This is the first part of a three-part series about age verification in the European Union. In this blog post, we give an overview of the political debate around age verification and explore the age verification proposal introduced by the European Commission, based on digital identities. Part two...

The UN Convention on the Rights of the Child clearly expresses that minors have rights to freedom of expression and access to information online, as well as the right to privacy.

These rights would be steamrolled by age verification requirements.

  • kbal@fedia.io
    5·
    1 day ago

    Uh… if “it doesn’t have to be unique” then you may as well just have a password — everyone who knows that the password is “swordfish” is allowed into the adults-only club. There are things stopping people selling their actual paper-based passports en masse or just making photocopies. If you have an easily-replaceable digital token with no biometric info and it’s not tied to your identity in any way, there are no such constraints.

    • Ooops@feddit.orgEnglish
      3·
      1 day ago

      I was obviously not talking about random paper-based passports but the one ID that is already standard and required for every citizen. And that one -if you decide to give it away- is tied to you, has your identity and is not easily replaced. But requiring to submit all that information on a low level internet verification process is unneccessary, when just “yes, I have that card proving I have the proper age!” is perfectly functional for that purpose.

      There is no one-size-fits all solution for security. But for basic stuff like acccess to online stuff an anonymous solution based on your ID is perfectly workable. Nobody is preventing additional biometric checks for more important stuff, it’s the general things in day-to-day life we need to primarily protect from data kraken trying to profile us to make money.

      • kbal@fedia.io
        5·
        1 day ago

        I’m still curious as to what it is that you have in mind. “Yes I have that card” will be communicated to random web services by the user presenting to them some kind of signed digital token I imagine, as is usual, and that token itself, or the user-held secret used in generating it, is what can then be sold, transferred, or used to track the user unless you have some way to prevent that. If you’ve given any hint of how you think it can be done, I didn’t get it.

        One thing people sometimes think of is having the user be authenticated with a government (or other authority) server in real time whenever they want to prove their age to some stranger — but the system I saw which worked like that was obviously a pretty big violation of privacy so I assumed it wasn’t the sort of thing you meant. If that’s the idea, how would you prevent the central authority from keeping a record of when and where your “passport” was used?

        • Ooops@feddit.orgEnglish
          2·
          10 hours ago

          We seem to talk about vastly different things or from complete different technical perspectives here, so I will take a few steps back and simplify it:

          I, the government, issue your ID (with all the usual stuff making if forgery-proof). On the front is all your personal info, on the back a big marker that you are a legal adult.

          If you want to buy something age-limited you just show the backside of your ID. I as the government have all your data but don’t know where you use your ID, the guy checking your ID has no data because he can trust me that I checked your age and provided a forgery-proof ID personally for you.

          That’s it. That’s the whole (simplified) process. And you can reacreate exactly this concept digitally with basic cryptographic methods for online use.

          So were is the problem with such a model? (Yes, I know that this is NOT what they are planning. But that’s the whole point. It is possible, the governments are just not interested because they actually don’t want to protect oyur privacy and outsourcing other methods to private companies -that do it cheaply because they want your data- is more profitable.)

          • kbal@fedia.io
            1·
            9 hours ago

            The main reason we can show our physical government-issued ID card to someone in a shop in relative safety is that it’s a human looking at it with their eyes, which do not have the ability to record and permanently store in machine-readable form all the information on it (such as a photo) that would identify their customer. (Of course when they hook up face recognition systems to their surveillance cameras we have other privacy problems, but that’s another story.)

            The same thing cannot so easily be done across the Internet. Something like it may be possible in theory, with some caveats, although it’s hard to tell for sure until we see an actual design document for such a system that is complete to the point where we could examine the details and see if it might really work in practice. Nobody seems to have got that far as of yet. All the actual proposals that I’ve seen sacrifice privacy for convenience of implementation because doing otherwise would be very complicated and difficult.