It is like negotiating with a terrorist that wants to kill you and this is his starting position and then he wants to agree on some compromise, like seriously beating you. There is no negotiation.

That exists and is called "self defense", no?

That data leaks out is always a given. So, gather less data. Ideally none. But this is not a discussion about data. This is a discussion as to what state actors think they are allowed to do. It is an attack on private life of people. See the combined strike against VPNs.

PS I'm referring to bail reform here.

PPS Just trying to frame what the CA government thinks its allowed to do which is apparently anything it wants.

I can only hope you are correct.

Obligatory XKCD: https://xkcd.com/2521/

but... I would also like to keep my kids from seeing the very worst of the internet before they're ready to handle it. I tried using a PiHole but Firefox DNS-over-HTTPS nullifies that now. It's not realistic for me to be watching over their shoulders 24/7; what can I do to keep them away from stuff 99% of people agree isn't for children to see, without something like this?

    # https://doh-int.mydomain.net/dns-query
        interface: [ip of lan port]@443
        interface: [ip of wifi port]@443
        https-port: 443
        http-max-streams: 220
        tls-service-key: "/etc/unbound/keys.d/unbound_server.key"
        tls-service-pem: "/etc/unbound/keys.d/unbound_server.pem"

    ip route add blackhole "${IP}" 2>/dev/null

If the childs account is not able to gain admin privs then their ability to change settings can be disabled.

I personally think this current version of the legislation is a good compromise. Tech workarounds are fine for the few of us that understand the relevant technology (though I have never bothered to compile DNS in my life and have no plans to do so in the future), but they are simply not practical for most people. Every time I hear someone suggesting this sort of thing I find myself tempted to say 'why worry about legislation? If you don't like what it mandates you can just write your own operating system.'

Of course this would not be helpful because writing your own OS is extremely hard beyond classroom/toy examples. And likewise, tech workarounds and even parental controls are hard for most consumers - partly by design. I have an xbox console and have been trying to figure out why it keeps freezing on certain apps for months now. I suspect a telemetry problem but it's just a guess, there isn't really any way to look at logs so it's a trial and error process because most consumer hardware/application vendors want their products to be black boxes.

I don't think it is a good compromise. It seems to cover the wrong use cases.

My use cases have nothing to do with children on any level. Why would I want to submit to government restrictions? That makes zero sense.

It's as if the right-to-repair-movement would suddenly be undermined by a lobbyist advocating how restrictions are great. Or Jackie Chan suddenly praising the sinomarxist mono-party.

Like no past generation could stop their kids.

Past generations absolutely protected their kids from cigarettes and alcohol. A gate doesn’t have to be 100% effective to have net benefits.

No. Like, obviously no. That’s not how effectiveness is ever measured.

Some kids getting access to booze here and there with planning and coordination is different from kids walking into a liquor store or bar whenever they want.

1. https://en.wikipedia.org/wiki/Splitting_(psychology)

But like your examples, it's not guaranteed to work.

Install a DNS filter. Firefox circumvented that? Smart kid :)

Censorship circumvention might be a good skill to have in the near future.

I'm sorry, but what? Cigarettes, sure. Alcohol? Binge drinking was absolutely rampant at my school, and I don't think I'm alone. Don't get me wrong, some parents just buried their heads in the sand, but unless you're giving them a breathalyzer when they get home and severely punishing them all the time it's pretty hard to prevent.

(Yes, you might get carded before you can go into a bar or a club, but we're talking about every possible device that can connect to the internet here; that's a lot closer to the grocery store than a bar or club terms of how much of a staple this is for most people's daily lives at this point. Cutting off my ability to access to my bank account, contact doctor, or pay my bills should not be something that should require additional steps because my devices which no children ever used could theoretically be used for a child to try to watch porn).

I agree these proposals are garbage. But if everyone who can credibly say that is busy trying to block any age gating, this is what we’re going to get.

I'm certainly not busy trying to block a bunch of hypothetical policies that no one has proposed when there are garbage ones that are literally getting pushed right now. It sounds more like too many of the people who recognize the harm of this policy are too busy trying to claim that the burden for coming up with a non-garbage policy should be on the people who fundamentally disagree with that framing.

Things a good way to put it. Yes. Regardless of whether you disagree with that framing, that is the frame that’s been set and is being run with. So you can make theoretical arguments against the framing. Or practical arguments against the policies within the frame.

Fluent in pod tide trends and latest sticker packs, but utterly unable to comprehend anything not working, be it wifi, proxy, dns, their phone's mobile connection. Unable to even ask the question "_why_ is something not working" or "what can I possibly do with this arcane message obscuring my $app's screen".

I know that's a quite broad generalisation but I see this in my kids' school across basically all their peers, and I can observe it online.

Anything broken -> passive hang up until fixed (of course if they cna talk to their bestie about the issue, this is what they do).

Nothing. VPNs exist (including free ones), some of classmates will have unlocked devices, etc.

Next question?

Also make sure to block all OSes allowing to install apps from outside the app store, lest someone uses a private socks proxy on their free Cloudflare Worker account.

Make sure to ban/backdoor all the encryption protocols so the traffic not yet blocked can be analysed. And ban all free OSes or someone will write a "black market" encryption/communication protocol.

There's insanity in your request and it needs to be called out.

Here we talk about use cases for EVERYONE. I don't see how your use case is fine for me, because I personally do not agree with it on any level at all whatsoever. You believe in restriction. I don't. There is no common ground here.

> It's not realistic for me to be watching over their shoulders 24/7

Is this your job? At which age will you stop monitoring them?

> what can I do to keep them away from stuff 99% of people agree isn't for children to see

99%? Where do you get those numbers from?

Besides, what stuff anyway? Even then the issue isn't about your kids. It is about laws for EVERYONE.

This is the main problem that needs to be addressed. Everything else is just a byproduct of it. If you support the by product of what was created by conditions that are not being address, you only make the problem worse.

However DoH isn't obfuscated and in order to operate the list of resolvers that firefox uses must be published somewhere. It follows that you should be able to filter the major DoH providers at your gateway.

The better question is "Why do I need to give up privacy on my devices that no children ever use and are used for all sorts of mundane things that are entirely unrelated to what you're trying to protect your children from to solve this problem?" The solution being proposed here is to require ID checks at the OS installation level; this would be like requiring me to flash my ID when I walk out of my house because kids would have to go outside if they were going to try to buy alcohol.

> before they're ready to handle it

You can restrict any access for the network to them. Extra bonus, this will save your child from addiction.

I understand that this is not always possible, but... it's spectrum - try to reach maximum and do your best.

Also, consider that I don't have any experience in raising a little human, so, probably, I'm talking nonsense

How do you propose doing age restrictions for social media?

These are broadly popular. (And the evidence supports them.) They are happening. So the question is how to do it best. The project for reversing the consensus isn’t worthless. But it’s a long-term project that will have to bear fruit after these restrictions go into effect, if ever.

