> I'm so tired of tech people saying "it has to suck because the law requires it", when they clearly haven't read it. [..] The AVMSD isn't new, it was codified in 2010. It has a website[1]

You know, if you were going to rant about people not reading things, you probably should have first validated your own assumptions. AVMSD was just updated ( https://digital-strategy.ec.europa.eu/en/policies/revision-a... ) which just recently went into effect. The updated law requires online video platforms to age gate content for children. How, exactly, do you propose they do that with an implementation that doesn't suck?

> if you were going to rant about people not reading things, you probably should have first validated your own assumptions

I did, but I didn't stumble on this revision. Now that you linked it, I see hints everywhere that I should have noticed the first time around. Thanks for bringing it up. Although, I'm rather unhappy if my rant was taken to be about reading comprehension though. It really wasn't. I'm annoyed at people blaming laws for poor implementation.

To tackle the revision though, lets looks at the revised text. It's kind of hard to get a hold of, since the EU document database is apparently down, but i managed to find a copy[1]. The relevant text seems to be:

    establishing and operating age verification systems for users of video-sharing platforms with respect to content which may impair the physical, mental or moral development of minors;

Even here, it only calls for age verification. Again, there's no requirement for checking credit cards or passports. If we look at one of the drafts of the now enacted law[2], we see that they seem way more concerned with the differentiated moderation between platforms than the adequacy of the age verification process. We have to keep in mind that watershed (only showing adult content after a certain time) is considered an appropriate way of deterring minors from watching. The EU commission clearly don't think we should disallow children at any cost.

I don't think it's on my to find a better implementation for YouTube, but with all the smart engineers they have access to, I would think they could come up with something less intrusive.

[1]: https://www.europarl.europa.eu/doceo/document/TC1-COD-2016-0...

[2]: https://www.eu.dk/samling/20161/kommissionsforslag/kom(2016)... Page 20 around the middle of the page.

> I don't think it's on my to find a better implementation for YouTube, but with all the smart engineers they have access to, I would think they could come up with something less intrusive.

The sentiment behind this sentence is the driving motivation for almost every single bad tech law on the Internet. Programmers aren't magic, there are limits to what they can and can't do.

Almost every bad tech law starts out with someone saying, "I don't know how this is going to work, but you're required to make it work, and if it falls apart it's your fault." You see this show up in the encryption debates, in the copyright directives, in debates about moderating content and identifying abuse, in the debates about age restrictions. It's universal, it comes from this belief that if you just require things, they'll magically happen because people can "nerd harder".

It is, of course, usually very good for tech laws to legislate outcomes rather than methodology. However, that doesn't get rid of the obligation to determine whether the outcomes being legislated are actually possible.

> it comes from this belief that if you just require things, they'll magically happen

We should be somewhat sympathetic that non-experts may not know the difference between a possible and an impossible technical goal, and we have to accept that for a politician there isn't much electoral advantage to be gained from trying to explain the difference to their voters.

However, each time I hear an impossible goal proposed, I can't help imagining the politician saying "We managed to land people on the Moon and return them safely, so surely we can do the same with the Sun now."

They should just do it at night, duh.

(as it happens, that's the premise of a Soviet political joke from the Apollo era)

I admit I wasn't the first to come up with that "landing on the Sun" analogy, and it's a joke that turns up every now and then[0].

Like many things relating to space travel, I'm prepared to believe the Soviets came up with it first.

[0] https://www.mic.com/articles/80001/did-north-korea-really-cl...

> I don't think it's on my to find a better implementation for YouTube, but with all the smart engineers they have access to, I would think they could come up with something less intrusive.

So you don't even have any idea what a better implementation might look like, not even a completely technically infeasible one? And the thousands of smart YouTube engineers, whose jobs revolve around making access to content frictionless to the point of being accused of making it addictive, just haven't thought "we should make this not suck?"

> Even here, it only calls for age verification. Again, there's no requirement for checking credit cards or passports.

Age verification offline has always been done by checking IDs. Why would you expect anything different by shifting to online? The law demands age verification, and youtube delivered the de facto standard for age verification in the form of ID checking. That seems to be extremely cause & effect of the most straightforward variety. There's no reasonable expectation for anything different to have occurred unless those creating the law also outlined how to do this in a more privacy-sensitive manner. But they almost certainly didn't, so obviously tech companies would go with what's well established practice instead of trying to skate on legally thin ice to create new precedents for age verification.

