▲ 135 points
back
128 comments
Background: Meta/Facebook, Google and Apple all support age verification. It gives them legal cover and for their ad platforms gives better data.
But Meta/FB have been strongly lobbying to make it required at the OS level, so they aren't responsible for it, whereas Google and Apple both want it to be an application responsibility.
I think the CA version of this ended up with a carve-out for open source? I can't recall the details.
> all support age verification
No, they all support harvesting your data so they can continue doing what they do best: building shadow profiles and targeting ads.
Nothing a signal of an age group tells them more than "send me more ads for XX year-olds".
Why do you think it's always a question asked in online surveys?
The CA amending bill with a carve-out for open source is still active, is not yet law (see https://leginfo.legislature.ca.gov/faces/billCompareClient.x... for the changes to current law if the bill passes).
What's most shocking to me is the willingness to comply on display here and elsewhere.
If the state proposes you stick a corncob up your rear, your initial response shouldn't be to ask if they prefer you use a rubber or wooden mallet to achieve compliance.
> If the state proposes you stick a corncob up your rear, your initial response shouldn't be to ask if they prefer you use a rubber or wooden mallet to achieve compliance.
Judging by the willingness to bend over shown here and on posts like "Everything You Do Is Being Recorded " https://news.ycombinator.com/item?id=49230477
you'd think the average HNer prefers it done by hand, with a repeating wavelike motion.
If the state proposed every OS must have parental controls activated via a checkbox would you say the same? Because that's what they actually did except the checkbox is a numeric text field.
Rectum? Damn near killed 'em!
Wooden. Definitely wooden.
From reading the article, it sounds like an enforced standardisation? Like, asking for account age bracket and then having a standard API to ask for it would be easy, right? Just write it to a root owned `~/.age-bracket` for each user or something (obviously something better).
It's a feature many apps implement in all kinds of ways already, especially games and social media stuff, so this, in theory, just makes it easier and consistent?
I'm against leaking our kids ages, and all the privacy and other concerns as much as anyone, but are we just getting overly angry too quickly on this one?
I get that it's a slippery slope too.
It passes responsibility and accountability from the large platforms to the open-source communities and to parents who are most likely tech illiterate.
Facebook, etc. can wash their hands when they "accidentally" serve gambling ads (or whatever) to children and say "well it's not our fault the parent has the laptop misconfigured"
It's classic blaming the victim.
> The law also stipulates that all transmitted digital signals have to be encrypted.
I'm hoping there's nuance, but I'm surprised the article didn't go deeper on this too. ARP? ICMP? DHCP?
I can't actually load the bill to read it ATM.
try: https://ilga.gov/Legislation/BillStatus/FullText?GAID=18&Doc...
It only requires the encryption of the specific age-bracket signals mandated by Section 10 of the bill. What you're looking for is here:
Section 10. Age assurance requirements. ... (d) All digital signals transmitted in accordance with this Section shall be encrypted to ensure data integrity and security.
In practice, this means TLS, but there is no reason to write that into the law.
Curious how the various Linux distros and *BSD will handle this.
I expect the Corporate distros (RHEL, SUSE, Ubuntu) will be happy to get that personal info from its users. The other US based distros, maybe ban its use in Illinois ?
I expect one BSD OS will ignore it completely because they are outside of US jurisdiction. Not sure what the others can do. Of the others, one does have a decent amount of cash, the other ones are just squeaking by. So who knows what will happen with those.
That's the correct way to do it. Age should be something reported by browser/os/hardware. Something similar to User-Agent.
I really hope this will end the whole third party age verification farce.
it's not
age verification laws have little to do with protecting anyone, and social media companies are attempting to remove themselves from liability for their dangerous product by pushing for it
social media in its current unregulated state is harmful as has been demonstrated repeatedly with (suppressed) studies, and the push for age verification instead of regulation on the actual harmful content
age verification will always be a tool to censor whatever content certain interest groups want to censor and it is a wild violation of privacy as has been repeatedly demonstrated every time an identity verification firm gets hacked, they do not take this seriously at all, and all the while the actual harmful sites continue to do harm and have the ability to blame others for not 'protecting' people from the harm their product causes
it's a complete farce and has nothing to do with protecting anyone except tech companies peddling a harmful product
It could be part of the Accept header which already indicates language. It could serve as a signal that you only want to see content that is appropriate for that age bracket. Where appropriate means what the site wants to serve according to the laws of their jurisdiction.
But to require OS to implement all of this goes way to far and together with the proposed verification mechanisms is a privacy nightmare.
Might as well put your real name and DOB in there.
Remember. We should do absolutely everything in our power to not hold these companies responsible.
Maybe we could have privacy protections before assuming every adult in the US is a child until giving random companies our PII? That would be cool, but not holding my breath.
