The Death of Online Anonymity

Age verification is reshaping how people access the internet. An ever-growing patchwork of laws can now require government IDs, facial age estimation, or behavioral inference before you can enter digital spaces. Discord, app stores, social media platforms, and AI chatbots are all being pulled into these requirements. Almost always, these measures are enacted under the banner of protecting children. However, beneath that goal lies a set of hard questions about privacy, anonymity, security, and the line between what a private platform may choose to do and what a government may compel. John Coleman https://x.com/FreeSpeech_AI is a legislative counsel at the Foundation for Individual Rights and Expression https://www.fire.org/, or FIRE, where he focuses on artificial intelligence and free speech policy. In this episode, John joins Kevin Ball to discuss the different methods of age verification and their privacy implications, the long constitutional history of anonymous speech, how recent court decisions are reshaping what governments can require, the data breach and surveillance risks these mandates create, and what engineers and companies should keep in mind when they are asked to build these systems. Sponsorship inquiries: [email protected] mailto:[email protected] The post The Death of Online Anonymity https://softwareengineeringdaily.com/podcasts/the-death-of-online-anonymity/ appeared first on Software Engineering Daily https://softwareengineeringdaily.com.

• 0:00Speaker 00

  Age verification is reshaping how people access the internet. An ever-growing patchwork of laws can now require government IDs, facial age estimation, or behavioral inference before you can enter digital spaces. Discord, app stores, social media platforms, and AI chatbots are all being pulled into these requirements. Almost always, these measures are enacted under the banner of protecting children. However, beneath that goal lies a set of hard questions about privacy, anonymity, security, and the line between what a private platform may choose to do and what a government may compel. John Coleman is a legislative counsel at the Foundation for Individual Rights and Expression,

• 0:45Speaker 00

  or FIRE, where he focuses on artificial intelligence and free speech policy. In this episode, John joins Kevin Ball to discuss the different methods of age verification and their privacy implications. The long constitutional history of anonymous speech, how recent court decisions are reshaping what governments can require, the data breach and surveillance risks these mandates create, and what engineers and companies should keep in mind when they are asked to build these systems. Kevin Ball, or Kate Ball, is the vice president of Engineering at Mentos and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript Meetup,

• 1:28Speaker 00

  and organizes the AI Inaction Discussion Group through LateinSpace. Check out the show notes to follow Kate Ball on Twitter or LinkedIn, or visit his website, kball.llc.

• 1:50Speaker 01

  John, welcome to the show.

• 1:52Speaker 02

  Thanks for having me.

• 1:53Speaker 01

  Yeah, I'm excited to dig in with you. This is a different topic outside of my usual beat, but let's start with an introduction to you, and maybe a little bit about FIRE, and then what our topic is here.

• 2:04Speaker 02

  Absolutely. Well, my name, as you know, is John Coleman. I'm a legislative counsel with the Foundation for Individual Rights and Expression. That's a mouthful. We usually go by FIRE for short. Let me dive into our organization first. So we're a nonpartisan nonprofit that is dedicated to defending the free speech rights of all Americans. We've been around since 1999, primarily working on free speech issues on college campuses, defending students and faculty from overzealous college administrators or unconstitutional speech codes.

• 2:42Speaker 02

  But in the last few years, we've noticed a great need to expand our work to cover tech policy. I particularly work on artificial intelligence policy, specifically for FIRE. But as we'll see, there are a lot of cross-cutting issues when it comes to how you deal with social media, how you deal with AI, particularly with regard to age verification. In terms of my background, I am an attorney by practice. I specifically do legislative work. So what that means is I either will lobby state legislatures, meaning I have to go and register with the state or with Congress to talk to them about legislative issues.

• 3:26Speaker 02

  And that means writing letters, drafting legislation, trying to convince people, essentially, in legislatures, whether it's the elected official themselves or the staff, that FIRE's position is right and the First Amendment matters in whatever case that we're talking about.

• 3:45Speaker 01

  Yeah, that makes sense. Well, I think this question of age verification, that is, the instigation for getting on here, is something that a lot of folks in our audience have been running into in their day-to-day. There is this big thing about Discord starting to either use it or not use it in different domains and all this controversy. So let's maybe like lay the groundwork here. So from a legal perspective, how is age verification defined versus, I've seen other terms out there like age assurance, identity verification, like what are all these different things? And when are people actually required or allowed to use them?

• 4:23Speaker 02

  Yeah, well, I think it's probably best to start with the definitions, right? Because it can get very confusing with phrases like age assurance, age verification, and one that we use, identity verification. So let's start with age assurance, because it's really an umbrella term for a range of different methods, whether it's a simple age estimate or requiring government ID checks to figure out the age of somebody. And every method involves trade-offs between accuracy, privacy, convenience, and what FIRE is particularly interested in, the loss of anonymity.

