parties doing the verifying.
Why do we need to verify age?
You can't tell me that these social media companies don't already know exactly how old someone is just based on the enormous data that is collected.
A big concern around age verification is that some people will be locked out because they can't prove their age.
Your solution here has the same flaw, I think. If the algorithm thinks I'm underage, I'm locked out.
being locked out = less profit = firing management by shareholders
it will solve by consumers, don't worry
Because it's all about bringing in digital ID and gated internet. Not age.
They do already like YouTube and ChatGPT, so they'll ask for your age only when they're unsure.
chatgpt began to spam me pretty hard for last a few months.
chatgpt basically never sent email and it's regular now - like 2 4 emails per month
so, it doesn't look great for chatgpt
This is scary though too. If the gov managed a key server like this, almost all companies would start requiring it. But this effectively gives the gov a very easy way to lock you out of everything.
This is really nothing new and has always be the case It's not possible to tech yourself out of a political problem.
So if there is something being done we should choose a solution that has at least some accountability to the general public (through elected representatives).
The alternative is Google, Apple etc where almost anyone has exactly zero influence and the government can still block as they like.
This will be possible if done by third parties anyway, it will just be apple, google and maybe meta, a single phone call is enough to cut you off. At least if the government is doing it, the app doesn't get your id.
If it has to happen, this is exactly how it should. Please feel for those of us in the UK who are currently denied access to some pretty significant services unless we send our passport to a random third party.
This is how it's planned in the EU is it not?
Maybe? I'm not sure since the UK is no longer part of the EU; we're running quite a bit behind on this kind of thing now.
That makes the most sense.
And, that public key of yours must be used only on given platforms. You want to participate on Facebook or Reddit, then you use that public key to prove who you are. Which platforms require verification is another issue.
But it should still be legal and allowed to access conventional forums, Usenet , tor accessible discord servers without having to prove who you are.
Otherwise , the right to organize is over and we effectively live in an authoritarian regime .
I’m from The Government, and I’m here to help.
One not entirely inaccurate definition of government is a loose agglomeration of third parties.
Or, less flatteringly, a stupendously large way too loose agglomeration of way too many third parties welding way too much power way too arbitrarily.
The difference here is that in a functioning democracy people have some control over their government. All the institutions are specifically built to be transparent and work for the public good, at least, in some sense of the word. A corporation, especially a monopoly doesn't care what you think, you have no control over it and the only thing that really matters to them is their bottom line. Are governments perfect? Of course not. Are random corpos better? Again, of course not.
No. It should be none of that. It should be a checkbox either set by the phone store when you buy the phone or set during the first boot process.
In this case will it be a transparent traceability and the mapping to user real identity close to 100%?
>It’s also pretty obvious that saying “parent should take responsibility” is also not working. Just observe the world around you to know it’s a non starter.
Then who should? Government, where each implementation strips away rights to privacy - which in some countries, including mine, are a constitutional right? Where it expands powers of government to track everyone's activity online - and remember we're one election away from total policy shift(just like with latest US elections)?
Free market? The profitable solution is, depending on environment - either ignore the problem(profit from ads served to children, no extra work necessary), or strip away all privacy (to filter out bots and get paid more per ad).
The sad reality is that "parent should take responsibility" is least bad option available, and takes into the account individual development of a child.
Even creation of a highly regulated child only internet creates more problems - as now that becomes a highly profitable target for bad actors(both individual abusers, and companies trying to serve ads)
The EU actually has a very good, privacy protecting way of doing this based on zero knowledge proofs.
Unfortunately they completely botched it by having the proof-of-concept app rely on Apple & Googles integrity APIs - which a bunch of countries copied.
ZKPs may as well just be unencrypted HTTP headers which would be way simpler and easier to implement. All a ZKP proves is that at least one person in the world is over 18.
This is not completely true.
With ZKP, if you make a business out of reselling tokens you get with your own identity, eventually they will see that you use orders of magnitude more tokens than normal people.
So with ZKP it's more difficult to cheat. Not impossible, just less accessible.
They're not ZK if they can do that
Each individual proof is zero knowledge, but downloading a _bunch_ of them is an indicator, yes. There's no real way to work around this with the current ZKP scheme. I'd argue ZKP is, in theory, the least worse option of all current age verification scheme.
