EFF launches Age Verification Hub

I am someone who is very privacy focused. I've literally never had a social media account on any platform and I'm 42. From day one of facebook, I never wanted my information online. Like many here, I'm deeply concerned about privacy and surveillance.

In real life, we think age verification is a good thing. Kids shouldn't buy porn. Teenagers shouldn't get into bars. etc... There has to be room somewhere for reasonable discussion about making sure children do not have access to things they shouldn't. I think it's important to note, that complete dismissal of this idea only turns away your allies and hurts our cause in the long run.

I'm not dismissing that idea. It is a perfectly reasonable thing to think about, part of why we have age verification techniques that already work well in critical places like online vape shops.

I'm even willing to talk about the possibility that we could use more robust systems deployed more broadly. A lot of folks here are talking about ZKPs in this regard, and that's not a bad idea at all.

The issue I'm trying to sound the horn on is that the current push for AF in the US and EU has nothing to do with kids. I think you could put together a working group on ZKPs and Age Verification, write up a paper and run experiments, and when you bring it to the lawmakers they're gonna say something to the tune of:

"yeah but that's not trustworthy enough and too technical for people to understand so we're just going to serve legal notices to VPN providers instead to tell them that they can't anymore"

...or something to that tune. I'm not a mind reader, I've just read the reports (by lawmakers) mentioning VPNs as an "area of concern".

This is a political gambit and not a new one. The more we treat the current issue as having anything to do with protecting kids the more we legitimize what is an obvious grift.

How does age verification work for online vape shops?

I think the equivocation of online and real life is a massive mistake. When you go into a grocery store you are constantly on CCTV. Does that mean when you shop on Amazon them recording you via webcam should be considered? Obviously not. The restrictions in real life are temporary. If you try to buy port, go into a bar, etc you are asked for ID and they look at it and hand it back. They don't take your ID, your picture and store it forever and then sell information about you to other people.

The concern about children is aimed at the wrong target. Instead of targeting everyone it would make far more sense to target the platforms. With Roblox having a pedo problem the company should face punishment. That will actually get them to change their ways. However all these massive platforms are major donors to politicians so the chance of that happening is low to none.

> They don't take your ID, your picture and store it forever and then sell information about you to other people.

It would not surprise me in the least if there are brick-and-mortar businesses doing this, especially larger companies in jurisdictions (such as the majority of the United States) with weak/nonexistent privacy protections.

In real life the situation is different. When I buy alcohol, someone looks at my drivers licence, does not make a copy of it, forgets it quickly, and cannot tie it to other information about me. As soon as it's online and it's copies, I can't tell what happens on anyone else's servers. I don't want any company knowing my actual name and location, then that can be tied to more data, which is what Google etc have been trying to do for years but this would just completely fast track that. I would in theory be fine with something where it never leaves my computer, but that is obviously impossible.

> The issue I'm trying to sound the horn on is that the current push for AF in the US and EU has nothing to do with kids. I think you could put together a working group on ZKPs and Age Verification, write up a paper and run experiments, and when you bring it to the lawmakers they're gonna say something to the tune of:

The EU is currently doing large-scale field tries of the EU Digital Identity Wallet, which they have been working on for several years. It uses ZKPs for age verification. They expect to roll it out to the public near the end of 2026.

In the online world you can’t make sure of anything. Florida for instance requires age verification for porn sites. Guess how many mainstream sites not based in the US are completely ignoring the law and guess how many others are easily accessible via a VPN? If you guessed the sum total of both is less than 100%, you would be wrong - and even that is tilted toward sites that just ignored it.

The one thing you can control is your childs access through their device using parental controls.

I can absolutely guarantee you that any teenager can easily get access to weed, cigarettes and alcohol despite the laws and definitely can use a VPN. It only takes one smart kid to show them how.

> In real life, we think age verification is a good thing.

Ok. In real life, do we think having agents from the government and corporations following you everywhere, writing down your every move and word, is a good thing? Or rather, what kind of crime would one have to have committed, so that they would only be allowed out in public with surveillance agents trailing them everywhere?

I appreciate the mention - i had not yet heard of this EU DIW thing. That said, I can't find any resources on it that mention the use of ZKPs. Could you share a link?

They don't need to. If you bought something with a card they just store that - let the data brokerage handle connecting it with actual ID cards and other elements of your identity.

But yeah, walmart is for sure logging their transactions and selling the data. It's practically free money.

> I can absolutely guarantee you that any teenager can easily get access to weed, cigarettes and alcohol

Is you argument then that we shouldn't age gate those things in reality either? Would you suggest that teenagers smoke and drink just as much as they would have had it been legal to sell to minors?

Laws don't just exist to stop you, they also exist to shape society. They exist as signals for what we deem appropriate behavior.

A lot of the proposals don't involve you sending your drivers license or "other information" to anyone. The site in question asks you to verify with a trusted third party (usually a government entity), and that trusted third party only provides then with the end result of the validation.

> which is what Google etc have been trying to do for years but this would just completely fast track that.

Excuse me? They have done that for years. There's nothing to "fast track" here. Big Tech already implemented surveillance.

I don't, but society clearly does. We're already there.