• 5:04Speaker 02

  So perhaps it's a good idea just to dive into the four main approaches of age assurance. And just as a little bit of a disclaimer, you're talking to an attorney, FIRE does not endorse in any way any particular age assurance method. In fact, we're pretty wary of any method that requires someone to identify themselves, but also what we'll see is layer someone's online experience with all these various methods that can figure out not only how old they are, but potentially who they are. And so just purely for your audience and for you, I just wanted to go through these so that we have a good idea of what they are. The first is self-declaration.

• 5:48Speaker 02

  And it's essentially an honor system where a user is asked to confirm that they're over a certain age. So think of like going to the Corona Beer website that has a lot of advertisements. And the first thing that you see is this pop-up that says, "Are you over the age of 21?" And you can either click yes or no, relatively low threshold for figuring out someone's age. But in reality, we know that it's not really figuring out anybody's age.

• 6:18Speaker 01

  Oh, yeah. My teenage will just be like, "Yep, give me access, give me access," whatever it is.

• 6:22Speaker 02

  That's right. So it's a simple method. Some people argue that it's not even like age assurance or age verification. No personal information is required unless it's something like inputting your birth date. But if it's just a click box, very simple and somewhat privacy-friendly. Again, we're not suggesting that this is something the government should require. A lot of industries are already doing this, but it's one method out there. The second is age inference. And so this is where a platform estimates an age using existing account data or someone's behavior online.

• 7:03Speaker 02

  So it may rely on signals such as account history, payment methods, viewing habits, and social connections even. So think of someone buying something online or going onto Steam and using a credit card account. They're already going to have that information. And because only adults are usually issued a credit card, there's some inference that the person using the account, at least some of the times, is an adult. And so this has been explored and perhaps even used by some platforms such as Instagram and YouTube, particularly in the case of viewing things.

• 7:47Speaker 02

  Is the kid or is the person viewing Minecraft videos and nothing else? Or are they also looking at how to do your taxes or how to fix your muffler? Those kinds of searches can be used to figure out, maybe not your exact age, but a ballpark of where you're landing. Maybe with incredible metrics, you can put somebody in the 25 to 30 category. Or if they're concerned about retirement, you can go closer to 65. And I think there's enough data out there, this is me speculating, but there's probably enough data out there that you can get a high degree of accuracy here. The benefit from the perspective of someone implementing this

• 8:31Speaker 02

  or trying to comply with laws that require something like this is that users don't really need to submit an ID. The drawback is that it requires analysis of user data. And so that raises some significant privacy concerns when there's something operating in the background, constantly tracking your actions because the government requires it. And it creates a potential for scaffolding, for a surveillance state, really. If a law is requiring inference and it has to go through this process of scanning everybody's data, there's a high likelihood that that could be used later for something else.

• 9:14Speaker 02

  And the fact that that structure is there is...

• 9:17Speaker 01

  Well, and honestly, like as someone who's been in the tech industry for a long time, I sort of assume that structure is there. The question is who has access to it and how is it shared? And is it in one place where somebody can just go? Or do they have to have distributed lookups? Like, Google knows everything about me from what I can tell.

• 9:34Speaker 02

  They do. Yeah. And that's the business that they've built and they've been very good at what they do. So they have all this access. What makes it a little bit more creepy in my mind is if the government requires these types of methods and then now puts it inside of a compliance or regulatory structure where they're going to have either more access or more questions about how this operates.

• 10:01Speaker 01

  Yes, absolutely. And I feel like Google in particular has been pretty good about pushing back against the government. But if this is something going to all sorts of different companies and they have to do that, you only need one or two who are not good at pushing back.

• 10:12Speaker 02

  That's right. That's right. Or in the case of this being offloaded to third parties to handle.

• 10:18Speaker 01

  Yeah.

• 10:19Speaker 02

  The federal government might not even need to deal with the big players if they have these smaller contracts, whether they're required or incentivized, who knows? But there are plenty of avenues by which we could see mischief, for sure.

• 10:36Speaker 01

  Well, and not to derail us too much, but it also feels pretty error prone. I mean, we're now on a family plan, but before that, my Spotify wrapped had stuff from my little kids and me and my wife and all sorts of other different things. I was like, you have a very mixed idea of who I am.

• 10:52Speaker 02

  That's right. That's right. And the approach that we're seeing now, particularly with legislation, is that no one method is being relied upon, particularly with the fact that we're going to see these kinds of methods come at various points of contact in someone's online experience, from purchasing a device, for example, or going to an app store, to using an app, to using a feature in an app. And then on top of that, if you're underage, you have to get parental consent in some cases. So now the parent has to go through identity verification potentially. And this is just age estimation and self declaration that the

• 11:36Speaker 02

  third, oh, I should go back. I described the inference method, but there's a third method before I get to age verification that it's worth

• 11:44Speaker 01

  Yeah, yeah, yeah.