My personal opinion is that age verification itself is a bad idea, but if we're going to go ahead with it, I'd much rather we use ZKP for it than the current mess of "upload your passport and picture of yourself to dodgy 3rd parties that likely now have your browsing traffic associated with your real name"...
So the government would impose a maximum limit on the number of porn sites you can open each day?
I have a feeling that, in order to protect privacy, those regulations must fall on the parents too. It is their primary responsibility to take care of their children. Maintaining your kids digital hygiene should be important to the lawmakers and the child protections services.
What should they do about it?
Who? The lawmakers? I believe banning children up to a certain age from having Internet-enabled mobile devices is a good starting point, and both child protection services and law enforcement services should fully cooperate with parents in enforcing that ban. If you see a kid smoking a cigarette or taking drugs, you know parents have failed somewhere along the road and it would be preferable if the government could step in to help.
This is a reasonable perspective, but don't you think the internet has the potential to do good as well as evil? I remember seeing some interactive lever applet as a kid where you could move the fulcrum. (Slightly) educational stuff. Shouldn't that be allowed?
This is reasonable up to the point of lawmakers suddenly deeming rainbow flags just as bad as drugs (Russia as an example). Your example may work in well intended countries but completely ignores that a country can VERY easily shift into a regime that does not have good ethics abusing these kinda laws.
Not having an internet censorship law never stopped a country from making rainbow flags illegal.
There should be a law that forces social media companies to use a different algorithm for anyone under a certain age and be required to disclose it to the public. Possibly different algorithm depending on age group.
There should however be no force age verification. Social media companies already know how old you are or very close to it using the data they collect everyday. Using this data they should be required to use "best effort" to determine which algorithm you fall in. Nothing is 100% and we should stop pretending it is, sure some kids will find a way around but they would also if there is a age verification system.
> There should be a law that forces social media companies to use a different algorithm for anyone under a certain age and be required to disclose it to the public. Possibly different algorithm depending on age group.
Frankly, in that case I want the kids algorithm. It is preferable for me as an adult, I do not want the intentionally harmful one either.
This. Just give me the option to have pagination. Sweet, old, pagination. Like here on Hacker News. I can then review one or maybe 2 pages, and that is all. Like a physical magazine where there's a clear end.
I have the firm belief that infinite scrolling is one of the darkest pattern that was ever invented.
Hang on... Hacker News very clearly has a complex, opaque [1] algorithm that orders stuff. Maybe it's not user-specific, and maybe that's a good dividing line, but these are the kinds of factors we're going to have to think about if we want to introduce regulation around 'algorithms'.
Infinite scrolling is a very different issue (although it's definitely a contributor to the harm, I agree).
([1] Unless I'm being unfair here; maybe the algorithm is available somewhere, I just don't see it obviously linked anywhere)
Yeah, seriously, New York just passed law that makes it illegal to show engagement-driven feeds to kids.
I can’t wait to not age verify on instagram and permanently get back a feed that’s only people I follow.
You can often do that via settings. But we could do with a law that makes it a crime to override a user setting that has been explicitly set, without notifying the user.
I think you've done a great job identifying the three main options and why two of them (parents, censorship-by-default) just will not work. That leaves regulation; the only way we will prevent children—or anyone—from coming to harm is to stop companies from producing this harmful content in the first place.
Either that, or just accept the harm.
Who decides what is harm? An unelected bureaucrat? Now you’re going into censorship area
No, I'd prefer elected representatives to do that, in the same way they've decided on all the other existing harms we legislate for.
Related recent discussion: https://news.ycombinator.com/item?id=49084938
> This is where regulation is supposed to come in.
Yes, agreed. However regulation does not necessarily have to mean age checks.
The most obvious low hanging fruit to start off with is open and interoperable content filtering infrastructure (ie parental controls) so that there's some common standard that literally everything supports out of the box. It needs to all work together - the current situation tends to be spotty and unreliable thus parents tend not to bother trying to use it.
Start with an extensible metadata format that enables websites to self-classify pages. Account for things like loading alternative resources on the same page. Mandate that all websites and app stores include such metadata and that all browsers and operating systems have some baseline functionality for making use of such data in a sensible manner.
Only after that has completely and utterly failed should we even begin to consider highly invasive measures such as mandating government ID checks.
