Concerns Over Age Verification and Privacy Safeguards in Technology

At a recent technology conference in Austin, Texas, Ehren Klett, the CTO of Signal, expressed his worries about legislative moves that mandate age verification on online platforms but lack proper privacy provisions.

Countries in the U.S., Europe, and other regions are drafting laws requiring these platforms to confirm users’ ages. This comes after years focused on reducing data collection and enhancing privacy protections.

The GDPR, introduced in 2018 by the European Union, imposed strict data minimization and storage requirements on companies, compelling them to comply with user requests for data deletion. This legislation has prompted extensive compliance efforts within the tech industry.

Currently, lawmakers are working on strategies to limit minors’ access to online platforms. Age verification is becoming a core requirement, necessitating platforms to gather and manage personal data to confirm age.

Klett argued that such demands contradict previous regulatory efforts aimed at safeguarding user privacy. “That’s the biggest thing that policymakers are overlooking right now,” he commented. He referenced ID breaches that have occurred and criticized the lack of distinction between identity verification and general confirmation of age.

During his talk at the conference, titled “Don’t Be Evil,” Klett highlighted concerns surrounding the existing age verification proposals. He suggested that a robust system must prioritize privacy; otherwise, it merely addresses part of the issue.

Several nations are now considering or have already enacted laws requiring age verification, with states like California proposing solutions that address this at the operating system level. Technology firms are already evolving to meet these requirements, with Apple initiating operating system-level verification in the UK.

However, many legislative proposals lack clarity on how these verification systems should function or what privacy measures must accompany data collection. Klett cautioned that the current direction could interlink users’ identities with their online behavior.

He proposed that cryptographic methods, like zero-knowledge proofs, could effectively verify credentials without exposing additional personal information. “If we want a system, why don’t we also require it to be as private as possible?” Klett stated, affirming the feasibility of creating such a system.

These zero-knowledge proofs would allow verification of age claims while keeping users’ identities confidential. Klett maintained that creating such a system isn’t overly complicated, requiring only foundational knowledge from existing research.

Klett also referenced Signal’s donation system as a model that separates identity from verification. This method allows users to validate their participation without disclosing individual identities related to payments.

As age verification requirements expand, discussions about online anonymity also intensify. If identity checks become mandatory for digital service access, opportunities for anonymous participation may diminish.

Additionally, the rise of age verification brings to light data security concerns. A recent incident involving Discord’s age verification rollout revealed a breach where the personal information of around 70,000 users was compromised through a third-party authentication service.

Despite the lawmakers’ intention to protect minors online, the proposed measures still heavily emphasize age verification without sufficient details on implementation or privacy safeguards. Experts have warned that once identity verification systems are widely adopted, they can be hard to modify due to the extensive infrastructure and data collected. Moreover, incidents like the Discord breach raise the risk of permanent exposure of personal information on the dark web.