With many jurisdictions introducing age verification laws for various things on the internet, a lot of questions have come up about implementation and privacy. I haven't seen anyone come up with a real working example of how to implement it technically/cryptographically that don't have any major flaws.
Setting aside the ethics of age verification and whether or not it's a good idea - is it technically possible to accurately verify someone's age while respecting their privacy and if so how?
For an implementation to work, it should:
- Let the service know that the user is an adult by providing a verifiable proof of adulthood (eg. A proof that's signed by a trusted authority/government)
- Not let the service know any other information about the user besides what they already learn through http or TCP/IP
- Not let a government or age verification authority know whenever a user is accessing 18+ content
- Make it difficult or impossible for a child to fake a proof of adulthood, eg. By downloading an already verified anonymous signing key shared by an adult, etc.
- Be simple enough to implement that non-technical people can do it without difficulty and without purchasing bespoke hardware
- Ideally not requiring any long term storage of personal information by a government or verification authority that could be compromised in a data breach
I think the first two points are fairly simple (lots of possible implementations with zero-knowledge proofs and anonymous signing keys, credentials with partial disclosure, authenticating with a trusted age verification system, etc. etc.)
The rest of the points are the difficult ones. Some children will circumvent any system (eg. By getting an adult to log in for them) but a working system should deter most children and require more than a quick download or a web search for instructions on how to circumvent.
The last point might already be a lost cause depending on your government, so unfortunately it's probably not as important.
Despite our current parliament sucking ass, I still have some general trust in my country's government (and culture). So with that in mind:
Our government bodies already have my basic data. Healthcare, census etc. and we use our online banking services to verify identity when accessing the data. It's simple, and extremely widely used. I really don't see why it would be so hard to make a relatively simple service that just gives sites that need to know a yes or no answer on if I'm over 18. They don't need to know my birth date or any other information.
This should be possible but of course the question is if one trusts the government to actually uphold this. Again, with my background, it's a bit easier for me to speak.
You'll never patch all the holes. In a perfect world, we wouldn't be having this conversation. In a perfect world, parents would actually parent their kids and monitor their internet use. Access to adult content doesn't even come close to being the biggest problem in many cases where some kids parents are fucking up their duties. Drugs, gangs, petty (and not so petty) crime comes to mind. Collective responsibility would be great but since we don't live in a perfect world where everyone can just agree to a good idea like "take responsibility of your kids", I'll settle for trusting a democratic government to have some capacity to pick up those that fall.
I happen to agree with age verification laws. This is a tangent but I would also go a step further in saying that MAINSTREAM internet should not be possible to use without verifying that the user is a real individual person. This would be another yes/no question via a service. Outwardly they don't have to reveal their identity but even JizzMcCumsocks needs to have a backend verification as a real person. Basically, if any government member uses some service with their own name and has a verification about that, that service must also have a way of verifying that any user is a real person. We have given Xitter way too much power and at the same time, allowed anonymity. Meta services too of course but I think Xitter is one of the worst due to easy and straight forward use. Humanity has shown, that we are not equipped to handle the kind of (mis)information flow there is in these spaces. Spaces such as Lemmy can and should operate in full anonymity, as there are natural barriers to entry here, plus it's less appealing when it's not even really intended for the kind of use mainstream social media sites are. Here we have a collective and individual responsibility to account for the anonymity and the challenges it brings.