The parenting argument is a complete cop-out. There's no universe where you can be shoulder hovering 24/7. This could've been solved years ago with robust parental controls. But companies like Google just didn't want to because they wanted to shove ads in kids' faces.
I think we can approach this from more than one angle. Yes, it cannot be entirely on parents, but parents should bear some responsibility to not just hand a device over to their children with unrestricted access to the entire internet.
Up until relatively recently you would have to install custom VPNs and maybe add Pihole into the mix to achieve anything close to that. Easy for us here, but we're in a small minority.
Parental controls have been part of mobile devices for years, but so have bypasses. For instance, you can bypass Google's parental control settings by opening the help page in the Google settings and clicking links until you get to the Google homepage.
I doubt it matters because nobody seems to configure the parental controls that are there, anyway. Only schools seem to try, and only because they're legally held responsible for what kids do on their computers.
Parental controls are complicated and obscure, IME. Setting up a child to play Minecraft through Microsoft was like setting up a web server with firewalls and reverse proxy... only less sensible. I'd appreciate that is so they can get parents to set accounts as 'adult' so Microsoft can exploit them.
You can set up, for example a child friendly DNS (Family version of OpenDNS) then Firefox come along and bypass it (DoH).
Probably, we need an OS level setting, per account, browsers would need to expose it to websites, apps installed would have to check and provide content according to local legislation/rules. Bypasses would have to be performed by an "adult" account.
The main issue is that adults would be able to set themselves as children and avoid negative commercial activity. That's a problem because it means FANG, etc, will lobby against it and then ensure their implementations are convoluted and broken.
Parents should take responsibility and not let their children smoke, and we still banned selling cigarets to children. Just because something should be some way, doesn't mean as a society we shouldn't do anything about it.
In any case, the story with parents and addictive devices is even harder for parents than e.g. cigarets. For example, a LOT of schools in the UK think that it's good to give childrens ipads to study, and there's nothing that parents can do to prevent this. In this specific situation saying that "parents should take responsibility" is unfair to parents, because their only option to avoid this is home schooling.
Can't we build a gateway in the internet that detects if someone is a influential CEO or something and just bar access to the internet?
If you have more than 100 million in the bank you should be barred from using the internet...
Good idea, you got my vote!
... unfortunately I don't have a vote according to Tobi
https://fortune.com/2026/07/27/shopify-ceo-voting-rights-str...
I was just saying yesterday that we (Finland) could take the bullet and create a luxury resort for all the zillionaires in the world.
Connect them with each other and populate their air-gapped "Internet" with like-minded authoritarian AI-bots and create special news like Don and Vladimir are being fed to keep them from tantrums. A win win for everyone!
Ooh, and mental health services. Plenty of mental health services as we're so poor of a race that even our richest can't afford enough therapy to feel alright!
What does this have to do with age verification?
We've already decided to do verification of users, now we can look into which groups of users should be limited or barred entirely.
I think it's the old that need to be protected more on the Internet since they disproportionately fall prey to online scams. So let's age-gate their access to online services too. If you are old and want to send money to someone, you get age-gating and second-factor authorization from a competent young person. If you want to watch porn online, believe it or not, age-gating and second-factor authorization.
Honestly, I wouldn't be opposed to that either. If we're protecting kids, we should also protect the old and feeble. Old people, people with developmental handicaps, you name it: they're being exposed to a world that can and will abuse you if you have any faith in humanity left and don't have the technical skills to identify things like fake domains and scam sites.
For some reason we're making sure no 12 year old can drive or run for any government positions, but a 90 year old can keep the driver's license that they've had since before the start of colour television, or make critical decisions affecting millions. We can't have it both ways.
This coordinated worldwide effort at the same time is very creepy.
I think this is actually a reaction to the over-reaching laws various governments are enacting. This is the way it should work - parents check a box that says "the user is 13 years old", and then apps and websites can see what the parent set.
This is much much better than having to do face scans and credit checks etc. to prove to some sketchy third party that you are over 18.
I think if Google had bothered to do this 5 years ago we might not be in the shitty situation we are now, but it's probably too late now.
It just means politicians read the news.
And aren't very imaginative.
> in our ongoing partnership with parents and developers by announcing the expansion of the Google Play Age Signals API
Which parents and which developers? How many of them? From where?
> expand... worldwide till the end of the year
So at the end of the year they contract again?
Or should the headline read _by_ the end of the year?