• 11:45Speaker 02

  a short discussion of. And this is where it's called age estimation as the general blanket term. But one of the more popular versions of this is facial estimation. As I understand it, it's different from facial recognition technology that matches two photos together to see if you are a person that is already known. But rather, this uses an algorithm to map your facial features and estimate your age based on it. Again, there is some data collection there with using an algorithm and then processing that data to come to some determination. And this is already being rolled out in multiple countries,

• 12:27Speaker 02

  as I understand it. The obvious benefit, again, on the scale of bad to worse, is that you still don't need a government ID to do this, right? You're just scanning someone's face. People can make the argument

• 12:40Speaker 01

  You don't have to store that information about them, right? You could

• 12:43Speaker 02

  In theory, right.

• 12:44Speaker 01

  In practice, you're getting quite a bit of info about me if you're looking at me.

• 12:48Speaker 02

  I think most state laws in the United States require deletion or some sort of tailored approach to data collection and storage. But as we know, that could be far removed from reality when it comes to how these systems operate and what's permitted and what's not. And also, how do states know that the laws are being enforced if all of the data is being deleted? So there's some trouble in the going to these laws and how they're enforced. So, yeah, no government ID with age estimation. But again, relying on biometric data, and that could produce inaccurate results, right? If you haven't heard the stories already,

• 13:29Speaker 02

  I think it just came out like within the last few weeks that kids were drawing mustaches on their faces to look older, and that was bypassing some of these systems. So I'm sure this is going to be a particular cat and mouse game with government regulators and kids who are very good. I've got two young kids myself, two kids that

• 13:52Speaker 01

  They will find ways around, for sure.

• 13:54Speaker 02

  Know how to work the system. That's right.

• 13:57Speaker 01

  Yeah.

• 13:57Speaker 02

  That's right. They do. So just to quickly go through these, the last one is age verification. And this is exactly what it sounds like. Users prove their age using a driver's license or a passport or some other government issued ID. And it's generally the most accurate. If your goal is to verify someone's age, you know that this government issued ID has gone through a process to make sure and verify that that's accurate. But if you have a driver's license, if you have a passport, you know that it doesn't just contain your age. It also has a ton of other information. So all that other information, like your name, your

• 14:39Speaker 02

  address, whether you're an organ donor in some states, all this information is captured when they either scan or require you to show your ID online. And so that's a lot of identifying information just to prove your age. And we describe this as the papers please approach because users must present documentation before accessing a service. We think that is particularly onerous among all of these methods.

• 15:09Speaker 01

  Yeah, absolutely. Well, and I think that's a useful metaphor because it's very easy to get in the sort of frog in boiling water approach of like, oh, yeah, I'm used to trading off privacy for convenience in different ways and what have you. But if you imagine the types of countries and states where you've had to present your papers regularly, just meandering through public services or things like that, like, that's not a country we want to live in.

• 15:34Speaker 02

  No, no. And that's certainly what it's looking like. If we're going to compare everyone's physical experience with the online experience, which I think both sides often do, say, hey, why don't we match what people's daily life looks like with online life?

• 15:53Speaker 01

  Well, I think that's worth really digging into, right? Because it gets into one of the core distinctions here between public and private, right? And maybe we can go back a little bit to the legal setting here, right? Like, we have a longstanding belief that government is limited in various ways and what they can ask of us and what they are allowed to require of us. So I think there's maybe a constitutional basis we could talk about here of like, what can the government ask us to do? What are they not supposed to? And how are we running into those barriers here?

• 16:25Speaker 02

  Yeah. So I think this is a good spot to drop my understanding of the First Amendment. I'm a First Amendment expert. This is what I work on every day here at FIRE. And so I want to start with the language of the Constitution, of the First Amendment itself. It states that Congress shall make no law abridging the freedom of speech. What does that mean? We know that it just doesn't apply to Congress anymore. And we know that it just doesn't apply to laws. So the Supreme Court has interpreted this free speech clause of the First Amendment to cover any state action, whether it's the federal government, the state government, or a local government. And it covers not just laws, but also regulations

• 17:08Speaker 02

  and individual actions by government officials. On top of that, free speech isn't limited to just you and me speaking in the public square. It covers all sorts of expression, from wearing an armband in protests of the Vietnam War, to scheduling a parade in a downtown city. And there are plenty other areas, including online, where the Supreme Court has found that people have expressive rights, including social media. So, starting with that basis, we know that the First Amendment applies in all sorts of contexts, and particularly

• 17:49Speaker 02

  with government interference. Also, on top of that, people have certain rights with regard to what the government can and can't do. And one of those is the right to remain anonymous. That comes up quite a bit when we're talking about what happens when people must identify themselves to access otherwise lawful content online, right? So anonymous speech has a very long history in the United States. If you go back to the Federalist Papers, for example, written by James Madison, Alexander Hamilton, and a few by John Jay, all of those were

• 18:31Speaker 02

  written under a pseudonym. So imagine if Alexander Hamilton had to submit a government ID in order to post his Federalist Papers online or for other people to view them. Again, making this comparison with the physical world, that doesn't sound so great, particularly if you're trying to convince people that we need a new type of government, right?