Voters are collectively deciding for all of our children. And there are absolutely group dynamics that require cooperation. It’s why rich communities ban phones in classrooms while in poor communities, the one family that tries doing it alone is probably going to be less successful.

Again, I’m not saying you’re fundamentally wrong. Just that this debate has been had and the polling is massively in favor of bans for under-14 year olds and strongly in favor for under-18s. (And to the degree I’ve connected with electeds, the folks calling in and writing were almost 100% one way. The civically-engaged electorate is practically at consensus.)

Huh?

"lolbertarian - A disparaging term for internet libertarians, used jokingly or not."

[1] - https://www.urbandictionary.com/define.php?term=lolberts

I want government bureacrats, empowered by the stupid median voter, to be as far away as possible from things that I (and any other parent) are perfectly capable of solving by ourselves.

I want more freedom

Sure. Call your electeds next time this comes up. Right now, the ship has sailed. Jurisdictions are debating methodology.

The idea is broadly popular but the second you start asking about implementation details (ie showing your ID to post on the web), the actual approval percentage tanks down to the single digits.

But you knew that which is why you construct this rhetorical motte-and-bailey about it being "broadly popular"

Source?

> But you knew that

I genuinely don’t. I don’t think many electeds do, either.

The playing field is currently lots of angry non-technical parents looking at Silicon Valley leadership not doing anything remotely reassuring when it comes to taking care of their children. And then a good fraction of them being drawn into a proper pantheon of idiot conspiracy theories. (They’re really stupid.) I would love to see polls considering implementation details because that would at least imply somebody is thinking of them.

Right now, honest answer, I don’t think anyone in government is. Electeds see an easy win—or more accurately, a patchwork of angry, mobilized voters they can scoop into their election-year campaigns with a rushed-out bill that pins them to the issue but which neither they nor those voters really have the technical chops to parse.

Best case, we get tripe. Worst, the process gets hijacked.

What it fails to account for is that today's internet is qualitatively different from the pre-social-media, pre-smartphone internet. The vast majority of the internet audience, too, is qualitatively different. Incentives are misaligned for an average parent who might want to keep a tight leash on smartphone internet access for their kids, when attempting to do so will generate fierce opposition from their kids and leave them socially out of the loop.

Maybe we should teach parents how to be parents instead of imposing draconian age checks (read: mass surveillance).

The first example is bad, the second is tolerable.

But the reason most kids don't smoke is that the parents and the teachers instilled in them that it was bad. If a kid wants to smoke or drink, they can surely get an older friend or a friend of a friend to sell them the cigarettes or alcohol. Anyone can buy 20 bottles of hard liquor and 50 packs of cigarettes, sell them to a 15 year old who can then sell them to their friends. That doesn't happen often not because a surprise police raid will show up and bust the seller but because there isn't enough demand. If there is demand from the kids and the parents don't care, kids will get their hands on drugs. Maybe not 9 year olds but certainly the teens.

Big honking "citation needed" there. I think it's far more likely that laws against advertising to minors, and tightening enforcement of prohibiting the sale to minors, is what did it.

On top of it all, smoking has decreased among adults too. Part of that is certainly cutting off a big chunk of the teen-to-adult smoking pipeline, but part of it is also just that adults don't think it's so cool anymore (and "going out for a smoke" is no longer a social or even professional activity), and are more aware of the health risks.

Low-tech Magazine (https://solar.lowtechmagazine.com/) has enough articles to publish a thematic book, “How To Build a Low-tech Internet?”. There are other books with concrete proposals: pretty sure Cory Doctorow's published a few (Chokepoint Capitalism, also by Rebecca Giblin; Enshittification; possibly others). You can read these if you would like. But the important part is using and maintaining credible alternatives, reducing both our dependence on and support of these companies.

[1]: although more work is needed to reduce the addictiveness / increase the humanity of Fediverse UIs (which are largely modelled on the corresponding Big Tech social media systems): websites are still the way to go, if you can.

[0] I also know home-schooled people whose parents are far better than any teacher I've ever had and whose education and achievements reflect that obvious fact. Home-schooling itself isn't the issue, and I'd prefer that it remain possible.

The home-educated typically score 15 to 25 percentile points above public-school students on standardized academic achievement tests.

-- https://nheri.org/research-facts-on-homeschooling/#Academic

First independent search result:

> The US-based NHERI describes itself as a leading research institute in the field of homeschooling. However, its neutrality is often questioned.

In all three scenarios (but especially in the first two) there is a sizeable population of parents who know their kid is several years behind grade level, but they tolerate it because they think kids learn at different paces. Or that it's fine for a kid to love one particular thing (cooking, machine repair, art) at the expense of a well-rounded education. And that's not even getting into the 'unschoolers' who treat never opening a textbook as a point of pride.

If you're well-educated and run in circles of people like you then you'll find the homeschoolers who also value education. But if you expose yourself to a wider variety of people your conclusions may change.

Anecdotes like this don't help the case much when government schools in a lot of places "graduate" large proportions of their pupils who are functionally illiterate and innumerate. Then you get misconduct, bullying, abuse that goes on in government schools. Who should "step in" on the government?

Home schooled people do fine, statistically.

Back on the first hard, I'd argue that most of those people might have benefited from having more access to the internet, as it sounds like at least part of the problem was that they had severely limited experience for how to navigate the world outside of small amount their parents allowed them to be exposed to. I'm on board with the government being involved in ways that are beneficial, but "make anyone using an internet-connected device plug in their ID first" just feels like an absurd overreach for what it's trying to solve.

We really can't have it both ways, that every failure of the child is blamed on the parent for lapsing in their almost totalitarian oversight, while also idealizing the idea that children must make their own mistakes and gradually growing into responsibilities and self-governance. Except having access to the Internet, apparently.

Taking a step back, this all smells like madeleines and a yearning for the good old days when everyone rode bikes and nobody owned smartphones. That's not really a productive stance on anything.

(If you would ask me, and I'm sure nobody would, I would think that there is a sort of trade-off here but with a clear answer: Make clear restrictions about buying cigarettes, alcohol, abusive content and extreme porn. But these restrictions aren't meant to be technically perfect. It's ok that some kids will learn to lift the limits and explore what is forbidden. At least then they would know that there is some reason society collectively considers these things off-limits, and that they soon will be in a mistake of their own making.)

The potentially all-powerful government shouldn't know:

- what vices a person has

- what religion a person has or doesn't have

- what porn you watch

- what alcohol and drugs you buy

PERIOD.

All of these things can be exploited. To control jobs, to control finances, to extort influence, to shape ideology, etc.

The government shouldn't be able to catalog those things in a database for later misuse.

The government shouldn't be able to install friction or barriers that make it easy to cordon off and kill these things at a later time.

The "think of the kids" argument can go to straight to hell. Nobody's having children anyway.