I don't understand why apps need to know anything about a specific age. If we have to go down this road, which I really don't, why can't we just simply have verification whether or not an age fits within a range better yet a category. Yes, age can still be inferred, for example, under 21 or over 21.
The API behaves this way:
> To request a user's age range and sharing status, you call the Play Age Signals API (beta) from your app at runtime. The default age ranges the API returns are 0-12, 13-15, 16-17, and 18+, but you can receive custom age ranges.
https://developer.android.com/google/play/age-signals/use-ag...
But I don't find it any better. I don't see any viable reason to provide identification to my phone's OS. If a parent buys a phone for their child, they can already set up parental controls before handing it over.
I wish Motorola all the best with their GrapheneOS partnership.
You can also get GrapheneOS right now on Google-branded hardware, which is expensive but not enshittified.
>which is expensive
The rumored Motorola devices are even more expensive. It's the signature and some foldables, all in the 1000+ MSRP range. At least with pixels you can get the a series for as little as 400 on sale.
If you buy one of the Motorola Grapheneos phones, you're gonna be marked. You will stand out in the crowd. It has happened before and will happen more frequently as the world becomes more authoritarian.
On the other hand, privacy becomes a luxury. People love signaling their status and standing out from the crowd. Entire car and clothing brands exist solely because of that.
And if enough people stand out, it doesn't matter anymore.
Yes, people can tell a phone is running Graphene. They just can't get in.
True. Though I have mixed feelings buying new pixel from Google after all these actions.
Then buy a used or open box one. There's plenty of people who try switching to Android and buy Pixels, but go back to their iPhones in a week.
I don't. When they start making shit hardware, stop buying their hardware. As long as it's good, buy it. That's a free market price signal.
LineageOS is still a thing too.
Because it's not about age at all. That's just ruse to get a lever to lock people out of their devices if they don't behave.
How would that make sense?
If anything, I would imagine that Google's changes are motivated by driving traffic to their Google Play Store, where they make billions in commissions.
Once this framework is in place for the Google Play Store, perhaps they can lobby for strict age verification laws, and then tell developers who publish outside of Google Play that they are responsible for compliance themselves.
It makes total sense. You here assume that this is only driven by Google. Once you include state actors, suddenly it makes sense.
They gather more data now. Only verified users will be able to use the internet in unrestricted ways - that is what is new.
When there is a clear motivation to protect a $50B/year revenue stream, that seems to be the more likely explanation.
If it appeals to politicians who view "protect the children" and surveillance positively, that is a bonus.
It's amazing how naive and gullible people are even after all the many thousands of examples of lies and gaslighting over many generations now. It seems to be a permanent characteristic of a certain subset of people, and seemingly a majority of people, at least in the west and at least in this era.
It always gives me the "he only beats me because he loves me" or "he wouldn't beat me if I knew how to behave better" vibes. It's not healthy, not sane, not rational.
One disagreement though; I don't even think they will lock people out of their devices outside of very narrow and specific instances or examples to "cut the grass" as the Israelis call it, to scare and remind people they are the slaves and the long arm of the tyranny can reach out and crush them if they don't self-censor and self-subjugate. Psychological and ideological control has very much proved itself far more effective than physical control in all circumstances. They want to be able to monitor and then use methods and technologies to control that have not really come to light in society even thought they were systematized through the Iraq war. You are now the "insurgents", are you old enough to remember those, those insurgents in their own country?
Laws have been written that mandate that applications and services treat various age ranges differently. You can't serve porn to kids, kids under 15/16 have very strict privacy regulations in some areas, and certain content age ratings are an industry standard only because that was the industry way of getting out of being regulated.
For kids this is a privacy risk because there are so many thresholds. Once you're above 18, all you need to care about is "are you a pensioner".
Kids have been lying about their age since the dawn of the internet and people have started catching on, so now we're getting actual restrictions rather than the assertion that nobody in their right mind would click "I am 18 or older" to access a website.
Californian law mandates that operating systems keep track of their users' age, so of course Android must follow. In all of the cases listed on Google's blog, though, the option to not share information and download an app that doesn't ask for your age range is still an option.
This isn't aimed at you specifically, but I think many technologists seem to innately misunderstand the slippery slope hypothesis which helps form the bedrock of American politics.