• 18:52Speaker 01

  Yeah, I think this is really important, right? Because you'll hear arguments saying, hey, we shouldn't have pseudonymous social media accounts. Everything should be attached to the person. And that creates this insidious structure where no one can go against the popular norms without suffering tremendous consequences. And so, yeah, historically, like, we've said as a society, our society started by saying, hey, we should be able to call things out when they're not good. And we should be able to do that in a way that is safe for us.

• 19:24Speaker 02

  There are all sorts of very good reasons why someone wants to access information anonymously. I think what's often trotted out is that this only protects child sex predators. The Federalist Papers is a really great example in history, but we can think of plenty of other circumstances where anonymous speech is absolutely crucial for someone finding information or connecting with other people online. Think of political dissidents who don't want to be tracked. Think of whistleblowers, whether in the government or in the private space. Also, abuse victims seeking help, whether they're minors or adults, with these

• 20:07Speaker 02

  kinds of age assurance methods in place, that's going to greatly reduce the amount of people willing to put up their ID or in any way reveal themselves and be able to access much needed information that the internet provides.

• 20:25Speaker 01

  Your customer lives in the real world and it's messy. Intermittent connections, mid-onboarding drop-offs, edge cases on devices you've never tested. Mobile apps reflect reality in a way no other surface does. Yet, from an engineering perspective, they're the hardest to understand. It's common for mobile engineers to see green backend dashboards, normal error rates, no crashes, but inevitably, somewhere, there's a frustrated user watching your app spin. After a few seconds, they'll lose patience, close the app, and turn their attention somewhere else. They may never come back. The worst part? Most observability tools never see any of it. Bitdrift, on the other hand, captures 100% of mobile data, unsampled and in real time, so it's immediately queryable by engineers and AI agents.

• 21:08Speaker 01

  It's mobile observability built for the real world. Try Bitdrift today. Bitdrift.io/signup. If you're running Postgres in production, you've probably felt the moment analytical queries start fighting your transactional workload. Most teams end up adding a second database and all the pipeline complexity that comes with it. Tiger Data, creators of Timescale DB, takes a different approach. We extend Postgres with hybrid row and columnar storage, so one table handles both writes and analytical scans. Native compression cuts storage costs up to 95%. Continuous aggregates keep dashboards live without bash jobs. And it scales to petabytes without urear architecting. Companies like Cloudflare, Octave Energy, Schneider, Axpo, and Flowco run production workloads on Tiger Data today.

• 21:50Speaker 01

  No stale data, no second system to operate, just Postgres. Managed for you, ready for the workload you're building toward. Try it free at tigerdata.com.

• 21:59Speaker 00

  Think about your mobile app's source code. Once it hits the App Store, it's out in the wild. And without the right protection, decompiling is easy for malicious actors looking to steal your IP or tamper with your software. That's where GuardSquare comes in. GuardSquare provides the highest level of mobile app security for Android and iOS applications and SDKs. Their advanced tools integrate seamlessly into your CI/CD pipeline. We're talking polymorphic, multi-layered code-hardening techniques and automated runtime application self-protection, paired with mobile application security testing and real-time threat monitoring, to deliver the highest level of mobile app security without compromise. Don't leave your hard work exposed.

• 22:44Speaker 00

  Secure your mobile applications today. Go to guardsquare.com to learn more.

• 22:51Speaker 01

  So let's talk a little bit about the current state of play. What's going on right now? I have this uninformed opinion observation that it feels like we're getting a lot more pressure right now from the government to impose these oversight draconian-style things. But what exactly is happening at the different, like, federal and state-level things?

• 23:12Speaker 02

  So, we've seen the fight on age verification play out in the past few years. Several states are introducing measures. I alluded to this before. They're taking a multi-layer approach to instituting age verification. So some are coming in at the App Store level. Some are coming in to regulate access to social media, in some cases, social media features. Others are what are known as obscenity-to-minors statutes that target a particular kind of content. And we're seeing courts now deal with all of these different types of laws.

• 23:54Speaker 02

  For the most part, district courts, so federal district courts, the lowest court in the federal system, has been pretty favorable to the First Amendment argument that anonymous speech is a right and it's worthy of protection. And they're wary of laws that are going after people's access to social media. On the other hand, you have a Supreme Court case that came down last year that kind of redefined this whole space in terms of what kind of scrutiny the court is willing to apply to these types of cases, but also creating an avenue for more regulation of social media content.

• 24:39Speaker 02

  So, let me back up for a moment and say, one of the biggest mistakes in this debate is treating social media laws like obscenity-to-minors laws. They're not interchangeable. I think lawmakers often talk about them using the same language, right? That we want to protect children online. We want to protect them from online harms. But constitutionally, those two categories are very different. So if you're trying to understand where these cases are heading, again, on the one end, these obscenity-to-minors laws, which I'll get into, and social media laws, we need to keep a very clear understanding of what the distinction is.