This is a very real (not logically fallacious) slippery slope right into the pages of 1984.

It's not about kids. It's about control over society as a whole. They're going to force you to use your ID to access the internet, force you to use an approved device, and the minute you step outside of allowed behavior, you'll be punished.

Shackles and telescreens are coming, and they're using this argument to build it.

Would it be acceptable for a private company to own this information? Perhaps sell it to others?

Private companies should also be regulated with regards to data sales of private information, yes.

Are you suggesting we remove current laws making it illegal for children to purchase these things?

That's besides the point though because this legislation doesn't check people's IDs when they're trying to purchase porn or alcohol, but as soon as they walk out the door, and if they refuse to show it, they have someone following then around even if they just go to the ATM and to the doctor.

With online services, there's no way to ensure your information isn't permanently stored and associated with the transaction for later misuse.

This broad rejection without good reasons is borderline sociopathic. ... and parental control is not the gov raising anyone.

- keeping class sizes small - keeping class within similar development range ( AP with AP. short bus with short bus )

None of it is a secret, but government can't (edit:or won't) make it happen. Hence regular people just doing the best they can within the system at their disposal.

It's why some schools in (iirc) California did away with higher maths like calculus entirely.

Sadly, it seems there's nothing actually common about common wisdom.

Socialization doesn't have to solely occur in an academic classroom.

> like your "sink it" nugget, they lack decent problem descriptions

Let me be clearer then: The legislation has passed but it is 100% possible to repeal that law. And it should be repealed, and we need to not let up pressure on California until it is rescinded. It was a bad law that was not thought out at all and fails to solve any problems.

I'm not worries about corporate feudalism and app age checks.

I'm not sociopathic, you're just making broad assumptions.

Eg "if you ban cellphones in schools then average test scores (on tests like PISA) will substantially improve". Or something else like that.

>This broad rejection without good reasons is borderline sociopathic.

It's sociopathic to not want the people in control to constantly make up new arbitrary rules? I guess we just need a few more Patriot Acts and Snoopers Charters.

This is only going to cause things you describe to get worse and the U.S. government is complicit in this because we have a two party system that works directly or indirectly for the establishment.

I'm not sure if you are encouraging more government intervention, but its clear this is not working. Its like going to a criminal gang and asking for security while they ransack your community and charge you for it.

Governance only works when it represents the people, that is not what this government does right now and no amount of electing the right candidates is going to fix that until we have those two issues addressed.

It's like saying we should install Flock cameras everywhere so that we can protect consumers from buying harmful products. Corruption and mass-violation of human rights is all that's ever going to come out of it.

If the goal is to stop predatory companies, why not do so? Oh right, because that was never the goal.

It's also the tired old argument that's constantly raised by encryption ban/backdoor proponents too. How many times do they have to be debunked, ugh.

If you're against the EFF on these kind of issues, it's typically a good time to reevaluate your position.

https://www.eff.org/issues/age-verification

Furthermore, age verification is being pushed at multiple jurisdictions across the globe. They're trying multiple approaches to get this through and seeing what sticks.

Governments are dangerous monopolies on force and the use of that force shouldn't be casually tossed out like candy at a parade on crap like this. If it doesn't matter if you lie, what's the point of even doing this, to prove that we're insane? Or is it the pretext for requiring a remote server id carding service in the future under that guise? Keep driving down this road and you end up with an end game that looks a lot more like North Korea than a free society with limited government.

Do you think the rule that children's toys can't contain lead is equivalent to living in North Korea? That's the same kind of law as this one.

You also have a lot more flexibility to negotiate on product quality. If you have a good reason why you can't meet normal product quality standards because your product is sufficiently different from the normal products in that category, you can usually put a prominent warning label on it to cover your ass and then you're fine.

And if they refuse to do all of this and resist, what happens to them? If you want a sample, stop paying your taxes, stuff your money under your mattress and see what ultimately happens. Just because our government is slow, stupid and incompetent doesn't mean that they don't use the same mechanism of action.

I would love to get into why looking at porno is not even in the same universe of danger as lead poisoning, but I've spent weeks trying to explain harm comparison to people that genuinely think high schoolers using social media is the same thing as them using cigarettes and heroin and I'm just exhausted.

It's useful to contrast this with the various device-based mandates that have been created in order to get a sense of what legislators seem to be trying to do. With that in mind, a few points:

* What you are proposing allows parents to opt in via parental controls, but age assurance mandates (both device-side and server-side) tend to require positive action to enter unrestricted modes. In some cases (CA AB 1043, for instance), this is just a matter of entering your age. In others, you actually need to demonstrate your age via some technical mechanism.

* While many age assurance mandates focus on adult content, which is primarily consumed via the Web, others (e.g., Australia's Social Media Minimum Age) focus on social networking, which is primarily consumed via apps, so anything that is Web only will not be effective.

* Site-level granularity isn't really fine enough in some cases. For example, the New York SAFE for Kids act prohibits certain behaviors such as algorithmic recommendations when a user is a minor, but doesn't require blocking minor usage entirely. It's potentially possible to implement this with something like RTA, but it would have to at minimum be at much finer granularity.

Section VI of https://kgi.georgetown.edu/wp-content/uploads/2026/01/Age_As... goes into quite a bit more detail about various architectures (disclaimer, I'm an author).

None of this is an endorsement of age assurance techniques; I'm just trying to help flesh out the situation.

> All legislation regarding age verification must revolve around this otherwise people must reject it as an abusive form of tracking and privacy invasion.

It's a bit late for that, given that around half of US states already have some kind of age assurance mandate.

Perhaps late to solve this globally but parents can still install parental control software if they so desire and can still intervene locally to prevent sharing data with 3rd parties. At worst this means small children might not get to visit social media and other assorted sites and I am fine with that. I think a number of parents would be fine with that as well.

Sites can voluntarily label as some do. It just means that parental controls would have to default to blocking everything until approved and while sub-optimal maybe that's what people will have to do in order to avoid the evil pattern of sharing data with all the websites that will ultimately leak, or "leak", be sold, stolen, etc... Good parents will not participate in the evil patterns of sharing their children's personally identifiable information.

When the PII of children is ultimately shared with evil people the children once adults will resent their parents for not protecting them.

- To all parents here, your children have no idea what risks are out there including devious companies that want their data. They will one day be adults if all goes well. Protect your children as corporations will not.

Certainly parents can install parental control software, but what does this have to do with children's PII being shared with sites?

Just so we're on the same page, the way AB1043 works is that the OS determines the user's age and then shares the age bracket with apps. No PII is shared with sites (this is not to say that the age isn't sensitive, but it's not PII as usually regarded). Is your concern here that sites get access to children's information because children visit certain sites regardless of legislation? That's a real thing, but it seems mostly orthogonal to age assurance.

