The article is slightly wrong. It is "addictive" feeds that are address, not "algorithmic" feeds.
The definition is in in the bill, but the copies I have seen are formatted in ways that make copy/paste too much work, and a quick comparison looks like it is almost identical to New York's law targeting such feeds (except Illinois numbers there list 1-8 whereas NY letters it a-h), and I happen to have that in an easily pastable form, so here is the NY definition:
> "Addictive feed" shall mean a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met, alone or in combination with one another:
> (a) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user or user's device, and does not concern the user's previous interactions with media generated or shared by other users;
> (b) the recommendation, prioritization, or selection is based on user-selected privacy or accessibility settings, or technical information concerning the user's device;
> (c) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user's device that is not otherwise permissible under this subdivision;
> (d) the user expressly and unambiguously requested that specific media, media by a specified author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to pursuant to paragraph (c) of this subdivision, be blocked, prioritized or deprioritized for display, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user's device that is not otherwise permissible under this subdivision;
> (e) the media are direct and private communications;
> (f) the media are recommended, selected, or prioritized only in response to a specific search inquiry by the user;
(> g) the media recommended, selected, or prioritized for display is exclusively next in a pre-existing sequence from the same author, creator, poster, or source; or
> (h) the recommendation, prioritization, or selection is necessary to comply with the provisions of this article and any regulations promulgated pursuant to this article.
Does it even ask for verification? If not, the problem with it is that it seems to require the OS provider (not the local installation) to store the age.
So in red states porn is being used, and in blue states TikTok and Instagram are being used. Is anyone tracking who is behind the concerted efforts here? For example, which organizations, executives, lobbyists and politicians are valid and responsible parties?
Unpopular opinion, but this is objectively better than having to upload your ID to every random website that requires an age check (if that's what the end result is).
I predicted this would happen. Others also predicted this would happen.
I think now even the last person realises that this has nothing to do with age "verification". They simply hate us for our freedom. And it is clearly a move coordinated by private business here; their lobbyists are acting. This is also why it is the same law essentially in so many different countries at the same time. It is quite fascinating to watch, actually. People used to say "conspiracy nut!" - well, the facts are too clear now. That's no longer a conspiracy.
I feel like all of these laws are being designed backwards. Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion.
Requiring my kids' devices to advertise their age (or their age "bucket", as if that was a meaningful difference) to protect them is not doing me or my kids any favors.
Can we extend that beyond just parental controls? I'd love to permaban 90% of the internet from ever reaching me. But the laws are designed backwards because they're probably written for someone else's benefit.
If this age verification stuff ever becomes plausible we always have the option of distributing actual Linux ISOs over bittorrent. Failing that, source code in RAR'd archives distributed across IPFS nodes and Tor. I feel like many of us would welcome the challenge if it were under better circumstances.
I know RAR isn't the coolest archive format but it has particular strengths for data preservation. Namely, built-in recovery records and effectively no archive size limit.
It is more reliable than most other archives in my experience though I prefer ZIP for general compatibility. Compressed TAR is not great for random access though I think you can create indexed tarballs which helps.
I think the issue is with something like algorithmic feeds — that's not content that can be allowed or blocked at the client-level, that's a setting that needs to be fed back to the service. It would be very difficult (impossible?) to design an API that allows services to identify whether a user should be served an algorithmic feed without also having that service know that the setting change was triggered by local age restrictions.
Like, I can imagine a browser exposing an API that says "wantsAlgorithmicFeeds: boolean", and websites would be required to respect that setting. In theory, anyone can toggle that setting, so the website doesn't know if the user is under 18 or not. But if in practice the vast majority of people with "wantsAlgorithmicFeeds: false" are children, then websites can use that API as a good enough proxy for identifying information in the vast majority of cases. Moreover, the more of these specific APIs you add, the harder it gets to keep things anonymous — especially if different states have different requirements on age-restricted content, you'd end up being able to triangulate not just age brackets, but also potentially location as well.
I agree that age bucket still has the potential for exposing identifying information (e.g. if you can monitor a user as they move from one bucket to another, you can identify their date of birth), but it's harder, and it reduces the amount of side-information that can potentially get leaked.
That said, exposing the information in the other direction as well would be a good step because it would allow websites or apps to enable OS-level age restrictions without requiring that they also read the "age bucket" bit. It would be nice if "read a person's age bracket" were a permission that an app or website would need to request, rather than one that was given by default, and that could be coupled with the fully-privacy-preserving approach you describe, so that different applications with different requirements could mix-and-match.
All that said, I suspect it would be a lot easier to coordinate on good technical solutions like the one you're describing if the default reaction to anything that even smells like age restriction wasn't the sort of abject horror and moral panic that is so clear in this thread. Like, sure, age verification at any level has all sorts of issues. But that isn't the only possible solution to the problem here, and if technical people react to these proposals by pretending the problem doesn't even exist in the first place, then we're never going to find those better solutions.