Too many seem to fall into the familiar problem-solving mode, ready to provide compromises or solutions while forgetting that once the infrastructure is in place, it can easily be modified later to undo the compromises which facilitated its acceptance in the first place. There is an inherent power asymmetry and it's not generally in favor of those building and using the infrastructure.
Indeed - Flock cameras showed this.
They also actively undermine the US constitution. Will be interesting to see whether the remaining judges have any power to change this or whether they were also integrated into the new dictatorship model.
Because it has never been merely about age only.
They want to track everyone now. Age sniffing is just one additional step for forcing verification. This will continue - see how suspiciously many countries adopt new legislation. It is quite fascinating to me to see how easy it is to kill off democracies.
This is actually a step in the right direction. I don't want to share my id and selfie with every stupid social media app/site. I would much rather allow parents to configure their children's devices to share their age.
Why is this part of Play Services? It should be something on-device as part of AOSP, not something that further entrenches Google.
(In case it's not obvious: rethorical question, Google just wants to do platform lock-in with Android and sees this as a useful means to bludgeon it.)
I'd be totally fine to solve this problem by banning children from the internet altogether. Not that I'd enforce this or anything. Just so no one other than the parents can be liable when things go wrong.
There's more and more evidence that internet access isn't healthy to have for children anyway.
Yeah. And if a kid drinks beer only the parents should be liable.
Why are we all so horny to transfer unlimited liability to parents?
Because raising children is unequivocally the parents' responsibility. It's, like, their main job.
But we don't put barbed wire on random sidewalks and then blame parents if a kid walks over it and gets hurt. There is the attractive nuisance doctrine, among other things.
You have a kid, you have responsibility for that kid. In Germany we have a term "Aufsichtspflicht" for this, which roughly translates to duty of supervision. Up to a certain age of the kid parents will be made responsible for damages your kid caused. One pretty funny example of that was a kid spending 1000s of Euros on a MMORPG because the MMO offered a payment option that allowed people to pay through their phone bill. Parents could've easily prevented any of that happening, but in that generation it was pretty common that kids were tech savvy while parents couldn't be bothered to learn about computers, which imo already is problematic.
Nowadays there are many many ways to supervise your children's online access. And yes, there are also many many ways for kids to work around that too, but ultimately if you buy your kid a device with internet access, you should try to supervise that. Parents need to care more about what their children are up to, instead of silencing them with a tablet for a moment of personal silence.
¿What are those ways?
A small example would be to set the device into "kiosk mode" which many companies use for their employee devices too. Prevent app installs, check what pages ur kids visit with their browsers and whatnot. Just make sure to be open about it so you don't hurt your kids by violating their privacy and trust towards you. Hell we even got parents having their kids take air tags with them so the parents know where they are.
What a pain reading this blog post. It's about them complying with recent regulations, but they never mention it once: they word it so it sounds like they are doing this out of the good of their hearts. The words "law," "regulation," or "compliance" do not appear once, despite being the entire reason the post exists.
Also on the "privacy-preserving tool", technically apps get a bracket ("16–17") instead of a birthdate. But who holds the actual data? Google. The privacy improvement is against the developer only.
Will these be compatible with the Digital Credentials API in Chrome (https://developer.chrome.com/blog/digital-credentials-api-or...) or will websites be essentially be locked out of friction-less age verification?
What's the difference between an age check and a total identification check?
If you can only check that the person is above age without checking who they are, then it's not the same, is it?
Surveillance comes for us all.
What's hilarious is how Westerners still think they're much different from China or the former Soviet Union anymore.
The usual "but think of the children" tactic.
I don’t understand how are they even checking the age ??
They aren't. The device administrators (ie. the parents) set an age range in the OS' config and then the OS tells applications the value. That's it.
In some jurisdictions/countries they have to call some government service which then tells them whether a person is above or below a certain age.
Theoretically you could make this double blind and that's the story they are telling.
We have no way to (dis)prove it though.
Alas, here goes the freedom, with thunderous applause.
This is what I keep telling people
Safety!
Global surveillance incoming.
Heard Google is also rolling out QR codes to get past captchas? Ie linked to a device that would now be identity linked too.
All seems pretty dystopian or to quote googles slogan - being evil
I already saw it on youtube. However, ctrl + f5 fixed it.
On the other hand, youtube became so unusable that I have spotify premium now.