The parent can block or just never approve all the sites that require PII.

but it's not PII as usually regarded

We will never agree here. All the companies I worked for financial considered any attribute of the person to be PII, even their IP address. We were audited very strictly on this. If a users age was disclosed to a third party without their written consent that was a contract violation and came with severe monetary penalties. Parents should expect this to be the minimum standard. It's their children, not the corporation or governments children.

Again, this isn't an endorsement of these mandates; I'm just saying that what you're proposing here doesn't address the objectives that policymakers who are in favor of these mandates are trying to achieve.

Oh trust me, I get it. They and I will never align. I know I am beyond beating the dead horse. It's gone from bone dust to micronized dust to sub-atomic particles to sub-quantum particles at this point. That poor horse will never be forgotten. Perhaps it is an illness on my part but I will find a way to bring this up every time until the year 2150 after which point this will be the least of anyone's concerns.

https://webmasters.stackexchange.com/questions/140733/how-to...

They stop trying to put everything in a different category and treat RTA as the person under the age of consent must get approval from their parent or legal guardian. Keep it simple.

Google's doing that for them though.

Defining a new header isn't hard; the hard part is getting consensus and adoption.

Are today's videos beheading's without blood, with blood, with or without anguish, with nudity, without nudity, etc... After a while it gets out of hand.

It turned out the internet was too dynamic so the RTA header was created to just say "adult".

Correct. Until parent or guardian puts in password next to the text that says "Approve this site, forever."

You gave me an idea. Maybe there could be categories similar in concept to those that exist in corporate firewalls today that say things like:

- News Category (Known to be SFW)

- News Category (That may be NSFW)

- Child friendly sites

- Social media sites

... and so on.

This could be crowd sourced, ideally in a way that can not be gamed. The masses could flag/report false claims. That, or just keep it simple. ad-hoc input of permitted sites by parent.

I think I know what you meant and sure we can keep it simple. Site is approved by a parent or it isn't.

The problem with defining categories is that artists will do their best to defy categorization. That has been the nature of art for as long as humans have been making art.

I do not have a proposal for that. I'm only covering the issue of sharing any personal attributes of a child or anyone with any corporations as they have proven time and time again they can not be trusted with it. If anything they have proven beyond any shadow of doubt they can not be trusted with anything.

I will leave the NSFW definitions to yourself and others. Since the W stands for Work I guess company management and HR get some say in it too. I don't know where they get their standards from.

Ages ago I worked for a company that hosted porn and their standards were uniquely liberal.

An intern could also just delete the product which would also "solve" this "issue". The fact that it's easy or cheap is not significant to the problem at hand.

> should be doing is setting an RTA header

Many sites will just set the header by default. Now you've created a problem.

> then progressively fine them into oblivion.

This does nothing. See: Ofcom vs 4chan.

> device mandates

Mandate that the device provide an API for child protection software. Then it's up to individual parents to decide to install that software or not. Then we also get competition in this market rather than relying on whatever solution an intern cooked up one day.

Many sites will just set the header by default. Now you've created a problem.

I am not seeing a problem. Kids need not access those sites unless the parent or legal guardian approves it. Sites meant for children would not be adding the header.

[1] - https://news.ycombinator.com/item?id=47953096

Is Wikipedia "meant for children?" Should they be fully denied access to it? Should Wikimedia be fined if they make a mistake? If they get fined often enough do you think they'll just turn the header on everywhere in order to avoid risk?

Replace Wikipedia with any other mixed content site you prefer.

Add it to any site not specifically meant for children, that is totally fine.

[1] - https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-R... [ Follow Links At Your Own Peril ]

- Browser detects header. Prompts for local password to access site.

- Child does not know password, picks a different site or begs parent for access.

- This is now between child and parent. No third parties, no tracking, no telling website the users age, no local or remote API's sharing data.

- At some point if all goes well the child will be an adult and will thank their parent for looking out for them when all their friends data was sold and abused.

B) How would your RTA header intersect with content rating in different jurisdictions? What if the content is illegal for children in Turkey but legal for children in Kentucky?

For topic (B) companies can set or not set the header based on GeoIP. Not perfect but GeoIP is already used in load balancers, web servers and applications.

For (B), your proposal requires the website have a database over current rules in every country they would be accessible from. Would a website then, in your opinion, be responsible for the accuracy of this database? We have to presuppose an official GeoIP source that would then be legally binding and under democratic control, but given such a database, would a website serving a wrong header to an IP associated with a specific country then be committing a crime in that country? What would the punishment be?

For (B) this is already a thing. Porn sites and already doing this. Instead of blocking a region I am proposing to stop blocking and instead the law permit them to just add a header. The only people I can imagine apposing this are commercial VPN providers.

I think a better example might be places like polymarket (not allowed to operate in us) or usatoday (serves an EU only version with no cookies). The technical limitations on those systems are both GeoIP as far as I'm aware, and that seem sufficient for regulators.

What I find more interesting is that what you want is within the scope of this law. It's only required that the operating system takes in your age from an admin, from there the application (user agent/webbrowser) is supposed to handle the blocking, which it could do with a header as you suggest.

I will note that you are going to find a lot of libertarians that would oppose banning GeoIP circumvention.

The problem is that the point is to root everyone's devices. Anyone explaining how easy this is would be pushed out of the conversation as fast as if they were advocating for single-payer healthcare.

edit: I've been advocating the nearly identical but opposite solution - restricted access sites shouldn't respond to requests that lack an appropriate age/content restriction header. If they do, jail them.

They're literally going to have to do this anyway. Rooting people's devices to force them to lie about their age when they install their operating system is an absolutely fake pretendy solution; the only way it works is if you have to verify your age with some government agency when you install an operating system, in order to make that OS age official. The point is the identification.

It's still a stupid unconstitutional law, but I see what the aim is, even without strawmanning it.

Instead, the default should be, that if there is no header or it cannot be parsed, then the content is unsafe. And if there is a header, it describes the page rating, like what kind of dangerous content it may contain. The header may be added to any displayable content like HTML, text, images, audio or videos, but not to machine-readable content like JS files or AJAX responses.

So only those who wants their site to be accessible by minors, have to add headers. For social networks, the user might have an option to mark his content as "safe".

This means that with my proposal existing site operators need not to do anything to mark their sites as "unsafe" - all sites are "unsafe" by default. This means that millions of site operators need to spend 0 dollars to adapt their sites. How great is that?

The browser on a device with parent mode, should not allow displaying any content which doesn't have a header or that is marked as unsafe, or that contains header with invalid value. The parents may whitelist some sites.

There should be a reponsibility for intentionally marking unsafe content as "safe". We should also think what to do with foreign operators, intentionally putting invalid headers for unsafe content. Maybe they should be added to some kind of blacklist that the browsers would periodically update.

Search engines like Google could work by default in "safe" mode, but add "unsafe" header if the user wants to turn off restrictions.

> If a site is not adding the RTA header then progressively fine them into oblivion.

