Get the top HN stories in your inbox every day.
nirui
zero-hp
Not only in China. Russian internet cenzorship also started as a "children protection" measure.
qnpnpmqppnp
This title seems misleading.
The EP paper appears to be highlighting the existence of a debate regarding VPN.
Relevant quote:
"Some argue that this is a loophole in the legislation that needs closing and call for age verification to be required for VPNs as well. In response, some VPN providers argue that they do not share information with third parties and state that their services are not intended for use by children in the first place. The Children's Commissioner for England has called for VPNs to be restricted to adult use only.
While privacy advocates argue that imposing age-verification requirements on VPNs would pose significant risk to anonymity and date protection, child-safety campaigners claim that their widespread use by minors requires a regulatory response. Pornhub and other large pornography platforms have reportedly lost web traffic following the enforcement of age-verification rules in the UK, while VPN apps have reached the top of download rankings."
Of course I'm not saying the EU won't regulate VPNs, but nowhere in this paper is "the EU" stating that VPNs need closing.
MandieD
"Children's Commissioner for England"... that's not the EU. Really not the EU - they had a whole election and years-long process to leave the EU.
oytis
These dimwits (and I don't just mean those in EU) seriously want to stop adolescents from watching porn, and are ready to mess with internet infrastructure for that. That's a depressing manifestation of aging society
chii
> seriously want to stop adolescents from watching porn
no, they want to pretend this is the issue, so that pervasive monitoring or permission and/or deanonymization is normalized. It is to serve the state apparatus, rather than any actual protection.
palata
If it is possible to "pretend that they want something reasonable", it means that there is something reasonable somewhere.
Maybe some want more control, but most certainly not everybody.
> so that pervasive monitoring
If you haven't gotten the memo, pervasive monitoring already exists. To sell ads.
> or permission and/or deanonymization is normalized
For age verification, it's possible to do it in a privacy-preserving manner. Now people spend their time complaining about the idea and claiming that all who disagree are extremists, so it doesn't help. But we could instead try to push for privacy-preserving age verification.
Mad_ad
it's not about porn, it's about power over all citizens.
eowln
Practically all the ills we suffer currently are depressing manifestations of an aging society.
That, and the lack of real issues to solve.
ArnoVW
Without thinking too hard I can name a few?
The rise of authoritarianism? Inequality? Revival of geopolitical "realism"? Decrease in empathy and holistic thinking? Increasing willingness of the general population to engage in political adventurism? Accelerating resource consumption (and decelerating resource stocks).
And if you consider none of those "real" problems, I know some people seem to have forgotten about it, but what about climate change? Given the half-life of CO2 and methane, that's a problem as "real" as they get.
AlecSchueler
If only we were all privileged enough to believe that the problems in the world today weren't real.
cess11
It's not really about kids looking at porn, it's about tracking everyone else and making it easier for state surveillance and corporations to identify people.
Kids don't have money and hardly ever manage to do crime without getting caught so they're profoundly uninteresting to surveil in this way, but adults are and here the interests of the state and corporations converge so they'll make a push for tyranny.
But how to make people accept it? Tell them they want to expose kids to gruesome tentacle porn, or else they'd support this. Few adults are willing to admit they even look at porn, let alone argue that this is an important activity that needs to be protected, which it is.
palata
If you think that there is a need for new technology to identify people, I suggest you wake up and start getting informed about surveillance capitalism.
There is absolutely no need for new technology to track people, it's there already.
Also I feel like a big reason for age verification is social media. Many countries are trying to prevent kids from accessing social media (because we know it's bad for them), and age verification is the way to do that.
Badly implemented, age verification is bad. But there are ways to implement it in a privacy-preserving manner, which wouldn't make the current state of surveillance capitalism worse.
palata
Adolescents, or kids? Would you say it's completely stupid to want to stop kids from watching porn, or accessing social media?
Did you grow up with free streaming platforms? Pretty sure many adolescents were accessing porn before those, though it was slightly less accessible.
I personally don't have a definitive opinion about porn (I feel like young kids obviously shouldn't have access to it, but it shouldn't be illegal to adults, but I don't know where the limit should be), but I feel like making it harder for kids to access social media makes sense.
oytis
I dunno, you have experience being a kid, right? Young kids are just not interested enough to look for porn, not to say figure out how to use VPN to access it. Lax restrictions like we have today are enough to stop porn from being forced on children who are not interested in it
rufasterisco
The title is also the exact title for that paper’s chapter.
