Colorado moves age checks from websites to operating systems | Biometric Update
www.biometricupdate.com
As Colorado lawmakers once again revisit online age verification, the debate is no longer about whether to protect children online.

Senate Bill 26-051 reflects that pattern. The bill does not directly regulate individual websites that publish adult or otherwise restricted content. Instead, it shifts responsibility to operating system providers and app distribution infrastructure.

Under the bill, an operating system provider would be required to collect a user’s date of birth or age information when an account is established. The provider would then generate an age bracket signal and make that signal available to developers through an application programming interface when an app is downloaded or accessed through a covered application store.

App developers, in turn, would be required to request and use that age bracket signal.

Rather than mandating that every website perform its own age verification check, the bill attempts to embed age attestation within the operating system account layer and have that classification flow through app store ecosystems.

The measure represents the latest iteration in a series of Colorado efforts that have struggled to balance child safety, privacy, feasibility and constitutional limits.

  • Snot Flickerman@lemmy.blahaj.zoneEnglish
    7·
    10 days ago

    1. How do they secure age data? Age is most likely two characters, with a max of three characters. If there are penalties for sharing the age data when they aren’t supposed to, how do they secure this? Even with cryptography a two character number with only 70-ish reasonable and expected variations is going to be difficult to secure.

    2. How do they ensure no one who is a different age ever uses the device? “Use mom’s iPad” is univseral. Does mom get in trouble for letting her child use her device, does the parent end up with the fine?

    However, if a developer has clear and convincing information that a user’s age is different than the age indicated by an age signal, the developer shall use that information as the primary indicator of the user’s age range.

    1. How do they determine age other than self-reporting with anything other than wholesale spying on user habits? What other way could they possibly glean “clear and convincing information that a user’s age is different than the age indicated by an age signal” other than spying on a user’s device use? This also implies remote-control of the OS if the operating system vendor can change the age-gate remotely based on user habits.
    • UnspecificGravity@piefed.socialEnglish
      3·
      10 days ago
      1. You don’t.
      2. Easy. The device constantly captures images of the user and checks them against the user image on file
      3. By scanning a government issued ID and checking against an online database with poor security.
    • baronvonj@piefed.socialEnglish
      1·
      10 days ago

      I feel like #1 and #2 are problems whether its client side or server side. As for #3 I would lean in the direction of there being a one-time check with no persistent knowledge. Like when you flash your ID to the bartender to order a drink. A client app that scans the ID and returns the answer to the requestor.

      But I don’t think there is any way to reliably implement this sort of thing. I think it should really just be left to parental control and monitoring.