I think my proposal is better because it requires only fining those who intentionally misrepresent content safety.

The only hard part for the web is that a site could lie since there is no gatekeeper, but some black lists can help with bad actors.

Websites by default are ‘true’ for every category, unless they specify.

Categories are, for example of some: nudity, sexual, violence, etc.

It doesn’t have to be perfect but sites will have to err on the side of caution.

We could even create an html tag <restricted type=violence> for example, and the browser can simply not render that portion of the page of the user has that type disabled.

And we could give companies a pass for best-effort categorization using tech to assess user-generated content, along with allowing users to flag their own content as “safe”

The goal should be to satisfy most reasonable governments. A neutral technical standard and an international organization to maintain the the ontology for content descriptors

Or they could just add the header to anything that is potentially adult which is what I am proposing. It would be up to the parent to decide what is appropriate for their small children to view. Parents should already know what is legal for their kids to view.

[1] - https://en.wikipedia.org/wiki/Age_of_consent_by_country

There's no reason a simple, standardized header can't be used to communicate any number of classifications simultaneously.

Edit: It occurs to me that if you oppose all age related measures then my above response isn't entirely fair to you. I still think it's an absurd objection but the comparison I made no longer applies.

What we need regulation to provide (IMO) is a reliable way of doing that.

Sites can choose to have unrated content (adult movies) and those are only available on devices without an enabled parental control option (adult-only theaters).

A solution would be browsers refusing to load any site that didn't provide such metadata, not just in child mode but in any mode. I suppose either Apple or Google would likely be capable of unilaterally imposing such a requirement as things currently stand. However I also think that's unlikely to happen on its own for various reasons. Thus legally mandating certain basic content classification categories in addition to an extensible standard protocol for communicating such metadata would (I expect) end the cycle. And rather than the government going after individuals the legislation could be structured to place the onus on mainstream browsers, OSes, and other client software to enforce compliance on their behalf.

Fine. It probably should be, if sites don't want to bother cooperating.

With a universal labeling standard the UX would be much better, and there'd be a much greater incentive for website owners to participate (they'd be implementing a universal standard, not adding support for one particular parental control tool).

For example, it would be insane if every website and blog in the world to had to run logic to detect and prevent Elbonian males under 16 lunar years from seeing ankles except on Thursdays.

Parents today can accomplish what you are suggesting by installing parental control software and only allowing access to things they explicitly approve.

This can also be done via headers explicit blocking of all the things and was suggested in another thread. [1] Some people liked the idea.

[1] - https://news.ycombinator.com/item?id=47952999

That said, outside of the merits of this approach, I am dubious of any actual implementation given 2 points.

1) Protecting the youths will always be a leaky bucket. With disadvantaged youths possibly more at risk. Those exposed to non-compliant parents ("cool" parents who are ok with sharing unsuitable content) or lacking strong parental involvement, likely won't benefit a great deal from any implementation.

2) Anti privacy social networks stand to gain the most from targeting ads utilizing signals from most child safety acts. They also might be able to reduce some costs from moderation if they can make it someone else's problem. I'd argue the net social impact from these social networks is likely both more normalized and strongly negative for our youths than any smut.

On the balance I'd say we are better off investing our energy in other places.

Or simply parents who won’t agree with the government on what is suitable for their children.

We already have parental control on all mainstream operating systems, why cannot this simply be the responsibility of the parent as are so many other things regarding what children do, watch, eat etc?

Adding a header to a web server or load balancer or app server if done globally can be done in a minute or two. Maybe 5 minutes for the intern not counting QA testing.

But you are right, the inverse is easier. I like that too. That was debated in the other recent thread.

[1] - https://news.ycombinator.com/item?id=47950091

None of that is true. Not even close. It will work if there are laws with big teeth as the government can have contractors that scan for the header. Header missing? Adult content? User provided adult content even if it violates the rules? Well darn, there goes 10% of revenue. Also it is not "this is a porn site". RTA stands for restricted to adults. That can include literally anything that is not appropriate for small children including but not limited to social media, forums, gallery sites meant to be SFW but users content is not pre-moderated meaning people can see it before a moderator does. What Restricted to Adults ultimately means will depend oh the laws behind it.

An actually useful standard would need to be much more granular, and be designed as a whitelist not a blacklist, as I and previous commenters said.

[1]: https://wiki.whatwg.org/wiki/MetaExtensions#:~:text=Restrict...

[2]: https://webmasters.stackexchange.com/q/140733

Here [1] is the only external link that is relevant and don't take their banner out of context. This was originally by the adult entertainment industry to self label and self regulate but is now used on any site that is not appropriate for minors. Entertainment could be inappropriate humor for example. That does require porn. I would link to some inappropriate humor but that would be inappropriate.

"The RTA Label is free to use, voluntary, and universally available to any website that wishes to clearly and effectively label itself as being inappropriate for viewing by minors."

[1] - https://www.rtalabel.org/page.php

I'd actually go somewhat further though and ask whether it's a good idea to even do this via web pages at all. We have a great potential system for this already: DNS. Do something useful amongst all the ridiculous vanity and spam TLDs for once and set up a ".kids" gTLD, or ccTLD for that matter so that different countries can set their own regulatory standards naturally (ie, .kids.us, .kids.uk etc). Domains could also be used for some broad buckets for people who don't want to drill in, ie, .1-6.kids, .7-12.kids, .13-17.kids, or whatever is deemed appropriate, but simple age brackets that would offer some sane defaults. 1-6 could simply not allow any ads, user generated content or algorithmic feeds whatsoever for example. There are a lot of knobs to turn. And then at the registry level it can be ensured from the get-go that anyone getting a .kids domain is fully identified, located in the country in question, has valid ID, has specific credentials or is an accredited organization, or whatever other criteria makes sense.

But ultimately the point would be to create something that is built right from the ground up, and in turn that doesn't interfere with what has already been built at all. Something that can also be worked with at the gateway and thus cover every device on a LAN, and for that matter can easily be plugged into the vast number of powerful tools we have for working with that stuff. It'd be easy to put a nice UI on all this, even to make it higly automated. For example, have a setup wizard where you enter children, put in date of birth for each, and it'll spit out a password for each one. This then auto-provisions the network such that each kid has their own VLAN (password for PPSK or even wired connection) and is automatically limited to the domain groups of their age bracket, which then changes as their age changes.

Parents should be able to dig further in and get more granular with content categories, metadata for which could be required for anyone hosting a site within that domain, but I think there is the potential to make something both pretty bullet proof and pretty accessible, using existing tech stacks, and without impinging on the present internet at all including privacy and anonymity.

And, if we are going to do this the “design” should be global and anticipate a range of cultures.

If a site is really mixing so much content (like Reddit) then they should really be separating their sites into different subdomains.

The vast bulk of the internet is child neutral. For example my church a web site, the bakery down the road has one, the local pro sport team has one. They're not designed "for kids", but kids are welcome.