You are right at pointing out that the paper is overall presenting the subject in a balanced manner, unfortunately it seems a bad choice was made when it came to that specific sentence, that gives a venue for it to be fed in the outrage machine.
https://www.europarl.europa.eu/RegData/etudes/ATAG/2026/7826...
sexylinux
Showing children naked humans is a horrible crime.
Bombing children is OK and we happily produce and deliver all the weapons needed for that.
Patterns of an ill society.
karmakurtisaani
This needs a new "law of headlines": whenever it's the EU saying something, it's never the EU that said that.
inglor_cz
This is how waters are tested and potential negative reactions are probed.
shevy-java
But you single out just one paper. If you include all paper and discussions the picture is super-clear, and the title is not misleading at all. This has to be said.
> Of course I'm not saying the EU won't regulate VPNs
The word choice is quite revealing. You write "regulate VPNs". To me this is not "regulation" at all - it is restriction or factually forbidding it. It is newspeak language here if we dampen it via nicer-sounding words. It also distracts from the main question: why the sudden attack by EU lobbyists against VPNs?
rounce
> why the sudden attack by EU lobbyists against VPNs?
Live sports, they’re already assaulting internet infrastructure in various EU member states (eg. La Liga forcing Spanish ISPs to block cloudflare IPs during matches). With this in mind it seems less a case of surveillance state and more a case of corporate state capture.
qnpnpmqppnp
This is the only paper that is presented as a source for this statement. I'm not the one singling it out.
donmcronald
I think all the identity verification schemes should start with the beneficial owners of companies. Governments have been lobbied to allow complete anonymity for the wealthy that own businesses doing questionable things while regular people are going to have to show id to buy food.
palata
> Governments have been lobbied to
Yep... and to make it worse, nobody is trying to push them towards looking at privacy-preserving age verification: instead technologists try to convince them that they just shouldn't regulate anything. Which... may not work so well.
nickff
As someone who lives in a jurisdiction which does require such disclosure: it is a significant inconvenience for small businesses, and no benefit to the general public.
walrus01
Do small businesses in your area have complicated ownership structures that it's significantly inconvenient to disclose the one family that owns, for an example small business , a plumbing repair company with 4 vans and 6 employees?
roenxi
They might? If they don't and it is trivial to identify the beneficial owner, why is it necessary to create a requirement to disclose? The practical experience is that people are quite bad at this sort of requirement, that may well be a source of problems and that on aggregate making it harder to do business has a notable impact [0] on general prosperity. Don't needlessly put barriers in front of people who create wealth.
It isn't a stretch to imagine that a small business owner literally doesn't have enough time in their life to maintain their own health and run their business. There are some pretty grim stories out there, I can tell one based on a friend of mine who was working ... I think 70 hour weeks. Sounded rough. It isn't actually crazy to say they may not have an hour free to figure out what form they need to fill out and where to file it, or that they'd be too sleep deprived to get it right. Assuming that this thing is the only thing they need to disclose and there aren't any other pieces of paperwork that need filing (which we all know there will be).
Sure if they have to they'll probably figure it out in most cases, maybe it is trivial. But the businesses where a straw broke the camel's back don't exist any more to point at as evidence. It is hard to know.
[0] https://www.grumpy-economist.com/p/the-cost-of-regulation
Aerroon
You get extra spam. Any data that ends up on those public lists will be used to spam you. Some websites will also correlate all the data they have on you too, so you can get that spam at home too.
Basically, you have no privacy if you start a small business under these kinds of rules.
messe
Precisely what inconvenience does it actually cause those businesses?
patrickk
Shell companies for the ruling class, ever decreasing anonymity for the peasants.
rswail
Governments already have everyone's ID, including DOB. They say that the problem is non-adults accessing adult sites and services. So therefore, the sites need to know that users are over 18 (or the selected government age).
There should be a standardized government ID service/API that allows a person to let it disclose their age (or other user selected information) to a requesting site/service. That's all that is needed if the government ID service has appropriate 2FA and security.
