Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

what if instead of this age gate or whatever government is doing, what if we simply said these big companies need to self police and if a child can reach their service they have to pay the child like lets say GBP 10k per instance?

remove all "reasonable step" shield to hide behind. for example, a shopkeeper can't say they took "reasonable steps" if they sell alcohol to a child so why should a website be any different? if we are going to the absurdity of age-gating VPNs, at least lets make it so that there is an incentive for children to self-report

 help



The end result will be the same. If you face a 10k liability for serving the wrong customer, you end up needing to ID your customers.

If the government isn't going to provide that service you end up with private companies verifying identity and the data security issues that entails.

If you want to shift the responsibility of protecting children away from parents, then you end up in a situation where third parties need to be able to differentiate between a child and an adult. I haven't yet seen a proposal that doesn't entail someone - government or private enterprise - getting access to identifiable information.

Of course, you could have something like a signed certificate, so the identity verifier doesn't see who you are patronizing, and the identity seeking business only gets to see your age, but it still has privacy issues.


> . I haven't yet seen a proposal that doesn't entail someone - government or private enterprise - getting access to identifiable information

California's Digital Age Assurance Act


That isn’t age verification. It’s an api for reporting unverified age data.

It’s basically parental controls standardized.


Yes. And that's the proposal that doesn't give anyone access to identifiable information. Well, in California it's not a proposal, it's the law.

It also doesn't give any actual age verification information. Verified age is not the same thing as self reported age.

If a kid can figure out how to click "yes, I am an adult" on a website, they can definitely figure out how to do the same thing when they turn on their phone the first time.


You can get alcohol with a fake ID, too

Yes. Which entails document fraud, expense and pretty significant risk of failure. No system is perfect, but a fake id is very different than the clerk just asking everyone how old they are and calling it good.

You really cant see the difference between checking an id and asking someone their age?

The point is that asking is completely pointless when lying is free and impossible to detect. You need some way to verify truth, and that necessarily entails exposing PII somewhere in the process.

All California accomplished was to add an api for exposing self reported age. That is very different than actually knowing a customer’s age. Any liquor store can tell you.


> you end up needing to ID your customers.

You've needed to do that for at least ten years. Mobile internet either requires a contract, or an ID check before you get a sim (pay and go)

Anyone providing internets is liable for what the users are doing. The way you got out of that is responding to legal requests. (originally mostly copyright)

This is the frustrating thing, we have effective and relatively uncontroversial age gated network (mobile data) already. and it worked.

but now they've done and fucked it up with OSA.


I don’t think that would have worked. Parents buy phones for their kids since the kids can’t buy them. What would the choices be? Give them a phone or not give them a phone. I don’t think society is ready for that kind of choice anymore.

Or give them an age-locked phone that tells the websites it belongs to a minor.

But its already the case now! As in if you buy an sim now, it comes with filtered internet by default. its been like that for years

You have to phone them up/log in and request the block to be removed.


I went to the uk with a foreign SIM. Didn’t have to show my id. I logged onto public WiFi networks without showing my id.

Plenty of ways to get it done.


sigh

Yes, there are indeed loopholes. My point is this, we have this already, it works already, and if the government had actually researched rather than read the telegraph, we would have had a system that would be much less shouting at the tides to stop them coming in.

of course your foreign sim didn't need ID, but given how easy it is to find out who you are from a sim, its not really needed.

Moreover, most deliberate public wifi asks you to accept the ToS, so that they can legally cover themselves from what ever you are doing. They are still liable if they dont take "reasonable steps" to stop illegal activity occurring on their service.


> what if we simply said these big companies need to self police and if a child can reach their service they have to pay the child like lets say GBP 10k per instance?

All of these proposals probably sound good to people who think the Venn diagram of sites they use and sites covered by these laws are two separate circles.

They probably sound a lot less good when you realize the law covers site like YouTube. The Australian law (which they said they’re modeling this after) also includes social news sites like Reddit.

If they passed a law like this extending to VPN services then you’d have to hand over your ID to use a VPN.

Usually people realize how bad these proposals are once they realize it might impact their internet use, too.


Or perhaps we should expect parents to take some responsibility for their kids' screen use?

Don't be daft. It's not the parent's responsibility to monitor and care for their kids.

How do you create new procurement pipeline and surveillance infrastructure from that?

Bingo

Ok, can you explain what that looks like in practice or is it just some abstract feel-good words?

Sure! With my kids it's meant not buying them internet-enabled devices (or disabling the internet access, eg smart TVs), only having 1 family computer in a shared space, and managing my own local network. There also aren't screens in the house through the week.

On the flip side, I let them read whatever they want, including things that are upsetting or that other parents would say aren't appropriate, and I talk to them about what they've read.

Overall, I think these policies have meant more thoughtful media consumption, and more time outside and with friends. I'm not enough of a fool to think our rules are enforced at friends' houses, but we've chosen to live in a community that's largely on the same page.

