11 ms·

Age verification is not (should not be) the same as ID verification / storage / etc; the US needs laws similar to EU ones where companies can only get the minim

Age verification is not (should not be) the same as ID verification / storage / etc; the US needs laws similar to EU ones where companies can only get the minimum required PII. In the case of age verification that's zero, or a boolean value "yes this person is over 18" that they get from a trusted party like a bank.

chrisjj 5d ago
> where companies can only get the minimum required PII. In the case of age verification that's zero, or a boolean value "yes this person is over 18" This person? There's your PII right there. The ad seller's dream.
- paintbox 5d ago
  I can't figure out if you're joking or not.
  - chrisjj 5d ago
    Yoti Remember Me ID. https://yoti.my.site.com/yotisupport/s/article/What-is-a-Remember-Me-ID https://yoti.my.site.com/yotisupport/s/article/What-is-a-Rem...
    - Dylan16807 5d ago
      That specific link is basically just "having an account" if anonymity is turned off. If you include the anonymous version are you calling a basic cookie an "advertiser's dream"? Then that's not something new they would get if the cookie tracked age verification. And you can reset cookies every visit (or more often). The "that person" of a site-specific session cookie is not a big deal for privacy.
      - chrisjj 5d ago
        "user identifiers".
        Dylan16807 5d ago
        I'll say it again but simpler: The "user identifiers" are just having an account. That's when it's not set to be anonymous in the first place. When it is set to be anonymous, it doesn't do this.
tsukikage 5d ago
It's just like cookie banners: they shouldn't exist, but people's bonuses rely on never admitting that, so here we all are.
- petcat 5d ago
  Well the EU's own government websites are all polluted with the cookie banners too so it's obvious that they can't even resist collecting visitor tracking data themselves. The whole thing is pointless.
  - nonethewiser 5d ago
    Pointless? If you dont microregulate technology how can you regulate the consequences of regulating technology? The regulators need this.
- adamsb6 5d ago
  EU parliament gets bonuses?
phyzix5761 5d ago
Bank? So now you know what bank they use?
- miki123211 5d ago
  This is why you have a relay in the middle. Then, Chase knows you've verified your ID somewhere, the relay knows that some Chase user verified themselves at Pornhub, and Pornhub knows that the user is over 18, without knowing their identity or what bank they're using. You could also do this with ZKPs and device integrity protection. The latter is more secure but more complex, the former is much simpler and openness friendly.
  - deaton 5d ago
    Or we could use multiple relays so nobody knows both the bank and the purpose, or even who would know the other piece of data... and now thats just Tor but for identity verification. Might be a good idea actually, except the whole point is Anthropic wants to know who you are.
  - AnthonyMouse 5d ago
    > You could also do this with ZKPs and device integrity protection. How has the anti-competitive lock-in scam of "device integrity protection" entered the discussion? Using ZK proofs without it has exactly the same effect. There are far too many attestation-passing insecure devices to expect attestation to have any security value against attackers who can choose any of those devices on purpose.
- bitmasher9 5d ago
  I think the key here is “a trusted third party” more than “bank”. Also, I’d rather a company know “he has an account at Bank of America” than “His full government name is Bit Masher and his driving license number is 9”
- brainwad 5d ago
  Well, they already know your credit card issuer, it's not that wild. Really Visa/MasterCard should offer age verification on their network... They have all the necessary components.
micromacrofoot 5d ago
The EU is also doing age verification by showing ID, only difference is that you have to trust that their zero proof concept works and they're doing what they say they do. In the US we just assume no one does what they say they do.
egorfine 5d ago
> or a boolean value "yes this person is over 18" It would be detrimental to the cause, which is to collect everyone's ID.
- estearum 5d ago
  QAnon for nerds
- itintheory 5d ago
  Whose cause? I think the government already has our IDs, given that they issued them.
  - sicktriple 5d ago
    The government isn't typically facilitating the check. In order to verify your age, you will be required to hand over your ID to a third party, who's privacy and security practices are likely: "Trust me bro." Seeing as how these companies get hacked all the time, (https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/ https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...) , I don't think it's unreasonable to resist this. Furthermore, I think many folks have reservations about requiring an ID checkpoint to utilize a computer. Obviously it's not that bad yet, but I don't think it's hyperbolic to state that the landscape is certainly trending in that direction, and it's absolutely not unreasonable to point out that governments and institutions to have a material interest in setting up access controls on who can and can't use the internet (read: participate in society).