Both the request and the response can be appropriately anonymized so that the government doesn't know the site, and the site doesn't know the person's identity.
Why isn't this a thing yet? As far as I know, no one has proposed it.
mr_mitm
The german gov id supports that. They have a PKI and the id is a smart card with a cert and private key on it [0]. It lets you answer the question "are you over 18" with a zero knowledge proof. I guess it only proves you have in your possession a valid id AND know the PIN to it, but that should be fine. France apparently has this, too, according to the article.
[0] https://www.personalausweisportal.de/Webs/PA/EN/government/t..., https://www.bsi.bund.de/EN/Themen/Oeffentliche-Verwaltung/El...
pimterry
This has been widely discussed, and initial implementations exist: the EU digital wallets are doing exactly this. https://ec.europa.eu/digital-building-blocks/sites/spaces/EU....
In theory, every EU state will have to support this soon so users can use it to verify age privately online. Still work to do to roll this out for real, but the technological part is very much already happening and I think the rollout plan is committed.
mcv
Exactly. Governments that really care about age verification should provide the tools to do so. They have the means to do so without violating privacy. Something like the Dutch DigiD service (the one they're about to sell to the US despite literally everybody opposing that) would be a great basis for this; just add an age verification service to it. They already know who you are in the most legal sense possible.
thrance
> There should be a standardized government ID service/API
Most European country already have one, some are still testing theirs. They're required by the EU to make one accessible to their citizens by the end of this year, in the context of the eID project [0].
[0] https://commission.europa.eu/topics/digital-economy-and-soci...
pembrook
> if the government ID service has appropriate 2FA and security.
You're kidding right?
drysine
Why?
In Russia we have gosuslugi.ru (state services), which nowadays requires 2FA and hasn't been compromised in any major way so far.
Among other things they provide a way for a third party to use it as identification service and a user chooses which data about himself he wants to share. No anonymity, though, and I don't see how it can be implemented so that the verification provider doesn't know which service is requiring age verification.
Hikikomori
These already exist in several eu countries. Imagine that there are governments that is not America and that actually work.
postepowanieadm
Currently Governments use the EU to enforce their unpopular/bad ideas.
What we must remember is that the EU is a process, not organisation. I think at this point, with rampant and unpunished corruption, lies and deception it's reasonable to take a step back and reconsider the Commission's role and citizens participation. Also, unanimity has to go, but in a way that would secure voices of smaller states (square root was a god idea) involve not only government representatives but also citizens.
chii
How come tax loopholes aren't as scrutinized?
Mandatory age verification online is a blight imho. It should be outlawed.
reddalo
I agree, age verification on the web should 100% banned.
Parents should learn how to be parents; the government shouldn't force companies to do parenting instead.
eloisant
Governement should force companies to give parental controls tools. Gaming companies like Nintendo and Steam do that, I can create a kid account with parental controls.
Social media companies (e.g. Meta, Snap) are the first that should provide that but they don't.
gherkinnn
Band and severely punish systematic violations of privacy.
Regulate the poison first, not the access to it. All this age verification nonsense is an admission that some platforms knowingly harm their users. And instead of fixing the issue by cracking down on the proverbial crack, governments make everybody's life worse.
I remain hopeful that one day, humans will regard the online advertising companies with the same scorn we do the tobacco industry and may they be ashamed and disgusted at our inaction.
otabdeveloper4
So you're implying alcohol and cigarettes should be sold to children?
(Not to mention all the other consent age laws.)
That said, VPN is a national security issue, children are only a pretext.
hnlmorg
Children have always found ways to access age restricted consumables. Whether that was porno mags, alcohol or cigarettes.
They’d just get an older sibling, or stranger to buy it. Or they’d have a fake ID. Or they’d just steal it from a family member.
But you know which kids did this the least? It was the ones where their parents / guardians took their responsibilities as a guardian properly.
esseph
> VPN is a national security issue
:/
vkou
What makes you think they aren't? The Double-Irish-Dutch-Sandwich in particular was cracked down on.
tgv
Just the fact that it takes NGOs and journalists to uncover tax evasion practices. The governments and tax offices aren't looking. CumEx was a scandal in 2017, and despite being known since 1992, has only recently led to just a handful of prosecutions.