None of this stuff is easy, but as a parent, it's the job.


“But I don’t want to be a responsible parent, I want to destroy the unrestricted internet.”

Just like we destroyed unrestricted tobacco stores

Nobody has a right to unrestricted tobacco stores.

Everybody has a right to free speech, and free speech frequently requires anonymous speech. This is why the protection of journalists' sources is so important, and why principled journalists are willing to go to jail to protect them.

You yearn for the end and couldn't care less about the means. But there are also those who couldn't care less about the end, but yearn for the means.

How can you distinguish between the two? And which do you think best describes the parties behind this global push to de-anonymize the Internet?


Why don't I have a right to unrestricted tobacco stores and gambling?

Pornography is a form of speech btw.


> Why don't I have a right to unrestricted tobacco stores and gambling?

Because--unlike free speech--those are not essential to freedom and democracy.

Care to answer my questions?


I don't really see how being able to read Mein Kampf is essential to freedom and democracy.

Yes yes, the internet is tobacco, TV rots your brain, the radio pushes devil music, and the printing press gives the peasants too many dangerous ideas. Shut it all down.

You expect the average parent to outwit Meta and TikTok and their teams of psychologists scheming to get their kids attention?

The social media companies could have done the socially responsible thing a decade ago and avoided all this.


I expect them to give a shit, yeah. Just like they should care about what they read or watch, or who they hang out with.

Don't let your kids have an internet-connected phone, or keep it locked down so they don't have parasitic apps preying on their pre-frontal immaturity until they're old enough to handle it.

All of this needs to be done intentionally, of course, or it will feel like the kids are being punished. But I can't emphasize this enough... it's our job as parents to raise our kids.


They do give a shit, and that's why all these social media age laws are being passed. Representatives are actually listening to their constituents.

Again, Meta and TikTok and their ilk could have avoided all of this by just being socially responsible organizations, instead of sociopathic.


> these big companies need to self police

It's not possible to prevent a person (of any age) from reaching a specific website if they are determined enough. Full stop.


> It's not possible to prevent a person (of any age) from reaching a specific website if they are determined enough. Full stop.

right, and that reveals the absurdity of this "age gate", doesn't it? because I am sure giving every UK national their very own unicorn would also poll very well but that doesn't mean that's what a functional democracy should be prioritizing just because a majority of the public supports because doing so is not possible


It’s not possible to prevent these same children from getting alcohol or drugs either but we certainly don’t permit it.

yes and we do fine companies that sell alcohol and drugs to children.

lets give everyone an incentive to report companies that allow or encourage children to use these websites. the children, the parents, bystanders, the employees and contractors of these websites, everyone should get paid from the fines these social media companies would need to pay out for every infraction. I think GBP 10k per incidence is actually pretty cheap considering the alternative is life in prison for the CEO and the board starting with cash incentives all the way to prison terms for the CEO and the board


That's because it's not about age gating, it's about identifying the internet users.

Is there any evidence of this? I hear it time and again with very little justification.

So if anyone who is a part of the establishment that protects known abusers and openly tolerated companies known, by their own admission, for hurting children, start saying "think of the children!" and "we're protecting the children", look at their hands because they're trying to swindle you.

Start from these two:

- https://www.eff.org/deeplinks/2025/12/10-not-so-hidden-dange...

- https://mullvad.net/en/and-then/uk

And remember that once these systems are introduced it will be very hard to get rid of them, and very easy to get them expanded to gate (identify users of) the more "radical" content, like environmental protests, opposing the genocide, perhaps opposing the monarchy...

If the establishment allows the companies, unpunished, to knowingly push teens into ED or suicide and at the same time says they "do something", you really shouldn't take it at the face value.

If you still honestly believe the reason for this is "protecting the children" (remember the next steps, mandatory, uninstallable surveillance on phones and IDing of all VPN users are in motion already), you can't be saved :(


Fwiw they acknowledge this and claim the goal of this regulation is to drastically increase friction, not render it impossible

Because they will just withdraw from the jurisdiction rather than bother to implement that, most likely

> big companies need to self police and if a child can reach their service they have to pay the child like lets say GBP 10k per instance?

HIPAA has been super effective this way. As we all know, American companies don’t give two shits about user privacy or even security. But wave the HIPAA flag and everyone starts caring real hard and taking extremely cumbersome steps to comply with patient privacy.

Very simple: Each HIPAA violation comes with a financial penalty for the business and personal penalty for every person involved in the leak. Very effective.


I agree the threat is there but I've never seen anyone actually punished for HIPAA violations and my data have been involved in several hospital and insurance breaches.

There's not even a test for HIPAA compliance, so you can't legally prove you were ever compliant in the first place, other than you did what you thought was right. People love to use the term "HIPAA-compliant" but it's technically not a thing.

From my understanding, HIPAA mostly just says that you need to have policies in place for various things, such as rotating passwords or encrypting data, but it doesn't go into explicit detail about what all must be IN those policies, or how you enforce them.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: