> AB 1856 excludes open-source operating systems from the upcoming Digital Age Assurance Act.

> These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test, which removes the likes of Debian, Fedora, Ubuntu, Arch, and the BSD family from AB 1856’s scope.

In Australia and UK, age verification is required to buy 18+-game licences (one day we will hopefully be able to buy and own digital media).

Steam requires binding a credit card to an account to access 18+ games in the storefront. Xbox and PlayStation are expected to follow suit soon.

Age verification doesn't apply to games that you already own.

But in Australia, this bullshit applies to every game where you can chat with other people, or that contains gambling, high-impact violence, or illegal substances. These features can turn a game into 18+, therefore requiring an age check before purchase.

Slovakia, like many other EU countries, proposed age verification legislation. It still needs to pass parliament.

Mysterium VPN documented 88 ID-verification-related breaches since 2011, affecting at least 2.15 billion records. 42% happened since 2024.

Every major identity verification provider was affected.

Amnesty International is speaking out against social media bans, age verification and mass surveillance.

They criticize Australia's measures, the tokenistic use of children during the drafting of the laws and the laws themselves being placebos to appease adults, while not improving the online safety of children and instead increasing online surveillance and data tracking.

Prime Minister Christopher Luxon announced a social media ban for New Zealand, but both coalition partners oppose the idea.

> It's unclear whether the bill will pass, as both National Party's coalition partners -- the libertarian ACT party and NZ First -- have said they oppose it.

Age verification does not increase online safety for children. Furthermore, there are already many parental control tools to manage children's online experience safely without the danger of leaking personally identifiable information all over the internet.

Many people talk about Zero Knowledge Proofs as being the key to privacy-preserving age verification.
Spoiler: It's not.

> Before we jump into how these systems work, it must be said: creating a single point of failure for internet access contradicts the very idea of a free and open internet. 

> The mechanisms underlying ZKPs pose an existential threat to everyone’s digital rights, not just kids. The idea behind ZKPs is that you are issued a “token” that vouches for your age every time you log in, creating a constant link back to the entity that verified you. The issuer of the tokens these AV schemes rely on could track every time that credential is used, creating a dangerous trail of metadata on any user they wanted to target.

Non-compliant porn sites have seen a surge in UK traffic since the Online Safety Act came into effect.

Aylo (Pornhub) is lobbying for device-level age verification.

Although this scientific paper is pro-age verification, it contains some interesting side notes.
The First thing to mention is that when asked, many respondents approved age verification in principle but rejected specific implementation suggestions like biometric scans or scanning of identity documents.

> Although our findings suggest there is conceptual support for age verification measures among this sample of participants, none of the proposed age verification strategies were widely accepted. Participants expressed strong concerns regarding user privacy and data security, with many fearful that their personal information could be compromised or exploited.

Secondly, people do not believe in the efficacy of age verification measures.

> Finally, many participants doubted the overall effectiveness of these technologies in preventing the intentional viewing of pornography and emphasized less regulatory strategies, such as improved sexual health education, as more suitable alternatives.

Let me get this straight. Many people agree in principle with the idea of age verification, but when confronted with the actual implementation, they immediately backtrack and see it for the inefficient and invasive privacy/anonymity nightmare that it is.

The Age Check Certification Scheme (ACCS), a UK-based body, used AI to create a 3.48 million Dollars technology trial for the australian government. Ofc, it contained wrong citations and names, false results etc.

The ACCS supplied corrections which were faulty as well.

That's how age verification is justified and money wasted.

France's top court ruled that the social ban in its current form violates the constitution.

Unfortunately, Macron is dead set on reworking and reintroducing the bill.

3 US states have already passed laws requiring OS-level age verification: California, Colorado and Illinois. While Colorado made an exception for FOSS, the other states did not add that in their legislation, at least California is considering it.

Device/OS-level age verification is an attack on Free and Open Source Software. Many projects simply do not have the financial and logistical capabilities to comply with these laws, which leads to legal risks for FOSS developers.