Does StackOverflow need to register a .kids domain just so children might get answers to programing questions?

If my-bakery.co.uk and my-bakery.co.au both want to be visible to 16yo there needs to be at least kids.uk and kids.au.

Does OpenSSL.org or OpenSSL.com get to be OpenSSL.kids?

Sorry but duplicating the entire neutral internet domain space with yet another tld isn't a helpful approach.

Instead of running their own websites, they'll migrate to a platform like Facebook. That way Meta handles the burden of moderation and the legal complaints for the inevitable moderation failures.

I surprisingly seriously disagree, and think you're perhaps missing a lot of the contention in this whole societal debate. The point is to give people workable tools with some level of agreed sane defaults they can make use of, tweak, or ignore entirely, without imposing any burden at all on the existing internet and its adult (or children with parents who wish it) users.

>The vast bulk of the internet is child neutral

First: by who's standards is one of the core questions! What's neutral to one parent may not be to another. You illustrate this with your very first example in fact, "For example my church a web site". There are religious parents (and no doubt atheist ones as well) who would quite strongly not want their young child to visit your church's website.

Second: there is a difference between simply wanting to be child friendly and taking on a legal obligation and liability to be child "safe" to some given standard. Parents would be perfectly free to whitelist whatever additional sites they liked, or to subscribe to lists that curated whitelists of various sorts, or to use other controls. But a politically significant number of parents clearly want assurance that their child will near-never (with actual enforcement mechanisms for failure) encounter something outside of bounds. Meeting that need requires either whitelists or the sort of restrictions that would wreck the current web (and probably still not work very well).

>Does StackOverflow need to register a .kids domain just so children might get answers to programing questions?

If the parents of said kids want it to, then yes? Why would that be a big deal? I'd be surprised if like most places SO doesn't already have piles of domains purely for defensive purposes, and as something nationally regulated I certainly envision such a domain registrar being dirt cheap (or even free, paid for by tax dollars) for domains. Given the context and that it'd be very much not open to all there isn't any need to worry about cost to dissuade scammers and such, they'd be prevented from ever registering in the first place. Rules around use of trademark, business names and so on could also be very strict.

>If my-bakery.co.uk and my-bakery.co.au both want to be visible to 16yo there needs to be at least kids.uk and kids.au.

Yes? DNS is not expensive. And again, parents don't need to make use of it. This would be for those who do, who are right now pushing for ID for everything. It's a safe default walled garden, but one with doors any parent can open.

>Does OpenSSL.org or OpenSSL.com get to be OpenSSL.kids?

Which one chooses to get accredited by a regulator or child protection organization with insurance and so on first? Why are you asserting either would even bother? Which one would be happy about having to verify ID of users right now?

>Sorry but duplicating the entire neutral internet domain space with yet another tld isn't a helpful approach.

Sorry but you haven't thought about this very clearly at all. This proposal is very explicitly a small subset of the entire neutral internet! Duplication is never something I suggested, rather the very opposite! The "entire neutral internet" is by default adult here, but parents would be able to allow children to browse it just as now. However, some are clearly unhappy with that, enough that we're seeing politicians respond with things that would be very bad.

The core problem is the lack of buy in. Unfortunately that likely needs to be forced. I think it's not unreasonable to legally require people to make a claim about the nature of what they are serving up. They already need to be aware of the legal status of what they're doing anyway so it hardly seems as though making such a determination should pose a burden when you consider that it's an alternative to either requiring ID, requiring the client send age bracket information, or other heavy handed interventions. The choice here isn't "the status quo vs a header" but rather "some other age related regulation vs a header".

An easy way to enforce this "voluntarily" (ie coerce) without sending government agents after every small time website operator would be to require that mainstream browsers and other client software (based on MAU or similar metrics) refuse to process content that does not send a classification header. Doesn't matter what the header says or what the status of the user account or parental controls or whatever else is, it has to send the header regardless or it will be blocked without exception. That would presumably trigger broad compliance with the relevant regulations.

What about spoken words?

What makes online speech different, from the perspective of the Constitution that limits the power of the state?

What I've described does not restrict one's ability to speak freely. It is most similar to an impressum except it bears no identifying mark thus poses no hazard to anonymous speech.

Mandates on how speech must be structured are a violation of freedom of speech, Constitutionally speaking.

“Redressing a concrete dysfunction” does not appear in the Constitution as an exemption to guaranteed rights, as far as I am aware. The proper remedy for this kind of problem is an Amendment, assuming you can get enough people to agree with your assessment.

By your own logic would online ID laws not also be a constitutional violation? Ditto for age bracketing laws such as the one under discussion here. After all, they both effectively regulate one half of the exchange necessary for meaningful communication (ie protected speech).

> Impressums cannot be required in the US

Yes but why can't they be required? My (quite possibly flawed) understanding was that SCOTUS previously established that publishing without attribution could not directly be outlawed, recognizing the ability to speak anonymously as an important aspect of political speech. What I have described does not run afoul of that. It neither restricts one's ability to speak nor provides for any form of attribution.

> “Redressing a concrete dysfunction” does not appear in the Constitution as an exemption to guaranteed rights

Regardless of either your or my personal opinion SCOTUS routinely makes exceptions to constitutional rights when a compelling need is presented and the remedy is sufficiently targeted. That said, I don't believe that what I described infringes on the first amendment to begin with so your point is doubly moot.

Now you’re getting it. Throw them all out along with the idiots who passed the laws.

> Yes but why can't they be required?

The Court has interpreted compelled speech to be almost universally a violation of the First Amendment, outside of the courtroom. I tend to agree. “Shall make no law” is a strong statement.

> SCOTUS routinely makes exceptions to constitutional rights

Prior courts. The present Court seems to be (rightly) rolling back both judicially-granted overexpansion of rights and exceptions to rights, although this is a slow process.

We have to stop relying on the courts to grant new rights and/or exemptions to rights. Passing unconstitutional bills and hoping for a favorable interpretation is clearly not the intended process, yet it’s become increasingly common.

We need to figure out how to pass amendments again or we are going to lose our republic. (It may already be too late due to an out of control executive and corrupt Congress, but that’s another matter.)

We require for example nutrition labels on food products. So clearly metadata of various sorts can be required for an interaction within the marketplace if there's a good enough reason for it. I'm not sure where that leaves personal blogs but it certainly applies to Amazon and PornHub.

The present court is rolling back some things but certainly not all. From the very beginning constitutional rights have never been absolute. One of the basic principles that comes up repeatedly and supersedes almost everything else is that the government must be able to carry out its duties. The contention is generally whether something is truly necessary for that and if so whether the law in question is overly broad.

Marketplace being the key word here. Interstate commerce may be regulated.

> I'm not sure where that leaves personal blogs but it certainly applies to Amazon and PornHub.