    - itintheory 5d ago
      Right, I'm not a fan of the ID check or identity/age verification. I'm just trying to understand the conspiracy theory kind of idea that "they're trying to get all our IDs!!!1!!" sentiment.
      - AnthonyMouse 5d ago
        "The government already has our IDs" is missing the correlation between the ID and the service. They know your face and your name but not what you do on the internet. The website knows what you do on the internet but it isn't tied to your name. It's the tying them together which is the problem. Which is why the people trying to do it always pull out the misdirect about ZK proofs. Those don't fix anything because a system that actually preserved privacy wouldn't be able to prove that the user is over 18, only that someone is over 18, not necessarily them. And that in turn means you're setting up a rug pull. You roll out a system which is indistinguishable from the perspective of ordinary people from the one that screws them, and then that system can't actually exclude minors so what follows is calls to change it to stop protecting privacy, at which point the people trying to collect everyone's ID will be arguing that you already have to show ID. It also presumes you would even get a privacy-preserving implementation to begin with, which a pretty credulous assumption given how these things usually go.
win311fwg 5d ago
> from a trusted party like a bank. For what reason should I trust a bank?
- kees99 5d ago
  Not "a" bank. You (somewhat) trust your bank, I would imagine. Since you know, they have your money. GP's hypothetical here is that Anthropic or other service provider who wants to do "age verification" could partner with (among others) your bank [1], where bank can answer yes/no to "is this user >= 18?", without revealing any other personal info to the SP. Allegedly. [1] via an intermediary, no doubt. Trying to do a "full-mesh" of partnering of every SP with every bank directly would not scale.
  - win311fwg 5d ago
    > You (somewhat) trust your bank For what reason? > Since you know, they have your money. You may trust them with your money, but does not equate to trusting them with anything else. Principle of least privilege, if you will. Anthropic has your chat data, which in many ways is more valuable than money, so if the only bar for free lying giving out your personal details is trusting a business with something of yours then why bother with this complex scheme and give Anthropic all of your personal information directly?
    - petcat 5d ago
      > You may trust them with your money, but does not equate to trusting them with any other PII. This doesn't really make any sense and it feels like it's just an attempt to be contrarian. Banks by law require substantial PII in order to even do business with you.
      - AnthonyMouse 5d ago
        > Banks by law require substantial PII in order to even do business with you. And those laws are extremely invasive and should be repealed. It's offensive to have a law that de facto requires you to identify yourself in order to pay for a newspaper subscription or buy contraceptives over the internet. But that's not the issue in this case. It's that the bank knows your name and what you buy -- already very bad -- but now you want to create a path to tying that information to everything you do on the internet.
rivetfasten 5d ago
Colorado and a few other states have zero knowledge proof apps capable of this. This is fantastic, except that the idea of mandatory government software only available on chosen proprietary platforms feels way worse. If there were a way to crypto-notarize a third-party wallet token etc blah blah, then it would be interesting. At the end of the day though, this is about protecting the powerful, not the kids.
shevy-java 5d ago
I do not want my computer to yield information to evil outside actors in general. This is why systemd going that way is so outrageous: https://github.com/systemd/systemd/pull/40954 https://github.com/systemd/systemd/pull/40954
- trashface 5d ago
  I think many linux users will apparently have been born on Jan 1 1970
  - SoftTalker 5d ago
    Strange, when I buy beer at Kroger and the "ID verification" guy has to come over, he looks at me and just keys in 01/01/1970 as my birth date most of the time. Or just asks me what my birthday is and I give him a random date in the late 1960s.
dlopes7 5d ago
Isn’t the very first option on the article a service that estimates your age without ID? Are they lying?
odo1242 5d ago
Well, that’s basically just the California law everyone hated
pocksuppet 3d ago
They have that, it's in the Digital Age Assurance Act, which I've been unreliably informed is fascism.