How many of those proposals do not have a government-mandated app as a spider in the middle of the web, which is aware of all the apps and websites you try to visit which ask for validation?

So we make meaningless laws that inconsistently enforced? What do you think happens when little Johnny is caught with weed in his car in a 95% White high income school district vs little Jerome in a 95% Black school district?

Also how much “shaping of society” do you expect to happen when you pass a law that no one respects?

How many kids do you think a law is going to stop from going to the porn sites that completely ignored the law?

How many kids say “I really want to smoke weed but it’s illegally so I won’t do it”?

> How many kids say “I really want to smoke weed but it’s illegally so I won’t do it”?

I think it's generally accepted that marijuana use increases after legalization. So yes.

> In real life, we think age verification is a good thing. Kids shouldn't buy porn. Teenagers shouldn't get into bars. etc...

These are not equivalent, I don't have to scan my face, upload my ID and share my personal biometric data with various 3rd parties, who will sell and leak my data, every time I want to look at porn or sip a beer.

Also, there are countries where teenagers can drink and go to pubs, and society hasn't crumbled. We also have several generations of young adults with access to porn, and the sky didn't fall.

Maybe we shouldn't use the government to implement a "papers, please" process just to use and post on the internet, maybe we should instead legislate the root cause of the problem: algorithmic optimization and manipulation. That way everyone benefits, not just kids, and we won't have to scan our faces to look at memes on Reddit.

Laws that nobody respects lead to lack of respect for the law as a whole.

Hate to break it to you, you're on social media right now.

Not according to the CDC with kids

https://www.mpp.org/issues/legalization/adult-use-legalizati...

If HN is social media, then so are PHPBB, NNTP, BBS, etc. and the term loses its semantic relevance.

My heuristic is that social media focuses on particular people, regardless of what they're talking about. In contrast, forums (like HN) focus on a particular topic, regardless of who's talking about it.

You would think so, but DARE increased adolescent usage of some drugs while having little to no effect on others.

Turns out being illegal isn't as much of a disincentive as being uncool. If your parents are smoking it...

Doesn't matter what you want it to mean. What matters is what those in power want it to mean. It's very easy to stretch the definition to cover all sites where people can post content for strangers to see, or stretch it even wider to all digital media where people can interact with a social group.

> Doesn't matter what you want it to mean. What matters is what those in power want it to mean.

I was replying to a discussion between two HN users, who were using conflicting definitions of the term. AFAIK they are not "those in power".

> AFAIK they are not "those in power".

AFAIK nobody here is. The point is that with relevance to the current discussion on potential future age-verification laws, only the widest definition matters, because that's what's at risk.

Nancy Reagan: Don’t sniff glue to get high.

Kids: You can sniff glue and get high!!!

Ya got me. Nevermind that the DSA (which I have read, in part) and the DIW (new to me) are different things, and that one does not mention the other [0]. Also the DSA is happening now while the Wallet thing isn't rolled out.

There are actual discussions about VPN regulation in relation to AV in the US [1]. The UK's OSA [2] is blatant about the need to violate encryption. Australia's OSA [3] has also come under criticism for precisely the things I'm talking about. Is it a stretch to extend this reasoning to the EU's incredibly similar legislation? Honk my nose if you must but I don't think so.

Here's the thing - I don't want you to listen to me, or anyone else on the internet, as an 'expert'. Verify your information personally, even when you trust it.

0 - https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32...

1 -https://www.eff.org/deeplinks/2025/11/lawmakers-want-ban-vpn...

2 - https://www.legislation.gov.uk/ukpga/2023/50/contents

3 - https://en.wikipedia.org/wiki/Online_Safety_Amendment

FWIW, not that it matters, the proper acronyms are EUDI (EU Digital Itentity) and EUDIW (EUDI Wallet). DIW is not used.

Not sure if you've bought alcohol lately, but at most large grocers near me, they're scanning licenses now instead of just verifying the birth date - and I'm pretty confident those scans aren't just checking the birthdate and then deleting all record of the interaction..

So then this is an easy problem. Issue liquor stores a terminal. Liquor guy checks licenses. If you're an adult, the clerk presses a button. A public key is generated and uploaded to a public list. You get a private key that shows you're an adult and is not tied to you. Regular laws that apply to liquor also apply to this private key QR code... You cannot give it to a minor or sell it without a license.

To view adult content, use the code to sign a thing. Content company sees the signed code, verifies against the public list and sends the content.

Privacy preserved, no adult content to kids... Easy.

My guy, this is making the opposite argument from what you think:

"On the illegal market, no one is checking IDs before selling marijuana. When and where cannabis is illegal, high schoolers often sell cannabis to their peers. In contrast, licensed cannabis stores have overwhelming compliance with age-gating."

It has indeed not increased the cannabis use of kids, but that would also still be illegal. That study is an argument that age gating works.

We have newer and more relevant data than DARE.

Pro tip: those scanners probably don't work with passports, so a human must still eyeball your passport to verify that you're old enough.

All chutzpah is built upon brazen assertion of desired outcome as already achieved.

Not sure where you are but no one has ever done that to me. I usually would go through self checkouts so someone just comes over, takes a quick look at my drivers licence, and puts in their employee id into the machine to authorise it.