• 25:19Speaker 02

  So, the first thing to understand is that age verification for obscenity-to-minors is not the same constitutional question. So, adult content age verification laws are also known as obscenity-to-minors laws. We think of pornography, for example. But these laws are so broadly drafted that they could include other things under the test for obscenity that regulate material that adults have a constitutional right to access, but minors do not. So, last year, as I alluded to, the Supreme Court upheld a law in Texas that provided

• 26:02Speaker 02

  one of these statutes that says, "We can restrict certain access for minors to," I'll just say pornography here, that's probably clearer for listeners. I use the obscenity-to-minors term because it's more precise, and I want to make it clear that-

• 26:17Speaker 01

  It includes more things, but the most common example would be pornography, so we can use that as a stand-in for now.

• 26:23Speaker 02

  Absolutely, yes. So, Texas's pornography law restricted access for minors and required age verification. The Supreme Court, in this case, recognized that requiring adults to verify their age placed some burden on adults, right? But they concluded that the burden was a byproduct of making sure minors can't access this material and that the government may constitutionally restrict it. So, we actually disagreed with the outcome of this case, and we found the dissenting opinions much more persuasive. The dissent, so some justices did not agree with the court's position, just to be clear here, and they wrote their own opinions, and they argued that the law should have faced

• 27:08Speaker 02

  a much higher judicial scrutiny. And a central concern was that age verification can become identity verification, where you are going to be providing information that will reveal who you are.

• 27:20Speaker 01

  Right. So, what I'm hearing is essentially, this law, which nominally is here to prevent minors from accessing pornography, becomes a tracking infrastructure to be able to track exactly who is looking at what pornography.

• 27:33Speaker 02

  That's the fear. I mean, and that's the discomfort for adults, is if they have to identify themselves before accessing this material, some of them are going to avoid it altogether. And we're talking about constitutionally-protected speech for adults. So now you have a burden on that right to access information.

• 27:50Speaker 01

  That might be worth, now, stepping back from the over-generalization we did in calling this pornography, because I think it's easy to say, "Oh yeah, why should pornography be constitutionally-protected? You don't actually need that, right? That type of thing." But this is a little broader than that. This includes all sorts of gray types of writing, and maybe, I don't know, does it include erotica? Does it include certain types of political speech dressed up as satire? Like, there's a bunch of different things I could imagine this applying to.

• 28:17Speaker 02

  It's very broad. And we know that it only applies to this particular type of content. Again, this obscenity-to-minors standard, which borrows from obscenity law, but it could include anything that could fall under this standard. So, again, like, the three, just like, basic prongs are, would an average person applying contemporary community standards? This work appeals to a shameful or morbid interest in sex. So that's the first problem. Like, are we talking movies? Are we talking, yeah, as you said, general erotica, but also just the things that we watch every day? There was actually a footnote in this decision that seemed to say that a lot of this, like,

• 29:02Speaker 02

  more mainstream-type material would be carved out. But it kind of renders the decision a little bit vague in a sense that you won't know exactly what the court is going to, or what Texas, this law was in Texas, what Texas is going to do with this. Are they going to enforce it against just pornography? Or, you know, are there other things that could fall under this obscenity statute? So, the other two prongs, just so we finish it off, is, is it patently offensive? And does it lack some serious literary, artistic, political, or scientific value? Again, these are all judgments that are going to be made by a prosecutor, and we've seen arguments throughout history brought out to go after books, movies, comic books, you name it.

• 29:46Speaker 02

  There's been plenty of the arguments that have been made to put content under a rubric where the government can regulate it.

• 29:54Speaker 01

  Well, and this maybe gets to, you know, there was this recent example of Discord, right? And Discord has servers that have obscenity in them. Discord has servers that are purely gaming content. Discord has a bunch of tech-related servers. And the lines are not so sharp, because people are people, and they talk about all sorts of things and share all sorts of things. So, when we start talking about platforms, like, technology platforms, like, how does this start to play in there? And what are the boundaries?

• 30:25Speaker 02

  Yeah. So, with this decision, you saw the dam break wide open. Now people are saying, "Hey, this now rationalizes new laws, new enforcement methods to go after not just obscenity as to minors, but social media and other communication platforms in general." And that's what we're seeing now. So, the key constitutional difference is that pornography or obscenity as to minors is a category of content, whereas Discord and social media platforms, for example, are platforms for communication.

• 31:05Speaker 02

  They're two very drastically different things, and to treat them the same raises a lot of problems. So, I think one of the best analogies here is to go with the court's rationale in last year's decision. And the case name, by the way, is Free Speech Coalition v. Paxton, if anybody's interested in looking it up or reading-

• 31:28Speaker 01

  Oh, Paxton. Man. Wish he'd get out of the news.

• 31:33Speaker 02

  No, I know. I know. And in fact, he is the one that is trying to enforce some other law against Discord right now, again, in the name of protecting children.

• 31:44Speaker 01

  So, any software engineers voting in the Texas Senate race, bear that in mind.

