← Back to context

Comment by Grombobulous

4 hours ago

The age verification API in operating systems is a really good idea for privacy and parental control, so long as it doesn’t require literally collecting your ID (it doesn’t).

Look at it from the perspective of a parent giving a device to a kid. Before, you’d have to deal with a maze of blocking content. You’d have to allow/blocklist a huge number of apps and services manually. If your kid discovers some new one you or your blocking service has never heard of, they’ve gotten around your parental control wishes.

With the age verification API, you just set the age in the OS (and lock it down with MDM or whatever) and now all the apps and websites have to respect it and act accordingly.

Your kid can’t just make a new account or download another browser or do some other crazy workaround to get around your restrictions. That setting is there at the OS level.

7 comments

Grombobulous

Reply
Scaled  3 hours ago

A child mode flag is fine. But a birthdate is a recipe for data collection and fingerprinting. And with Google, we're seeing a full verification requirement flag that means people have to scan identity documents or face pictures. It's a slippery slope.

  • Grombobulous  2 hours ago

    The OS (I'll use systemd as an example) knows the birth date to determine whether or not you fall within an age range, but the applications are not offered the exact birth date by the API.

    Fingerprinting, perhaps it is a higher risk, the age range is being more directly provided. However, once a user is under 18 they're already triggering more stringent privacy laws and rules, an inability to enter into contracts, etc, and then when you get to the "over 18" age range it all becomes rather vague.

    Also, I highly doubt existing social media and Internet applications haven't already figured out most of their users' ages rather trivially using other means. Discord implicitly admits to this by saying that 90% of their users will not even be asked to verify their age. Discord already knows how old 90% of their users are with high confidence.

    Of course when we talk about someone like Google or Discord we are talking about a privately operated service provider and business, which is a separate issue than the OS-level privacy flag and is worth separating as a distinctly different concept. Private businesses were always able to scan your identity documents or face pictures if they wanted to do that as a prerequisite to using their products or services regardless of the law. In almost all states, this practice was never banned, and even in states with more stringent biometrics collection requirements like Illinois you can still do this as long as it's implemented in a legally compliant way.

noosphr  3 hours ago

That's great. Now that you have all the infrastructure in place the next request by the government will be a felon flag. You already have everything there, what's the big deal?

  • Grombobulous  2 hours ago

    Certainly we can take almost any topic through to the most extreme possible next steps and arrive at a draconian place, but I don't find that exercise realistic or productive.

    • noosphr  2 hours ago

      >but I don't find that realistic or productive.

      Go back to 1996 and tell someone that in 30 years the government will be legally able to look at everything they have written, taken pictures of, or recorded in the last 5 years in private and it use to retroactively punish them for any crime.

      This is the law for cellphones and computers for anyone who lives within 100 miles of an ocean, border or airport.

      The most draconian possible next steps we can imagine are far too Utopian for the world we live in.

      1 reply →