So, give it a few years and corpos will take it down because of missing profits.
Incoming? Have you been asleep for 30 years?
"Providing a safe online experience and protecting users from harm is a top priority at Google Play." LOL NO. amount of malware says otherwise.
I couldn’t care less about children or about what is ultimately a parenting issue (keep your fucking kids off the internet). A problem that affects a subset of the population is not something that should be solved by subjecting the entire population to inconvenience. Just make it illegal to use the internet for under 18s or under 16s or whatever and let it be assumed that all users are of the appropriate age.
If I a child is on the internet without adult supervision, that’s a parenting problem, not an issue for the state or other people to solve.
They want your data.
YOU have become their product.
By the way, this also explains one reason why Google shut down third party access/applications recently on Android. Android (if one uses the Google software) becomes the ultimate spy tool on people. At the same time you see several countries force age sniffing on people - this is the beginning of the end of the free web. It will happen in various steps; the next one is Microsoft adding this to their software.
Linux is also ready to support age verification through systemd. Luckily, there are still distros without it, like Void Linux. I switched to it recently and now my media PC boots faster than my TV takes to turn on.
Age checks are inevitable sadly. No one would tolerate “adult” services and goods rendered directly to children without age check.
The main argument is that there is an assumption this data is not stored in the real world, which is only sometimes true. Some places like airports and some concerts, shows, bars, etc. scan identification with digital readers whose data is presumably retained. One reason for this is because fake identification is a thing so defense against this converges to the same solution as digital verification.
Imo best to spend energy thinking of the appropriate solution that minimizes privacy violation than conceptual fighting against the idea.
> No one would tolerate “adult” services and goods rendered directly to children without age check
I don't think it's fair to say that parents who don't care to use parental control measures already available to them have no tolerance for that.
Parental controls don’t solve all of the issues. The same way telling your kids not to do drugs is not a solution to vaping use.
If you don't even try to use simple available measures to prevent your own child from vaping then it's unfair to say you have zero tolerance for children vaping.
Strange comment, plenty of parents try and fail to stop their kids to do certain things.
This smells like Soviet Union. The next step will be a requirement to confirm your identity - trying to justify it with a wicked manipulation tactic "we need to know your are not lying when selecting your age". No one asked for it to begin with. Android is normalising totalitarianism and mass spying on citizens, one step at a time. This is a very bad feature and a very bad development.
Its the same thing with Europe allowing scans of private chats now. Nobody would tolerate a person opening the letters from ur physical mail box and reading through each of them just to see if you do [insert illegal activity]. But once this stuff happens digitally, people seem to simply tolerate it. If I remember correctly, in 2019 there were huge protests against upload filters were people actually protested on the streets in Europe. Now there is almost NOTHING for chat scans, NOTHING for age verifications, NOTHING for making Android less open. Its really frightening what the general public tolerates nowadays.
The authorities open letters all the time. Try sending a letter to prison without it getting scanned.
The problem with this comparison is that the authorities can open a letter if they need to for various well-intended reasons, but they cannot open an encrypted message. Either the authorities can scan all messages, or they can scan no messages, there's no inbetween.
The mandate to verify age before selling alcohol has been around forever. This is not a new idea. The biggest restriction until now has been that there was no good way to do these kinds of age verification, but that problem has been solved. You can still debate whether or not age verification is a good idea for specific subjects, but selling 10 year olds alcohol or porn has been illegal for much longer than the internet has existed.
Last time I checked an Android phone was not selling me alcohol or porn. It requires specific deliberate actions to get access to anything like this with a phone. Any checks could be justified on the store or web-site level, not on the phone level. Treating every citizen as a child or even worse a potential criminal who needs to be constantly checked at numerous checkpoints the state so kindly put everywhere is exactly the stinking smells of the Soviet Union I'm talking about.
Communicating via PGP encrypted snail mail seems an attractive option.
It would make for a good alternative, but so would any app that doesn't implement scanning. If they can force Signal to implement client-side scanning or ban it entirely, they can do the same to PGP software. In theory you could do RSA by hand, but it would require a lot of hard work.
Not just android
I think you're misinformed, they didn't have age checks on smartphones in Soviet Union.
But there're countries where that already exists. They usually get labelled as a threat to democracy. Isn't it ironic? It's as if our own governments are the greatest threat to our way of life.