Do you actually manage devices for kids? It's a massive pain fine tuning all the controls on Apple, and the only way to really be sure is to completely ban the web browser and the app store (and probably more things I have missed). Now do this for multiple kids.
Most parents can't be bothered, especially if they are non-technical and intimidated by settings. And so they give their kids unrestricted devices. I think I read the average first exposure to pornography is now age 7. I'm speaking from experience as many parents I've talked to have thrown up their hands because they can't keep their elementary aged kid from using the ipad all night, despite there being an extremely easy screen time fix for that very problem.
I am technical enough to understand how to do all this, but even then I encounter many bugs in the parental controls, for example one kid is able to use Safari despite my blocking, even though they are on an identical device to another child who is successfully blocked.
There are infinite content sources now, and it's not possible to manage them all 1-by-1.
All that being said, broadcasting device user age should be completely opt-in for those who want it, and not mandated for every customer.
These laws still do not sit well with me. This is just going to create endless lawsuits. In my opinion the safer choice would be to avoid doing anything with current teens, that's just a non starter. Instead think of sliding windows of time and sandbox small children on a child account that if all goes well will one day be a teen and then an adult. They will thank you when they are an adult for looking out for them when they were too young to consent to the data leaked by these laws.
Why not just signal age ranges? Simple, the way the legal system works is one puts in a benign sounding law, then tweak it every year since the mechanism exists. (scope creep)"Now add city, state", "Now add DOB and address", "Now add your federal wallet ID."
- For small children set an RTA header (previous discussions) [1] for any URL that may potentially contain content not appropriate for small children. Give site operators 1 year to implement this. Not counting QA and change control this takes minutes.
- Require app and device vendors to create a properly sand-boxed child account. Pen test it but it does not have to be perfect. This is for small children and default installed applications. If the child visits a URL that contains the RTA header then trigger parental controls. It is entirely up to the parent when that child is ready for mature content. It must be impossible for the child to install any applications, addons, etc... There are a myriad of ways to accomplish this.
- How is this enforced? Same way as any other parenting issue. If there is an incident that involves law enforcement, then social services can investigate and determine if negligence was occurring. When the child is mentally mature enough to deal with all the crap that is the internet their account is converted to an adult account. If the parent is giving the child an adult account before they are ready then the parent(s) go to mandatory parental training. If the child was being bullied or groomed, redirect law enforcement to go after the bullies or groomers.
- Set the laws to be active for any small child that would be under 13 as of the year 2034. Presto! One need not try to confine teens. When these small children are teens they will either be used to the sandbox account or the parent may have converted the account to adult.
As a side note all public and private schools should be legislated to have classes on dealing with all the crap the internet has to offer. Bullies, Cry-bullies, Trolls, Groomers, Scammers, Devious companies, Astroturfers, Gas Lighters, Propagandists, NGO's and so on. Also teach and help them build friend networks so there is protection in numbers. No child should be friendless.
89 comments
[ 0.23 ms ] story [ 33.3 ms ] thread>no algorithmic feeds for minors by default
Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm?
The definition is in in the bill, but the copies I have seen are formatted in ways that make copy/paste too much work, and a quick comparison looks like it is almost identical to New York's law targeting such feeds (except Illinois numbers there list 1-8 whereas NY letters it a-h), and I happen to have that in an easily pastable form, so here is the NY definition:
> "Addictive feed" shall mean a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met, alone or in combination with one another:
> (a) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user or user's device, and does not concern the user's previous interactions with media generated or shared by other users;
> (b) the recommendation, prioritization, or selection is based on user-selected privacy or accessibility settings, or technical information concerning the user's device;
> (c) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user's device that is not otherwise permissible under this subdivision;
> (d) the user expressly and unambiguously requested that specific media, media by a specified author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to pursuant to paragraph (c) of this subdivision, be blocked, prioritized or deprioritized for display, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user's device that is not otherwise permissible under this subdivision;
> (e) the media are direct and private communications;
> (f) the media are recommended, selected, or prioritized only in response to a specific search inquiry by the user;
(> g) the media recommended, selected, or prioritized for display is exclusively next in a pre-existing sequence from the same author, creator, poster, or source; or
> (h) the recommendation, prioritization, or selection is necessary to comply with the provisions of this article and any regulations promulgated pursuant to this article.
You can also thank big tech for this because they'll do anything to not verify age on their platforms they want to push it onto devices and OSes.
Also how is that fine going to work if you don't have any children?
Self-declaration means that the system asks the user to declare if they are a minor. Nothing is verified.
Age verification typically means a system which checks ID or has other enforcement measures to try to verify age.