chrisjj 5d ago

> where companies can only get the minimum required PII. In the case of age verification that's zero, or a boolean value "yes this person is over 18" This person? There's your PII right there. The ad seller's dream.

paintbox 5d ago
I can't figure out if you're joking or not.
- chrisjj 5d ago
  Yoti Remember Me ID. https://yoti.my.site.com/yotisupport/s/article/What-is-a-Remember-Me-ID https://yoti.my.site.com/yotisupport/s/article/What-is-a-Rem...
  - Dylan16807 5d ago
    That specific link is basically just "having an account" if anonymity is turned off. If you include the anonymous version are you calling a basic cookie an "advertiser's dream"? Then that's not something new they would get if the cookie tracked age verification. And you can reset cookies every visit (or more often). The "that person" of a site-specific session cookie is not a big deal for privacy.
    - chrisjj 5d ago
      "user identifiers".
      - Dylan16807 5d ago
        I'll say it again but simpler: The "user identifiers" are just having an account. That's when it's not set to be anonymous in the first place. When it is set to be anonymous, it doesn't do this.

tsukikage 5d ago

It's just like cookie banners: they shouldn't exist, but people's bonuses rely on never admitting that, so here we all are.

petcat 5d ago
Well the EU's own government websites are all polluted with the cookie banners too so it's obvious that they can't even resist collecting visitor tracking data themselves. The whole thing is pointless.
- nonethewiser 5d ago
  Pointless? If you dont microregulate technology how can you regulate the consequences of regulating technology? The regulators need this.
adamsb6 5d ago
EU parliament gets bonuses?

phyzix5761 5d ago

Bank? So now you know what bank they use?

miki123211 5d ago
This is why you have a relay in the middle. Then, Chase knows you've verified your ID somewhere, the relay knows that some Chase user verified themselves at Pornhub, and Pornhub knows that the user is over 18, without knowing their identity or what bank they're using. You could also do this with ZKPs and device integrity protection. The latter is more secure but more complex, the former is much simpler and openness friendly.
- deaton 5d ago
  Or we could use multiple relays so nobody knows both the bank and the purpose, or even who would know the other piece of data... and now thats just Tor but for identity verification. Might be a good idea actually, except the whole point is Anthropic wants to know who you are.
- AnthonyMouse 5d ago
  > You could also do this with ZKPs and device integrity protection. How has the anti-competitive lock-in scam of "device integrity protection" entered the discussion? Using ZK proofs without it has exactly the same effect. There are far too many attestation-passing insecure devices to expect attestation to have any security value against attackers who can choose any of those devices on purpose.
bitmasher9 5d ago
I think the key here is “a trusted third party” more than “bank”. Also, I’d rather a company know “he has an account at Bank of America” than “His full government name is Bit Masher and his driving license number is 9”
brainwad 5d ago
Well, they already know your credit card issuer, it's not that wild. Really Visa/MasterCard should offer age verification on their network... They have all the necessary components.

micromacrofoot 5d ago

The EU is also doing age verification by showing ID, only difference is that you have to trust that their zero proof concept works and they're doing what they say they do. In the US we just assume no one does what they say they do.

egorfine 5d ago

> or a boolean value "yes this person is over 18" It would be detrimental to the cause, which is to collect everyone's ID.

