It seems to me that these bills aren't prescriptive (they say you can use a "commercially reasonable" method). Most states are also moving to adopt the ISO mDL standard[0].
[0] https://www.mdlconnection.com/implementation-tracker-map/
What? First, that has nothing to do with anything. Second, it's not true: most auditing has an in-person component, and many stings don't. Do you actually know what an audit is? Hint: a "pen test" isn't an audit and isn't much like an audit. Neither is a code review.
> Why does auditing always come up with this topic?
1. All security controls need to be audited.
2. There is a 100 percent chance that many of the organizations advocating for these laws, most of which would actually prefer for porn to be outlawed completely, will grab any chance they can to accuse sites of not complying. They'll either try to get sympathetic law enforcement agencies to take up those accusations, or, if they can find a legal avenue, they'll bring lawsuits themselves. They will undoubtedly find anecdotes of system failures, since any large-scale system will fail sometimes. They will claim that as evidence that the rules aren't being followed. Evidence, no matter how flimsy, has to be countered with other evidence, especially if you're in a "preponderance of the evidence" situation. It's pretty hard to show that what you're doing is reasonable or effective if you don't have at least a sample of records.
Like I said, I've seen no laws requiring any audits or record keeping, and actually every law I've seen explicitly makes such records illegal.
Not if you want to be able to pass any kind of audit, no. Not unless the authority issuing the ID participates in a complicated cryptographic protocol. Which none of them do and which is definitely not standardized.
One of the early states passing these, I think it was Louisiana, actually did at least try to step up and deal with the privacy issue. They came up with a trusted-third-party thing. The third parties, who are private entities, have to pinky promise not to leak the data or keep them beyond certain limits. They are not audited. There are no actual penalties if they screw up. That's not acceptable assurance. There are also no limits on what they can charge, come to think of it, and it's not exactly going to be a large fluid market.
None of the other states even went that far. Nor did any of them try to come up with a shared standard.
There's definitely nothing out there that the user can verify as working, or that's certified by anybody the user should trust.
There are also the facts that--
1. All of the "age verification" protocols that the various activists are pushing and the various vendors are hawking are ineffective, in that any halfway motivated kid can easily figure out how to circumvent them, and
2. Kids just seeing porn isn't actually a big problem, especially if they've sought it out.
It makes complete sense to resist this BS.