I think now even the last person realises that this has nothing to do with age "verification". They simply hate us for our freedom. And it is clearly a move coordinated by private business here; their lobbyists are acting. This is also why it is the same law essentially in so many different countries at the same time. It is quite fascinating to watch, actually. People used to say "conspiracy nut!" - well, the facts are too clear now. That's no longer a conspiracy.
Requiring my kids' devices to advertise their age (or their age "bucket", as if that was a meaningful difference) to protect them is not doing me or my kids any favors.
The point is monitoring everyone, age verification requires you to share who you are.
If this age verification stuff ever becomes plausible we always have the option of distributing actual Linux ISOs over bittorrent. Failing that, source code in RAR'd archives distributed across IPFS nodes and Tor. I feel like many of us would welcome the challenge if it were under better circumstances.
It is more reliable than most other archives in my experience though I prefer ZIP for general compatibility. Compressed TAR is not great for random access though I think you can create indexed tarballs which helps.
Like, I can imagine a browser exposing an API that says "wantsAlgorithmicFeeds: boolean", and websites would be required to respect that setting. In theory, anyone can toggle that setting, so the website doesn't know if the user is under 18 or not. But if in practice the vast majority of people with "wantsAlgorithmicFeeds: false" are children, then websites can use that API as a good enough proxy for identifying information in the vast majority of cases. Moreover, the more of these specific APIs you add, the harder it gets to keep things anonymous — especially if different states have different requirements on age-restricted content, you'd end up being able to triangulate not just age brackets, but also potentially location as well.
I agree that age bucket still has the potential for exposing identifying information (e.g. if you can monitor a user as they move from one bucket to another, you can identify their date of birth), but it's harder, and it reduces the amount of side-information that can potentially get leaked.
That said, exposing the information in the other direction as well would be a good step because it would allow websites or apps to enable OS-level age restrictions without requiring that they also read the "age bucket" bit. It would be nice if "read a person's age bracket" were a permission that an app or website would need to request, rather than one that was given by default, and that could be coupled with the fully-privacy-preserving approach you describe, so that different applications with different requirements could mix-and-match.
All that said, I suspect it would be a lot easier to coordinate on good technical solutions like the one you're describing if the default reaction to anything that even smells like age restriction wasn't the sort of abject horror and moral panic that is so clear in this thread. Like, sure, age verification at any level has all sorts of issues. But that isn't the only possible solution to the problem here, and if technical people react to these proposals by pretending the problem doesn't even exist in the first place, then we're never going to find those better solutions.
Most parents can't be bothered, especially if they are non-technical and intimidated by settings. And so they give their kids unrestricted devices. I think I read the average first exposure to pornography is now age 7. I'm speaking from experience as many parents I've talked to have thrown up their hands because they can't keep their elementary aged kid from using the ipad all night, despite there being an extremely easy screen time fix for that very problem.
I am technical enough to understand how to do all this, but even then I encounter many bugs in the parental controls, for example one kid is able to use Safari despite my blocking, even though they are on an identical device to another child who is successfully blocked.
There are infinite content sources now, and it's not possible to manage them all 1-by-1.
All that being said, broadcasting device user age should be completely opt-in for those who want it, and not mandated for every customer.
Why not just signal age ranges? Simple, the way the legal system works is one puts in a benign sounding law, then tweak it every year since the mechanism exists. (scope creep) "Now add city, state", "Now add DOB and address", "Now add your federal wallet ID."
- For small children set an RTA header (previous discussions) [1] for any URL that may potentially contain content not appropriate for small children. Give site operators 1 year to implement this. Not counting QA and change control this takes minutes.
- Require app and device vendors to create a properly sand-boxed child account. Pen test it but it does not have to be perfect. This is for small children and default installed applications. If the child visits a URL that contains the RTA header then trigger parental controls. It is entirely up to the parent when that child is ready for mature content. It must be impossible for the child to install any applications, addons, etc... There are a myriad of ways to accomplish this.
- How is this enforced? Same way as any other parenting issue. If there is an incident that involves law enforcement, then social services can investigate and determine if negligence was occurring. When the child is mentally mature enough to deal with all the crap that is the internet their account is converted to an adult account. If the parent is giving the child an adult account before they are ready then the parent(s) go to mandatory parental training. If the child was being bullied or groomed, redirect law enforcement to go after the bullies or groomers.
- Set the laws to be active for any small child that would be under 13 as of the year 2034. Presto! One need not try to confine teens. When these small children are teens they will either be used to the sandbox account or the parent may have converted the account to adult.
As a side note all public and private schools should be legislated to have classes on dealing with all the crap the internet has to offer. Bullies, Cry-bullies, Trolls, Groomers, Scammers, Devious companies, Astroturfers, Gas Lighters, Propagandists, NGO's and so on. Also teach and help them build friend networks so there is protection in numbers. No child should be friendless.
[1] - https://nochan.net/b/Internet-Crap/20230829-Think-Of-The-Chi...