@osma
Age Verification needs NOTHING the laws enacted mandates (device to person binding).
1.1 Each time user logs in to a trusted institution like bank or insurer site (an ADC), it upon succesful login emits the "ag header" which tells the "realm access level" of the logged-in person as inferred from their date of birth and country of jurisdiction in accordance with local laws.
ag: 0 ; "none"
ag: 1 ; "any"
ag: 2 ; "trimmed"
No user action is needed. Attesting happens every time they log-in to their bank, insurer, or e-gov site for this site main services. The "curated" access level "3", or higher is meant to be set by preschool kid's parent (ag:1) to let sites curate content served.
1.2. If device's "keyring" is not locked in its state and the server certificate was checked to have ADC policy set, then browser can ask OS on the device to set the Ag-Flag bit for the user to the value as received in the "ag" header.
1.3. OS checks whether browser or an ADC proprietary App has a privilege to do so. If trusted, the Ag-Flag sets to the "keyring" accordingly.
1.4 From now on any other application on this device, at the user permission, can read the Ag-Flag state then pass it to the other side of the connection.
[...]
Stop the EU overreach in our devices!
@zackwhittaker
@Gargron
@rysiek