estearum 5d ago
QAnon for nerds
itintheory 5d ago
Whose cause? I think the government already has our IDs, given that they issued them.
- sicktriple 5d ago
  The government isn't typically facilitating the check. In order to verify your age, you will be required to hand over your ID to a third party, who's privacy and security practices are likely: "Trust me bro." Seeing as how these companies get hacked all the time, (https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/ https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...) , I don't think it's unreasonable to resist this. Furthermore, I think many folks have reservations about requiring an ID checkpoint to utilize a computer. Obviously it's not that bad yet, but I don't think it's hyperbolic to state that the landscape is certainly trending in that direction, and it's absolutely not unreasonable to point out that governments and institutions to have a material interest in setting up access controls on who can and can't use the internet (read: participate in society).
  - itintheory 5d ago
    Right, I'm not a fan of the ID check or identity/age verification. I'm just trying to understand the conspiracy theory kind of idea that "they're trying to get all our IDs!!!1!!" sentiment.
    - AnthonyMouse 5d ago
      "The government already has our IDs" is missing the correlation between the ID and the service. They know your face and your name but not what you do on the internet. The website knows what you do on the internet but it isn't tied to your name. It's the tying them together which is the problem. Which is why the people trying to do it always pull out the misdirect about ZK proofs. Those don't fix anything because a system that actually preserved privacy wouldn't be able to prove that the user is over 18, only that someone is over 18, not necessarily them. And that in turn means you're setting up a rug pull. You roll out a system which is indistinguishable from the perspective of ordinary people from the one that screws them, and then that system can't actually exclude minors so what follows is calls to change it to stop protecting privacy, at which point the people trying to collect everyone's ID will be arguing that you already have to show ID. It also presumes you would even get a privacy-preserving implementation to begin with, which a pretty credulous assumption given how these things usually go.

win311fwg 5d ago

> from a trusted party like a bank. For what reason should I trust a bank?

kees99 5d ago
Not "a" bank. You (somewhat) trust your bank, I would imagine. Since you know, they have your money. GP's hypothetical here is that Anthropic or other service provider who wants to do "age verification" could partner with (among others) your bank [1], where bank can answer yes/no to "is this user >= 18?", without revealing any other personal info to the SP. Allegedly. [1] via an intermediary, no doubt. Trying to do a "full-mesh" of partnering of every SP with every bank directly would not scale.
- win311fwg 5d ago
  > You (somewhat) trust your bank For what reason? > Since you know, they have your money. You may trust them with your money, but does not equate to trusting them with anything else. Principle of least privilege, if you will. Anthropic has your chat data, which in many ways is more valuable than money, so if the only bar for free lying giving out your personal details is trusting a business with something of yours then why bother with this complex scheme and give Anthropic all of your personal information directly?
  - petcat 5d ago
    > You may trust them with your money, but does not equate to trusting them with any other PII. This doesn't really make any sense and it feels like it's just an attempt to be contrarian. Banks by law require substantial PII in order to even do business with you.
    - AnthonyMouse 5d ago
      > Banks by law require substantial PII in order to even do business with you. And those laws are extremely invasive and should be repealed. It's offensive to have a law that de facto requires you to identify yourself in order to pay for a newspaper subscription or buy contraceptives over the internet. But that's not the issue in this case. It's that the bank knows your name and what you buy -- already very bad -- but now you want to create a path to tying that information to everything you do on the internet.

rivetfasten 5d ago

Colorado and a few other states have zero knowledge proof apps capable of this. This is fantastic, except that the idea of mandatory government software only available on chosen proprietary platforms feels way worse. If there were a way to crypto-notarize a third-party wallet token etc blah blah, then it would be interesting. At the end of the day though, this is about protecting the powerful, not the kids.

shevy-java 5d ago

I do not want my computer to yield information to evil outside actors in general. This is why systemd going that way is so outrageous: https://github.com/systemd/systemd/pull/40954 https://github.com/systemd/systemd/pull/40954

trashface 5d ago
I think many linux users will apparently have been born on Jan 1 1970
- SoftTalker 5d ago
  Strange, when I buy beer at Kroger and the "ID verification" guy has to come over, he looks at me and just keys in 01/01/1970 as my birth date most of the time. Or just asks me what my birthday is and I give him a random date in the late 1960s.

dlopes7 5d ago

Isn’t the very first option on the article a service that estimates your age without ID? Are they lying?

odo1242 5d ago

Well, that’s basically just the California law everyone hated

pocksuppet 3d ago

They have that, it's in the Digital Age Assurance Act, which I've been unreliably informed is fascism.