That’s the point. I also care about restrictions on smaller businesses and want to prevent regulatory capture, but personal/nonprofit/community sites must not be burdened above all else. They face enough challenges as it is. If a website or software project is noncommercial, their speech is not subject to regulation, Constitutionally speaking. What’s more, the Constitution has the correct take here—this is as it should be.

> One of the basic principles that comes up repeatedly and supersedes almost everything else is that the government must be able to carry out its duties.

Then you get the question, what are its duties? Enforcing unconstitutional laws is not one of them.

“We” (as in the US government) do not do this. There is not, nor can there be, a law requiring such rating.

> we don't allow children into liquor stores, strip clubs, or adult bookstores

These are physical stores/venues, not written speech. “We” do not restrict authors from writing adult books that may or may not be seen by children, nor do we require that the books are labeled as such.

If you want to restrict speech, pass an amendment. That is the allowable path.

Also, FWIW, 18 U.S.C. § 2257 applies to printed books as well as online content.

But pure text literature (physical or online) isn't as regulated as visual media.

That's something the client should be doing. You can configure your own device (or your kid's) to have whatever default you want.

The actual problem is that classifying the entire firehose of user-generated content is precarious and uneconomical, so the default tag is going to be whatever minimizes liability. If untagged implies "unsafe" and "unsafe" minimizes liability then the majority of content will be untagged. If untagged implies "safe" then the majority of content will end up explicitly tagged as unsafe, because tagging it as unsafe minimizes liability.

But either way if you disable "unsafe content" you'll end up disabling almost everything, specifically including the huge amount of "safe" content which isn't tagged as safe because accurately classifying it is uneconomical.

Ultimately the problem is the provider knows what category the content is and the parent knows what the content policy is. Providers can't say whether it's "safe" or "unsafe", only what standards it complies with. Some parents will have weird policies like "only G-rated movies or any Jim Carey movie" that can't even be delegated in any reasonable way to providers.

So the header has "PG-13, US-legal" because it's a movie rated PG-13 and constitutionally-protected legal content in the US, and whatever other markets you want to open up. Providers could even include AI ratings so as to mass-tag their content at low cost, and parents can decide if a particular AI rating is okay.

Parental controls could even restrict official ratings to country of origin, so if you approve PG-13 it'll block that content from countries where you can't sue them for lying about it.

Those two things are completely disjoint. In one case you're measuring the value of the content to the platform and in the other you're measuring the value of the content to the kids.

Suppose there is some content that the platform would get $10 in ad revenue to show to kids, would cost $100 to classify, and is worth $1000 to the kids.

In the land of spherical cows you could have the users pay the money, but that gets killed by transaction costs, privacy issues with payment systems, and that kids generally don't have money. So the kids lose access to valuable information because the platform isn't willing to spend $100 to make $10.

And it's still a problem even if the platform could make as much revenue from showing the content as the user receives value from it. Consider the entire firehose of social media posts on some unspecified site. Classifying it all would cost e.g. a billion dollars. So even if the value of kids having the content was half a billion dollars -- a huge sum equivalent to multiple human lifetimes of labor effort -- to the kids and the platform both, it's not happening because the cost of classifying the content is even larger yet.

> Ultimately the problem is the provider knows what category the content is

That's the problem though. The provider doesn't know what category the content is. There are Wikipedia pages that contain nudity etc. Who is going to pay someone to read the millions of articles and classify each one? But if they instead just mark the whole site as adult content, the amount of non-adult content kids lose access to is large.

So the maximum cost to a provider is capped at convincing parents to disable blocking of the content. That could be an unfathomably large sum for pornhub or negligible for wikipedia.

The question then is what's cheaper, paying to have parents enable the content (for instance advertising to make that choice acceptable) or rating the content? If it's the former that's essentially the same value parents place on blocking that content.

You're looking at rating content in this default-block scheme as a cost, but really it's a discount. You're paying a smaller amount to rate the content "G - general audience" then convincing parents to allow unrated content.

I think that's okay. The need for regulation is incentivizing capitalism in its amoralism to favor your regulated morality.

Corporations very much like targetting impressionable kids with content to sell stuff. If that adds a liability cost to moderate and make sure that content is "safe" (whatever that means in your jurisdiction), then isn't that what you would want?

I've never let my kids out on youtube, or the internet without either of us parents (yet at least). I hear you can now whitelist channels on youtube premium for child accounts, which sounds exactly like I want, but of course that doesn't scale. While I'd want to curate the entire internet for them until we've instilled enough judgment/their brains have developed enough to do it themselves, it's obviously impossible. Adding a liability risk or moderation cost to target kids seems like a fairly aligned incentive.

Your cite is an earlier post of yours which says

> The one and only method I will participate in is server operators setting a RTA header [1]

and that cites a still earlier post of yours

> I stand by my repeated statements of how this could have been solved simply using an RTA header [1]

which finally actually cites¹ something that explains what the heck on RTA header is.

It would be quite a bit more reader friendly to cite https://www.rtalabel.org/page.php rather than make the reader traverse a linked list of comments to get there.

¹https://www.rtalabel.org/page.php

They can't do anything today as it is a federal holiday but they could do something tomorrow.

This could all be handled by settings in the browser, only if the sites themselves listened to the users' browser preferences.

It makes a bit of sense, since the mailer had already paid, but the main justification (iirc; it was years ago that I read the opinion) was that a postal service should be neutral and trusted to deliver.

The companies on the ads wouldn't do it that way if they were not getting a positive ROI from it. They probably only need to get 2 maybe 3 new customers to offset the cost of mass mailings.

Should USPS be required to respect that owners wishes here?

Sensible decision I think.

The user agent should... be an agent for the user, and be able to perform actions on their behalf.

(The legality of those actions is of course assumed by the user here... if I add an automated flamethrower to my mailbox and burn my bills, well the debt collectors may come regardless if I read them or not - we cannot shift blame to the USPS here).

The second argument has the problem that for the whole thing to work the recipient must also have reason to trust the post office, but here their interests are not considered at all.

Ultimately there’s no good excuse for the banner solution.

Same sort of thing when you log into Wizzair and the check box below the password field is not "remember me" but "subscribe to our marketing emails".

If you build a website without all that tracking stuff and without 'free' services from the data collection companies Google and Facebook, then you have a pretty good chance of not requiring a banner at all, because for logins, etc., you are allowed to use cookies et al. without requiring an opt-in.

But I never saw anybody at the OMR being proud about the state of cookie banners they created...

The problem is that people generally want functional and often performance cookies, and then you end up with the stupid cookie banner regardless of marketing cookies.

To not be indistinguishable from "strictly necessary" there would have to be a case where the "functional cookie" actually required consent, right? What case is that and how would you solicit that consent other than some kind of cookie banner?

> “Performance” actually refers to analytics, probably rebranded because users did not want it.