• 31:50Speaker 02

  So the rationale, or at least the analogy that they used in the FSC decision was, oh, checking someone's ID to access pornography is like checking someone's ID at a gas station to buy a nude magazine behind the counter. Right? So a kid walks in and provides interest in the magazine rack behind the clerk and the clerk kind of eyes it. Maybe he's doing some, you know, analog facial estimation is like, oh, it doesn't look quite old enough. So, you know, he can go and ask the kid, let me see some ID.

• 32:30Speaker 02

  And that's the analogy that Justice Thomas, who drafted the FSC decision borrowed from was that we have some of these kinds of checks in the real world that we can borrow for online. Again, we disagree with that position. And we think that the obscenity as the minors is covering much more than just, you know, a kid walking in to a gas station. But now compare that to a clerk at a bookstore checking everybody's ID to go even view the books.

• 33:05Speaker 01

  Yeah, no, absolutely. And even without that, right? Like that clerk is not remembering all the details on this ID. That clerk is eyeballing me and I, the gray hairs on my head lead to me, I no longer get carded. So he has no view of my identity, right? Like there's all sorts of different limitations that apply in the physical space and judgment that applies in the physical space that is not happening online.

• 33:28Speaker 02

  Oh, absolutely. And particularly with, as AI gets rolled out, we're going to have an internet with a memory stronger than we've ever had it before.

• 33:36Speaker 01

  We already have one. I mean, if I'm blunt, the people who I know who worked at Google are the most paranoid about anything they ever do being online. Because it's already there.

• 33:47Speaker 02

  Good to know. So, yeah, it's so it's, so there is this disconnect between the physical world and the online space in terms of checking someone's ID and the implications of that. Even if, you know, we were to buy into the fact that checking an ID at a bookstore is somehow okay, it's totally not. But if it's okay, again, to your point, the clerk is not going to have infinite memory to know who you are in all contexts. Online, they're always going to know. They're always going to have all these various methods. And what that means is you're going to be much more easily identified.

• 34:28Speaker 02

  Or you're going to think you are, and you're going to have greater discomfort to go and look at things that you want to look at or interact with people or join communities. Merely by the virtue that the government is putting in place, these layered ways of figuring out not only your age, but incidentally, or actually who you are. And that's, that's something that people have rightfully concerns about giving up to access information.

• 34:59Speaker 01

  So I think if we think about the folks who are listening to this, or I think about myself, right? Like, I don't feel like I have that much influence over what's happening legally. But I might get asked to implement something like this inside of a company. I might be asked to do this. So if somebody's like, oh, my company's talking about implementing age verification. What can I push back on? What are the angles that I can take to say like, hey, we don't actually need to do this? Here's our avenue out.

• 35:29Speaker 02

  Yeah, that's a really good question because it gets at this idea of private companies dealing with a perception that the internet is dangerous. And don't get me wrong, there are parts of the internet that are very dangerous. We can't deny that. But these laws are so overbroad that they would restrict anybody from going online without identifying themselves or eventually getting to a point where you have enough information about them that you're effectively identifying them. The thing is, FIRE's position is that private companies can actually institute these measures on their own. We're not fundamentally opposed to private platforms creating communities that they want to have.

• 36:15Speaker 02

  Whether that's through the type of content they want to share or who they want on their platform. The key problem is when government mandates this, it is now a one size fits all internet. Because every platform has to conform to these requirements. So the pushback on the idea that we're putting in baby gates for the internet, it's kind of true. If every platform has to cater to these particular kinds of requirements, you're not going to have the intellectual diversity or even the diversity of design that makes the internet what it is.

• 37:01Speaker 02

  And so this raises a question about who should be responsible. Should the platforms be responsible for their design elements? Absolutely. Should they, like an artist, be responsible for how viewers interact with it? It seems less so, right? That that responsibility exists somewhere else. And that's the position that particularly I personally take with this idea. So we're not opposed. Again, if you're bringing this back to the company, it should be more of a question of design. Why does your platform, what is your software doing? How is it interacting with people? Who do you want on your platform? Those are all absolutely valid conversations that you all should have.

• 37:45Speaker 02

  The problem is, is when government comes in and says, no, no, no, we're flattening everything. All must be the same.

• 37:52Speaker 01

  Now, that makes sense. I also like the technologist in me is like, is there a technological solution here? And where I go with that is increasingly for things like passwords and that type of thing, we're moving to a world where you know, there's an exchange of information or actually even a better, maybe a more familiar example, like something like Apple Pay. It used to be everywhere I would go to pay, I would distribute my credit card number. And I was trusting that those people charging me were going to be good actors, cautious, not, you know, charging other things to this. And there were checks and balances, right? I could go and dispute charges and what have you. But with something like Apple Pay, I only have to trust Apple. And they distribute a one-time use token that allows someone to charge.

• 38:37Speaker 01

  And I could imagine something similar that is a local verification. You have one trusted entity that maybe is offline or some other thing where you, you trust one provider to say, oh, this is some key information about me, my age, or whatever it is that actually needs to be verified. They can assert that and then share only the assertion of yes, this person meets your needs or not, but not having this data going everywhere on the internet.

