Irenes (many)Feb 28
there's so many bills in so many jurisdictions, we hadn't realized California actually managed to pass the age verification in the OS thing :(
Show threadJeffrey Yasskin

@ireneista My impression, and I think @npdoty 's, is that the California law makes OSes *ask* their owner for the user's age, in order to pass it on to apps. It doesn't make them verify that age, so it facilitates parents working with websites to give their kid an appropriate experience. If a kid is more mature than their age implies, or websites are hiding age-appropriate information, the device owner can say a different age. Seems in line with https://www.w3.org/TR/privacy-principles/#guardians. Much better than the jurisdictions that are requiring sites to verify with private-info uploads.

I could be missing something, of course.

Privacy Principles

Privacy is an essential part of the web. This document provides definitions for privacy and related concepts that are applicable worldwide as well as a set of privacy principles that should guide the development of the web as a trustworthy platform. People using the web would benefit from a stronger relationship between technology and policy, and this document is written to work with both.

Feb 28 at 5:37pmWeb
Show threadIrenes (many)Feb 28
@jyasskin @npdoty interesting. yeah, we haven't actually read the bill yet, it's always important to do that.
Show threadNick DotyMar 2

@ireneista @jyasskin yeah the details of different bills and different approaches are significant, even though we might be concerned about the trend and its risks for privacy and free expression in all cases.

California will require operating systems to ask the user to select an age range. Texas requires app stores to confirm age (with an identity check or some other system) and then pass on the age range to apps. UK and Australia mandate that every service do its own identity or age check.

Show threadNick DotyMar 2
@ireneista @jyasskin voluntary, user-selected age-range signaling seems among the less harmful of approaches, in that it doesn't require or enable much additional data collection, and gives guardians some discretion in what they signal. We hear from both parents and teens that they want those choices, and that they're creeped out by the ID and biometric verification mechanisms.
Show threadIrenes (many)Mar 2
@npdoty @jyasskin we do anticipate the Heritage Foundation is going to fund lawsuits to push for the strongest possible interpretation of any law that does exist along these lines, as they have with SESTA/FOSTA, since it appears to be coming from the same ideological position. so we can't rely on it being interpreted by people who want to be reasonable.
Show threadNick DotyMar 2

@ireneista @jyasskin I think the more active fight, and the attention of many conservative activists, is pushing for laws with more invasive mandates. At the US federal level, for example, there's the Kid's Online Safety Act vs the Parents Over Platforms Act.

Some laws do have more openings for aggressive interpretation, and ambiguities that might lead to overcompliance. Texas and others refer to undefined "commercially reasonable" verification methods, for example.

Show threadIrenes (many)Mar 2
@npdoty @jyasskin yes, of course. we've been following all that to the best of our ability for some time now.
Show threadJeffrey YasskinMar 3
@npdoty @ireneista Reading https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043, I'm worried about 3 things:
1) '"Account holder” means an individual who is at least 18 years of age.', and the OS has to ask "the" account holder, but there's nothing about how the OS figures out its administrator's age. Presumably it'll be ok to assume that the person setting up a device bought the device, and only 18yos can buy things, even though that's strictly false?
2) The law talks about "the" user, so what about devices with multiple users? (probably minor?)
3) The law assumes that the OS will give apps a granular version of the single age specified for the user. But a good parental control app ought to let parents say "my kid is Xyo for this particular app". Is that allowed?
Bill Text - AB-1043 Age verification signals: software applications and online services.

AB 1043 Age verification signals: software applications and online services.