It refers to statistics, but sometimes you do want that, e.g. so the site can tell you how long it took you to do something compared to the average user, or provide those analytics to you. And the fact that this is ambiguous is an obvious problem -- if you get access to the data they collect is that "analytics" or "functional"?

In the face of an ambiguity, most corporate bureaucrats are going to take the risk-averse option, which is to ask for consent in case it turns out to be adjudicated as required ex post facto. The result is quite predictable. If you pass a poorly drafted law, businesses have a general preference for doing something stupid/wasteful/annoying over something that could get them sued or fined.

The case is when you don’t use that feature.

> how would you solicit that consent other than some kind of cookie banner?

Using the feature that requires the cookie is considered consent, same as using the website is considered consent to set cookies actually necessary for the entire website to function. For example, if you click “save settings”, that’s consent to save those settings, there’s no need for a “but am I allowed to save settings?” popup.

You might be tempted to dive into the potential grey area here, and sure, one exists, but (a) that’s why the laws go into 1,000 times more detail than this HN comment, (b) most of it’s not in the grey area, and (c) even in the worst case, making 100% sure is as easy as a checkbox before the button that activates the feature, there’s never a requirement for a blanket “can we do whatever we want” before even displaying the homepage.

> It refers to statistics, but sometimes you do want that, e.g. so the site can tell you how long it took you to do something compared to the average user, or provide those analytics to you. And the fact that this is ambiguous is an obvious problem -- if you get access to the data they collect is that "analytics" or "functional"?

The GDPR calls it “statistics”, but in this context defines the word to mean analytics, not statistics shown to users. If it’s shown to users then it’s either strictly necessary or functional.

> In the face of an ambiguity, most corporate bureaucrats are going to take the risk-averse option, which is to ask for consent in case it turns out to be adjudicated as required ex post facto. The result is quite predictable. If you pass a poorly drafted law, businesses have a general preference for doing something stupid/wasteful/annoying over something that could get them sued or fined.

Businesses are generally risk averse, yes, but don’t mistake knowing a force at play for knowing them all. The “cookie consent banner” was invented and evangelized not by the laws they’re commonly believed to have sprung from but by the IAB, an ad industry consortium counting Google, Facebook, and many others as members. The same organization that organized efforts to prevent third party cookie blocking, and that tried to block the GDPR entirely. The banner norms they created did not even comply with the law until changes a few years ago, the EU just took its sweet time on enforcement.

The average small business, of course, is not in on some grand scheme, but this is where your risk aversion comes in: if all the big players are doing something, and everybody around you is doing it, and you Google it and the first 20 results all say to do it, then the risk averse move is of course to just do it and move on. After all, trusting your own judgement is scary, what if you get sued or fined?

https://www.edpb.europa.eu/system/files/2023-01/edpb_2023011...

Also the law doesn't require anything to be done by the user to reject cookies, to begin with, as that is the default state. I often just delete the cookie dialog from the DOM.

It’s a useful guide on how the law is likely to be interpreted, and likely influences the interpretation itself, but my inner pedant is not satisfied.

Yeah, me too, which is why I challenged OP on the claim that it's 'clearly stated'.

For example, firefox's "strict tracking protection" setting also breaks a bunch of websites.

Midori is an example for a graphical one, while there is Lynx for the terminal.

The former are things like "does the user want dark mode", the language you chose to use the website in, the contents of your cart, your login info etc. The latter are for tracking. Typically, the former don't need consent, the latter do. Browsers have no way of telling the two apart.

But then again if it was to protect children, better support for voluntary age control would be so much more useful as most minors use devices managed/owned by their parents.

But then similar to cookie banners it is just about enabling surveillance

Do binary search and you don’t even need that many calls.

1. Is person older than 50? 2. Older than 25? 3. Older than 18? 4. Older than 9? 5. Younger than 14? 6. Older than 16?

It’s not written the way it’s written because they’re oblivious it’s written the way it’s written because it’s plain lobbying writing the bill.

For example, there’s little in the way of protections in how the age verification would be protected or prevent the analytics from being sold

Combine that with the character of practically every law written involving data privacy, use, IP, and associated regulation of activity around these since the 1990s. It becomes painfully clear that the interests of private citizens have not had a seat at the table, and the Constitution has been taken as an inconvenience to bypass, not a guiding document.

It's our duty as informed persons to educate the general population to exert pressure on policy makers to act in the common good - otherwise indeed nothing will change but increasing corruption.

The entire site shouldn't be blocked; the browser needs a way to tell the website "my parental controls are enabled and I need to you to filter out age-restricted content".

Alternatively, the RTA header/meta could include a parameter/attribute for an "alternate URL" to load when parental controls are enabled. This could be useful to allow sites to present a custom error-type response, but could also be used to automatically redirect the user to similar, but age-appropriate, content.

Anyway, this all ignores the fact that "protect the children" isn't really the goal here: it's to slowly eat away at our ability to be anonymous (even read-only anonymous) on the internet. Age verification is just a watered-down way of saying they require positive identification, and eventually our hardware will have to cryptographically attest we are who we say we are. I really hope this isn't inevitable, but it's starting to feel that way.

That could be a fingerprinting vector though so maybe depending on privacy settings it just blocks the page. Really these are all solvable problems that web standards orgs have dealt with before; you just need to create the incentive for such systems to exist.

If Meta, Google etc could easily have algorithms in place for determining the age of the person seeing the video - apart from having the override capability via a parental login as you have stated.. but these platforms have consistently refused to limit the type of content they are showing to children.

This can also be broadly implemented, any other technical solution won't be widely spread anyway.

I don't think authorities care about child protection though. They could have legislated malicious advertising practices and a lot of similar bad influences, but didn't.

Seems like this would incentivize just all sites to have the header regardless of if it meets the definition since you get fined if you dont but no fine if you have the header unneccesarily.

Especially if your definition is contains user contributed content. That is all sites with a comment field. What really is left? I'm not sure i have even visited a site in the last month that wouldn't fall under this.

1. This assumes that websites are under your jurisdiction and can be fined. This is not a valid assumption on the internet. If you want to do this, you need a framework to block noncompliant websites via ISP-side null-routing, putting pressure on payment processors and hosting companies which do operate in your country etc.

2. HTML tags and not HTTP headers. If just a small part of the site contains content which shouldn't be displayed, the web browser should just hide that part.

3. Sometimes, it is genuinely useful to know the user's restrictions ahead of time. Imagine you're a movie streaming site or game store. You have some content which is suitable for the user, no matter their age, but you need to know which bracket they're in to decide what to show them. Without that info, you either default-adult (which sucks for children) or default-child (which sucks for adults).

The problem of hosts in countries that don't give a shit is true for every solution aside from the great all blocking firewall no developed nation would want to have. So no to "ISP null routing" from me. ISPs provide infrastructure. They are not school teachers.

Such a solution implemented today would be tunnelled yesterday and everyone should support evasion attempts.