• 39:03Speaker 02

  Certainly, yes. And the risks of that are certainly not theoretical, right? We've, not to beat up on Discord too much, but one strong example of what these systems end up doing is making the companies much more vulnerable to privacy concerns and data breaches, right? You can look to Australia as an example. Australia instituted a age ban for social media under 16, instituted very strong age verification requirements. Discord used a third party to comply with the law and to process age verification.

• 39:46Speaker 02

  And it resulted in 70,000, this is all reported, right? 70,000 IDs or photos of people being leaked out into the, to the universe for anyone to see or have or use. That's going to become much more common, I think, if we're moving towards a pay-per-plays internet, but also using all these various methods. We, we kind of talked about this before, that we're going to have multiple parties involved, whether it's third parties doing these or an app store level. You know, to your point, Apple might have a very good way of doing this. The problem is, is if the government comes in and mandates that, what does that look like for

• 40:31Speaker 02

  other platforms that aren't using Apple? It's going to have to be this system that the government gets really deep into the weeds on. And we're going to have these layers of checks with a system or with IDs or

• 40:47Speaker 01

  Yeah, yeah.

• 40:48Speaker 02

  estimation.

• 40:49Speaker 01

  It reminds me, I mean, to use the financial analogy again, right? When the internet started, there were no guardrails and people were put, once we started doing payments and things like that, like there were all these security things and cards being leaked and whatever. And then, so we added layers of requirements and compliance and other different things. And adds all this requirement, if you're handing financial data and then things centralized. And so we got to a place that was much higher burden. And then it centralized into a few companies dealing with that and everyone working with those companies. Now, in the financial case, we kind of need that. We need to be able to transact things online. Here, we're talking about something where we're instituting these requirements that are not only probably not required, they may well be unconstitutional.

• 41:33Speaker 01

  And we're going to put all these layers of burden and security risk on ourselves for that.

• 41:37Speaker 02

  And to distinguish this from the financial sector, we're talking about speech. We're talking about content generated online, whether it's Discord that provides this live experience more often than not. I know that they also has, you know, what's akin to a social media type scrolling effect in individual chat rooms and elsewhere. But on the most popular social media channels are just people talking. There are people communicating their ideas, their thoughts. There's communities that form. And so what we're really talking about is not something like a product, but an expressive

• 42:19Speaker 02

  experience that people are joining and communicating with each other about.

• 42:25Speaker 01

  So we talked a little bit about, you know, what are the possibilities for an individual in a company or things like that? What about in terms of getting involved with legislative, regulatory, et cetera proceedings? Like, what can someone who hears this and says, like, that sucks? I want to do something about that. What can you actually do?

• 42:44Speaker 02

  I'd say if you had to do something is to pay attention. There's so much happening right now at the state and federal level. For example, just this week, a bill dropped called the Kids Act that would effectively require age verification across multiple platforms. And for the software space, this might be really important because if you're working on AI, you now have these certain disclosures that are required. If it's a chatbot, there's social media requirements, there's even video game requirements in this bill, all of them predicated on figuring out someone's age. Now, the standard that they use is if you know their age.

• 43:28Speaker 02

  But we also know that companies are already collecting this information or knowing this information already. We've heard multiple platforms roll out age verification, often because of government pressure. So to go back to that question, pay attention, pay attention to what your legislators, what your elected officials are doing.

• 43:47Speaker 01

  Well, and let them know, right? Like, let them know, hey, this is not okay with me.

• 43:51Speaker 02

  Sure, absolutely. Right? That's part of our system of government. We're a self-governing society. That's why the First Amendment is so important is because we must be able to communicate our ideas to the people representing us in government. So absolutely, if you feel called to talk about these bills with legislators, to talk to your communities, get out there and do so, absolutely. On top of that, you can also keep track of how cases are going. Just get more involved in this space by keeping an eye out for which prosecutors are bringing cases, what they're saying in them, how that affects you. Because there's going to be this huge compliance regime that's going to be rolled out if all

• 44:36Speaker 02

  of this is somehow considered constitutional. I don't think that it will. I think we're going to go through a long, drawn out process where we're going to have multiple courts deciding yes or no, this is constitutional and it's going to go through appeal, it's going to go up to the Supreme Court, some things will come back down. It's going to be more than, I think, a decade before we find out.

• 44:59Speaker 01

  Let's kind of spell out that process, actually. Because like, I think for you being in this space, like, that, you know what that looks like, but I think it's not always obvious. Like, when a law is passed, say at a state level or something like that, that's not the end of the road, right? There's all of these different layers. So what actually happens, say, law is passed, challenged in court, what do I as a company need to do there? Or what do I as an employee who's being asked to implement age verification and I'm paying attention, so I know this thing is being challenged? Like, what are my options? What does this sort of time course of a decade look like?

• 45:33Speaker 02

  That's a great question. And the lawyer in me has to say, go talk to your attorney. Go talk to your attorney.

• 45:41Speaker 01

  Okay, so knowing enough to say, like, hey, this is in contention, so I can talk to my attorney and ask where my levers are, that's something.