I doubt it. I've worked in a couple different social media companies and default age system is ml guessing unless you do something extreme like this. That gives you reasonable accuracy, but still very noticeable error that's a lot worse than id requirements. It's fairly hard to have confident age especially when a very high percent of people lie about there age if you just ask directly. I remember hearing a number like half of people underage just lie at work although unsure how serious that stat was. There were engineers that did spend projects on better age modeling as other ways just seemed unviable. If you make a legal requirement well enjoy id requirements.

The main path I can see around this is if the government/some company became accepted standard place for basic profile information. But that's just another id except a digital one. You can probably make a digital id system with good way of specifying which fields you grant to another company. The actual digital id when created will still need a physical id/government check though.

> NO, the law does NOT require your implementation to suck,

This is kind of an excuse though, because I have never seen an implementation of an age gate online that isn't kind of awful. You either make something that is trivial for kids to bypass, or you make something that is invasive, like Youtube's system.

So we get these laws that say, "solve the problem", and there isn't a way to solve the problem. But criticism of the law or criticism of the law's outcomes aren't allowed because the law doesn't technically require that your solution to be terrible. It just asks you to do something that's impossible to do well without violating someone's privacy.

In the US (at least for a while) this was solved by pretending that self-reported ages are an effective way to protect kids. And we pretended that would at least reduce exposure to this kind of content, even though in practice it has basically no impact at all. But if the law doesn't care about effectiveness, then why have the law in the first place? So we raise the standards a bit so that the law has some teeth. But again, nobody has ever in any context demonstrated a working age gate to me online that doesn't involve violating someone's privacy or collecting identifying information about them like a credit card or ID.

So it doesn't actually matter whether or not the law says the solution has to be terrible. The only outcomes that are possible from these laws are either ineffective solutions or invasive solutions. If there is only one method to accomplish an outcome, then requiring the outcome is effectively the same as requiring the method.

> So we get these laws that say, "solve the problem", and there isn't a way to solve the problem.

To give another obvious example of this pattern, there's "Make a crypto system which only lets the good guys in, not the bad guys".

In both cases, there's a "think of the children" imperative attached, but at least with laws about age restrictions there's more of a chance that the politicians' true goal isn't mass surveillance.

If it was codified in 2010, was is it only going into affect now 10 years later? I'm not an expert in browsing EU law, but I do see a "revision" of AVMSD [0] that passed in 2018 and started going into effect around 2021 in various countries [1]. The two links you posted very clearly say "archived on 2012" so they are not the new version.

[0] https://digital-strategy.ec.europa.eu/en/policies/revision-a...

[1] https://www.obs.coe.int/en/web/observatoire/avmsd-tracking

How do you even define content that "might" seriously impair the physical, mental, or moral development of minors. This is so subjective I don't see how you could get away with marking anything that wouldn't in the US be rated PG.

At that point in order to ensure that such content isn't shown to minors you have to require a credit card or an ID because any reasonably kid would figure out how to set his or her age to a reasonable age of majority to avoid being pigeonholed into kid stuff.

Can you give me an example of an alternative strategy that would be legal and more reasonable?

> NO, the law does NOT require your implementation to suck,

When the law is "you have to verify a meatspace user's age before showing them content that could arbitrarily be considered 'adult' by some group of lawmakers who most likely have different and more puritan values than you," yes, it does require your implementation to suck, because that law sucks by definition.

I'm glad YouTube implemented it this way, so that the pain of shitty laws can be felt instead of being allowed to proceed. Maybe people will actually try to push back against overzealous Internet regulation at some point.

It's possibly not how they wanted to interpret it (though I see how it helps their ad/tracking business). But it is probably how they have to interpret it because they might get sued if they didn't. At the very least it's an expensive court case to dismiss. All whilst eyeball-thirsty news agencies print articles such as "Google Refuses to Support EU Child-Protection Legislation", and Twitter-personas post tweets like "Uh Google - what about the kids?"

I'm not saying that the law requires that YouTube does this, all I'm saying is that this policy is the result of the AVMSD. Without the extensions to the AVMSD, Google would not have implemented this behaviour. You can argue that they've implemented an intentionally awful way to comply just to spite the politicians, or that they're overthinking the law, but there's still a direct relation between the update of the directive and the change in YouTube's policies.