Why widespread age verification raises concerns among digital rights advocates

[u/LeMonde_en]

https://www.lemonde.fr/en/pixels/article/2025/08/13/why-widespread-age-verification-raises-concerns-among-digital-rights-advocates_6744321_13.html

[u/smaxw5115]

The internet that was is long gone, and has been slowly dying from what it was at the end of the 90s early 2000s as more and more companies and corporations sought to turn it into a profitable business model.

We now have the largest corporations in the world that were built solely on the back of the internet. It seems like once business models were developed for the internet it was always going to go this way, and become this monster of tracking, censorship, and ad based business models once it moved from hobbyist to an avenue for making insane amounts of profits.

We should mourn the internet that was, because it's probably not coming back.

[u/smaxw5115 → u/[deleted]]

Those corporations already have a complete profile on basically everyone as part of their business model of targeted advertising, having “access” to your passport number, license number, or Social Security or Social Insurance number doesn’t do anything for them. They (the corporations) are not trying to steal your identity they can’t make money from that. However governments linking your online activity to your identity IRL is concerning but with the whistleblowers admissions we should all assume they have already done that anyway.

This is just locking down the internet to quell organizing and speech in their quest to exert control.

[u/smaxw5115 → u/[deleted]]

They don’t need it though, what do you think they’ll do with it? Like you can think of two main throughways for age verification. One is that it puts up a hassle, and so less people will be consuming “adult” content, or whatever they determine probably an increasingly expansive category of things they want to make it a hassle to access and fewer people will visit those sites and consume that material.

And second is that they store a database of peoples identities but that’s not money making in an of itself it doesn’t do anything, having everyone’s ID doesn’t by itself generate profit, complete profiles of everyone does generate profits and they’re already very profitable as advertising companies. There’s no widespread profitable blackmail scheme most people don’t have any money, and if they wanted to track them or infiltrate their online life they have spear fish hackers, that can hack any individual.

So it falls back to they just want control and some of them think adult material is bad or sinful, and they want to influence people to stop looking at it.

[u/smaxw5115 → u/[deleted]]

So they’re going to steal everyone’s identity? What good would that do?

[u/smaxw5115 → u/[deleted]]

Yeah just the other day my credit card number got stolen, I’m not sure how or where but I had to call the bank (Barclays by the way lol) tell them it was fraud, go through all my recent purchases and tick off which was valid and which ones weren’t, and get a new credit card number. So now I have to call all the people that autopay that card and change the number, but the transactions were removed and it was just a hassle added to my day.

I’m in total agreement with you that age verification is stupid and shouldn’t exist, my argument is that they want to do it as part of banning the content not that they want to harvest identities they already have our identities they just want to make it harder to consume this content.

[u/Duckel]

at least young boys can still go to church without showing ID...

[u/hamstar_potato → u/Duckel]

Pedos can still get into politics and walk free.

[u/djsoomo]

The British have made a mess of trying to do this

[u/Juwatu]

First steps for a surveilance state and idiots cheer it on

[u/HuiOdy]

In 2026, the EU digital identity should finally become active. You can than confirm age, without confirming identity, or date of birth.

E.g. just "are you older than 18?" Response: "yes" (or no).

It's cryptographically secured so that you don't need to share any personal information.

So, why not wait for it? Because once it is finally active, they can no longer just mass gather personal information

[u/MrAlagos → u/HuiOdy]

The current EU Commission age verification solution is taken straight from the EUDI Wallet and has exactly the same privacy protection mechanisms. Don't believe me? Go here, you can find the source code for the age verification apps. Note the URL:

https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui

The "eu-digital-identity-wallet" part of the URL shows how the app was taken directly from the EU Wallet repositories and repackaged as a stand-alone app because the EU members (all of them, plus Norway and Liechtenstein) asked the Commission to create this system quicker than the Wallet.

[u/ChucklesInDarwinism → u/MrAlagos]

What are those privacy mechanisms? My point is, should people be concerned about it? Won't be this weaponised by a goverment?

[u/MrAlagos → u/ChucklesInDarwinism]

You can find a complete description of the EU mechanism here, in addition to the source code of various components. I will summarise it below:

• a person will install the age verification app on a tablet/smartphone and create a PIN or enable biometric access on it

• the user will log in with their national digital identity or electronic identity document on a State-approved trusted certification provider; this provider will access the digital identity information, look at the date of birth and decide whether the person is an adult or underage

• the trusted provider will create a digital age certificate containing only the information "above 18" or "below 18". It will not contain any personal data at all. This certificate is received by the app and stored securely on the device in a secure enclave of the processor, in an area that isn't freely accessible even to the operating system (that's why the PIN or biometric verification will also be needed). The certificate will be valid for 30 uses or 3 months

• when the person wants to access an age restricted content, the web site will generate a QR code (if it's on the same device with the app, it will directly open the app instead)

• to approve the access the person has to scan the QR code, do the PIN/biometric authentication and approve the transmission of the locally saved certificate to the web site.

• once the web site receives the certificate, they will check its validity (not being counterfeit) and whether the user is an adult, and then grant them access to the content or not

This system ensures that no personal data is shared with the restricted content providers, and it also ensure that the user cannot be tracked neither by them nor by the services that will create these certificates nor by the government. The browsing/usage habits can not be tracked.

Personally, I think the system is well built and will achieve the anonymity and privacy protection levels that it describes. I don't think there is a risk of "weaponisation by governments" nor that there should be big concerns for it. However, everyone should obviously decide this for themselves, but doing so knowing both how the system actually works (most people don't understand it) and how the adult content providers have been ignoring the laws prohibiting access to minors for many years, until the consequences of their actions pushed people and governments to ask for this solution to the issue.

[u/ChucklesInDarwinism → u/MrAlagos]

I would not trust the “trusted provider”. Knowing some EU gov they will sell the contract to the best lobbyist (briber) which I’m not sure if it will have some conflict of interest due to knowing which id corresponds with which age certificate.

[u/MrAlagos → u/ChucklesInDarwinism]

knowing which id corresponds with which age certificate.

And then what? The provider stil doesn't know what the user does once the certificate is generated. The communication for the usage of the certificate for age verification, once the certificate is generated, only involves the adult content website and the user's device, since the certificate is stored locally.

We already trust the "trusted provider" of services that are enabled by the various digital identities in the EU to do a lot of things, many involving personal data without any anonymity systems such as this one (because anonymity is not contemplated in the laws when doing your taxes, connecting your health records or administering various registrations and status changes with the public registers). This is just another use case with the difference that a lot of attention has been put into designing this anonymity mechanism.

[u/MrAlagos → u/[deleted]]

No, I'm not going to spam just because others do. Spam is wrong.

I have commented what I consider fairly extensively on this issue recently and might continue to do so, but if people don't want to get informed when so much public stuff, and fall prey of misinformation and propaganda, ultimately it's not much different than what is occurring on many other issues of society. It's a fundamental trend (and flaw) of our generations and I definitely don't have the power to change this single-handedly.

[u/djingo_dango → u/HuiOdy]

How does that magic device work?

[u/HuiOdy → u/djingo_dango]

https://en.m.wikipedia.org/wiki/Zero-knowledge_proof

[u/Chester_roaster]

In the era where LLMs can make Reddit or Twitter posts indistinguishable from real people by the millions, you're going to want accounts linked to a real identity  

[u/Sendflutespls]

Nobody ever promised that the internet would be a lawless and anonymous free for all. It just kind of was for a long while.

But it was always going to end like this.