• 45:48Speaker 02

  And I know not every software developer, particularly startups, often don't have a legal team on hand to handle those types of things. So there's a real struggle there. That's why paying attention really matters, not just, you know, for any advocacy that you want to do, but also for the compliance reasons that are coming down. And that's something that we're trying to fire as filed cases, fighting against age verification. And, you know, we're always looking for startups or any groups out there that are coming into, are having concerns with age verification. So also reaching out to organizations is a really good way to feel connected and get the information that you need. There are compliance organizations, but there's also advocacy organizations that stay on

• 46:33Speaker 02

  top of, of these issues and help people navigate it, particularly on the First Amendment front. FIRE has been doing this for a number of years now. So on top of advocacy, on top of compliance, you know, where compliance needs an attorney, obviously, go talk to one. But adjacent to the advocacy, go talk to organizations, call FIRE, let us know your problems.

• 46:58Speaker 01

  Yeah, no, that makes sense. Okay, so we're getting kind of close to the end of our time here. Is there anything we haven't talked about that you think would be important for us to discuss?

• 47:08Speaker 02

  You know, how can these laws go horribly wrong is something that we touched on a little bit, but not as like a topic in and of itself. And age assurance has weaknesses from age verification that we've clearly talked about, where there's identity verification involved. So none of these processes, no matter how well this technology advances, is ever going to be perfect. And I think that's something important to keep in mind, that kids are always going to play a cat and mouse game with the technologies out there trying to prevent them from accessing content. People lie about their age. So when it comes to self-declaration, people are lying about their age all the time.

• 47:52Speaker 02

  Age estimation systems make mistakes. I have the baby face, so I can look like I'm probably 20-something, but I'm 41, so.

• 48:03Speaker 01

  I was so proud when I went to buy a drink at a concert and they, they told me they didn't need my card. Like, they were carding everybody coming up and then they're like, no, we don't need yours. And I'm like, okay, so now I'm officially crossed into the looking old.

• 48:16Speaker 02

  Hey, you know what? That's great. I still get carded for everything and then people are so surprised when they look at my birthday. So these technologies, if they're getting fooled by kids drawing mustaches on their face, even if they overcome that, that struggle, there's still going to be problems in the future. But if all of these are acceptable means for the government to implement, we're going to have a host of problems with their accuracy and the fact that they're required, right? That we have to live in a world where we're having these imperfect checks that are either going to wrongfully prevent you from accessing information or are easily being bypassed.

• 48:59Speaker 02

  So the actual effectiveness of these laws come into question. And so the added layers is the approach lawmakers want to take here to help combat that. But the end result is going to be, again, this internet where we have multiple age checks depending on what you're doing. There's just going to be a problem with complexity, the cost of implementing these, the friction that it has with your user base, right? That people just simply aren't going to want to do these. And again, that data collection component that people are just going to be concerned about.

• 49:32Speaker 01

  Yeah, I mean, I think, as you highlight, bureaucracies in general, and our legal system in particular, have a tendency towards accretive, right? They like, just like to add things and add things and you have a problem, you add things. It's far harder to remove things. And so there's a lot of value in just pushing back against that accretion of burden, even if we thought there was a way to implement these in a way that was constitutionally valid and all these things. It's going to be a lot of overhead for dubious value.

• 50:01Speaker 02

  Yeah, exactly. Especially because if ID verification is raising so many constitutional problems, ultimately going to these other methods, that might eventually lead you later to having some form of ID verification is still going to have, be problematic. So let me break that down just for a moment. So imagine that you're a 16-year-old kid that wants to go and download an AI companion chatbot. So assuming that all these laws are in place from device level to feature level, age verification requirements. So you go to your phone, which you've already had to verify your age, or your parent did.

• 50:46Speaker 02

  You go to the App Store where you've already had to verify your age. You go download this app, assuming that a 16-year-old is allowed to download this app. But you want to use it to create funny videos and share it with your friends. So you have to use your face, and you want to use your face and create a funny AI background. Well, that feature under this hypothetical law would require you to get ID verification, but you're 16 years old and you don't have a driver's license. So knowing that the system instead kicks you over to get parental consent.

• 51:29Speaker 02

  But since this is a feature that's not necessarily tied to the other verification methods, you now have to get your parent to

• 51:40Speaker 01

  Identify themselves. Oh, my gosh, yeah.

• 51:42Speaker 02

  They have to provide their ID and then perhaps even some identity measure to prove that they're your parent or guardian or someone that can make decisions for you. And so it just becomes a mess. So like, you're going from top to bottom, a massively intrusive process that is going to affect people wanting to access this information. So you might have a very enthusiastic 16-year-old who wants to go through that. But if you're just an adult who also has to go through that process, just to make, to ensure that you are still an adult, that could be enough for people to stop using these technologies or these apps.

• 52:21Speaker 01

  All right. I think that's probably a good place to wrap.

• 52:23Speaker 02

  Great.