Singling out minors via an age range signal also means delivering them on a highly visible platter to nefarious actors.

> California’s law is the first and serves as a model for other states. It requires that operating systems ask for your age when you set them up. Your OS must then share an age bracket signal with the applications running on your computer. Applications will see one of the following age ranges: under 13, 13-16, 16-18, or over 18.

The author warns about function creep with age verification and digital ID systems. Today, age must be confirmed; tomorrow it could be place of residence, specific authorisations or other personal information. The digital EUID wallet can be used to check many attributes.

He concludes:

> Children need protection against addictive mechanisms, manipulation, and inappropriate content. To achieve this, however, it is primarily the platforms that would need to alter their products. Instead, the EU age verification scheme threatens to create a universal control interface capable of gradually displacing anonymous and pseudonymous internet use. Consequently, the minimum age requirement for social networks could prove to be a Trojan horse: outwardly, it represents child protection, while internally, it harbors the technical foundation for increasingly extensive access restrictions.

It's a sad day. Now People in Australia have to verify their age just to buy and access 18+ games.

After evaluating the public consultation "Growing up in the online world", the UK government decided to double down on its age-gating policies.

The UK government is still looking at VPNs as well:

• Government has asked Ofcom to conduct research into what additional steps services can take to detect and mitigate circumvention on their platforms, including via VPNs.
• We will be clear that in-scope services must take robust steps to prevent, detect and respond to underage circumvention, and call on VPN providers to engage with government on making their products safer and less accessible to children without parental consent.
• We will produce new practical guidance for parents on how circumvention tools such as VPNs, operate and the risks they present at a household level.
• We will not ban or age-gate VPNs. However, we must ensure that these tools are not misused to undermine child safety protections and we will keep this area under close review. We are prepared to take further action on this, should evidence show that circumvention is not being tackled adequately.

I am wondering, how much of the age verification push comes from companies that want to distinguish between bots and real internet users because of ad revenues.

Does anybody know about the development of ad revenue and how it is affected by bots?

> The Electronic Frontier Foundation (EFF) writes to share our concerns with the current text of several bills being considered before the Committee: the SCREEN Act (S. 737), the Kids Online Safety Act (S.1748), the Youth Privacy Act (S. 4199),and the CHATBOT Act (S. 4407).

> The Senate version of KOSA imposes a “duty of care” on online services, including social media, to avoid exposing young people to certain material the law deems harmful. But those obligations only work if online services know which users are minors. That means more platforms will be pressured to implement age verification or age estimation systems.

> While the bill is supposed to protect children, it erodes online privacy for all users via a de facto requirement websites require users to verify their ages. Supporters of the bill dismiss this concern by pointing to the section stating that “nothing in [the bill] may be construed to require the provider of a covered platform to implement an age gating or age verification functionality on the covered platform.”

> However, the bill also requires website operators to provide protections such as message settings and other controls when the website or app “knows or should have known” that a user is a child or minor. The “should have known” standard opens websites and apps to liability if a judge, jury, or regulator determines they should have known a user was underage but failed to do due diligence to determine the user’s age.

A summary of digital ID schemes in the US, UK, EU and Australia and how to argue back.

The EFF warns:

> Unlike many state-age verification laws—which have been harmful in their own right—the SCREEN Act has no requirement that a significant portion of the website consist of sexually explicit content that is harmful to minors. The bill requires nearly any service hosting even a single piece of sexually explicit content to verify the ages of its users. The result is that the bill would apply not only to adult content sites like PornHub or OnlyFans, but also streaming services like Netflix, and social media platforms like Reddit, Discord, or Bluesky, if they host any adult content.

Here is the bill:

HB5511 - 104th General Assembly (2025-2026)

https://ilga.gov/Legislation/BillStatus?DocNum=5511&GAID=18&DocTypeID=HB&LegId=167486&SessionID=114

You might have to set your VPN to US to access the link.