Edit: of course, downvote the comment pointing to Americans having more civil rights. Expect nothing less from the HN techbro cesspool. And yes, this meta commentary infringes the guidelines, and the trust contract is broken at this point. This site does not deserve my energy anymore.
Age verification is human verification at the time when the internet is getting very smart and dangerous bots. At least that's my optimistic view of this kind of paradigm shift!
Are they expecting parents to be held responsible when their kid gets given a laptop and doesn't put in the right age? Or is it just a best effort thing that "parents who want to" can opt in to and which mostly serves as a shield for online platforms who wave the "but age API said" flag whenever something sketch happens?
It's opt in. You can say your kid was born in 1900 if you want an unrestricted internet.
Wouldn't it have the opposite effect as intended? Making kids easier to target and undermine their safety?
I liked reading this:
It's time to create a library: `lib-deny-age-verifiers'. Start putting it into every open-source package. Modify the license to prohibit removing this library from the package.
Actually, yeah, advertisers might be about to hang themselves.
Okay, so the OS in my own computer is responsible for reporting my age. Okay, okay...
And some states are going to pass laws that advertisements can't be shown to minors. Seems good.
I think I'm about to become a bit of a minor myself, at least when I'm using certain sites...
> Start putting it into every open-source package. Modify the license to prohibit removing this library from the package.
I think you haven't understood what open source means.
exactly what is the definition of an "OS" and how many of them might there be, then.
or, does Illinois know what a fork is?
and can people just add "not legal for use in illinois" somewhere and go back to devoting 99.9999999999999 % of there attention to things other than Illinois?
illogical hubris - no state can regulate the internet; no state can compel developers to write code. the court cases on this will be interesting
I think you'll find they don't have to compel you to write code. They can simply prevent you from doing something else if you don't meet an obligation. Many many industries have compliance obligations that compel speech. Therapists have to report certain things if they hear them. Managers have a duty to report. My restaurant time I was required to write temperature logs.
The idea that code can't be compelled to fit a shape by the government is goofball nonsense.
It's like a product safety law. No state can compel you to put a pressure relief valve on your boilers. But they can stop you selling boilers without pressure relief valves. They can also prosecute you if your boiler explodes and kills people.
I assume you've heard of New Mexico's DoJ winning a not-quite-$1B court case against Meta.
Maybe Meta's lawyers will win on appeal, maybe they won't. "Think of the children!" pushes a lot of emotional buttons.
But Mr. Zuck most certainly can decide that he doesn't like the legal bills and uncertainty, and order his developers to write code.
What if you make your app refuse to load in Illinois just opens a banner saying why and who to lobby.
At the end of the day, it is my job as a parent to steer my kids out of harm’s way, be it the alley where they will find the local dealer, the park where people are injecting at night, or not stuffing their faces with sugar, or social media.
The “Bob and Alice are technically illiterate” defence doesn’t hold. I’m gun illiterate but I wouldn’t buy one for my kids.
Do I feel bad for the kid that killed himself doing something stupid he say at TikTok? Yes. Do I feel bad the for parents that gave a phone with TikTok to an unsupervised 11 year old? Not really.
Parents must take responsibility.
This is censorship; it is like saying you can't eat a steak because a baby can't chew it. They will try to ban Linux or fine Linux developers unless it reports the user's age.
Parents are responsible for their children's upbringing. Not the government.
Let's not ruin it for everybody else with this so-called "age verification" BS. This is all about adding more information to what Meta and Google and Bing already know about Internet users. Information they monetize by selling ads and sharing it with authoritarian governments.
Yeah and it's great. Because it wards off any verification that would actually be intrusive. You just need to add a birth date field to GECOS and you're done. It doesn't have to hold your actual birth date, as there's no penalties for lying. Viewing this as "age verification" is the wrong angle since nothing is verified - it's actually mandating that every OS must have parental controls. Don't think of it as "my birth date" - think of it as "apply parental controls that would be appropriate for someone born on this date".
Actually I'm tempted to think everyone who calls it "age verification" is being deliberately dishonest about what the law is.
Another state requires identity verification and monitoring in order to use a computer…
I wonder how vim will handle age brackets. Send all text to a LLM on the cloud in real time and refuse to show keystrokes with unsafe content? And censor unsafe text read from disk?
/s
The breathless fearmongering over an age field on account set up is just completely over-the-top. This is probably the least bad out of all possible ways to implement age checking. The benefit of this is that it can short-circuit support for more onerous age verification. The writing has been on the wall for some time now: the era of completely unrestricted internet is coming to an end. The question is how awful will the new normal be? Legislation like this is a win all around, a complete nothingburger. We should be celebrating it, not fighting it tooth and nail.
Seeing as this is Illinois we're talking about, it's probably less about protecting kids and more about extorting punitive fines from tech companies for non-compliance.
> violations can cost up to $50,000 each
I hear slot machine noises.