ExpertAdvisor01
Cumex was not a tax loophole it was straight up fraud .
spwa4
To be replaced by the Irish tax department making direct deals that are essentially the same. But ONLY for specific companies (principle: big multinationals don't pay tax at all, local companies get big tax raises. Irish companies are dying, multinationals are moving to Ireland)
https://taxsummaries.pwc.com/ireland/corporate/tax-credits-a...
In case anyone wonders: this means the FANG companies don't pay tax in Ireland if they hire enough people in Ireland, which has famously high income tax. It is, in other words, effectively a massive tax increase on the employees while actually reducing total tax income in the EU compared to the "double dutch sandwich".
Note that Ireland signed at least 2 international treaties that they weren't going to do this (OECD minimum tax treaty, EU tax treaty). Of course, there are no consequences to this.
The response to is that EU is exploring company-tax-per-transaction which is so incredibly bad in the massive administrative burden it will generate. It's not final, but it will mean that for every transaction done companies will have to keep (PER transaction) pieces (plural) of evidence for what country they happened in. Every single transaction.
https://joint-research-centre.ec.europa.eu/projects-and-acti...
nickff
Lots of governments give tax exemptions to selected industries (film comes to mind) or even companies (Foxconn/TSMC); I don’t support this behavior, but I don’t see what makes Ireland special in this regard.
loeg
A tax "loophole" is just a deliberate policy you happen to disagree with.
jraby3
Why? Isn't your age verified when you renew your drivers license? Purchase something on Amazon?
When I was a kid, child programming and commercials were heavily scrutinized. Now any kid can access porn, violence, and scams on the internet. That's a blight. Not age verification.
zeroonetwothree
I don’t understand, did broadcast TV or cable do age verification? Surely kids could watch content that was for adults very easily.
xg15
Broadcast TV had a very simple solution to this problem: Only air the not-for-kids stuff at times of the day when the kids are already asleep, i.e. late in the evening or at night.
It was still the job of the parents to set the bed times etc, but at least this was something the parents could actually control.
And for pay-per-view stations with actual heavily violent or pornographic content: Yes, they were absolutely age-gated, usually via a PIN.
tmjwid
As a kid, you never found a stack of porno magazines in the woods did you?
oneshtein
> Now any kid can access porn, violence, and scams on the internet.
Before Internet they used paper.
kaliqt
That’s the job of parents. No exceptions. OP is right, it needs to be outlawed.
stirkac
How can you define a tax loophole then? Since there isn't a thing you can do called a "Tax loophole", but rather a collection of otherwise totally legitimate practices, just used as an optimization, they are impossible to define, and as such, be scrutinized. It's a neverending whack-a-mole...
thunderbong
I have a question that's been going through my mind -
Why is age verification connected with identity verification?
I understand why the former is not possible with the latter, but my question is -
Whichever entity is responsible for the verification can just pass on the age verification confirmation without passing through any of the other details, right?
Am I mistaken here? Because if this was possible, I could still go ahead with using the VPN.
xg15
This seems to be what "double-blind" verification is doing:
> The report highlights emerging approaches, such as “double-blind” verification systems used in France, where websites receive only confirmation that a user meets age requirements without learning the user's identity, while the verification provider does not see which websites the user visits.
palata
You are right, it is possible to do age verification in a privacy-preserving manner. Feels like most people being very vocal against the idea don't know about that.
At least most complaints I see here are assuming that age verification means tracking.
Too bad, there could be interesting discussions about privacy-preserving age verification, if people just bothered getting informed before complaining.
dinwos
It's a question of blind trust in your government to respect this, when they themselves control the age verification apps, at least in the EU who wants to impose its own system and not rely on an autonomous third party.
palata
It is cryptography. Just like you don't have to blindly trust Signal with end-to-end encryption (their client app is open source), it could be implemented in a way that you don't need to blindly trust your government.
rufasterisco
From a tech perspective it has been a solved problem since about a decade ago, via DID (decentralised identities) and their Verifiable Proofs.
The EU digital wallet framework is built around those, and your suggested scenario is a first class citizen.
It is now moving from the academic/research world, to the political field, and feedback/pressure from both commercial groups and political agendas is muddling the field.
Here are some links to canonical docs, you can easily find high quality videos that explain this is shorter/simpler terms to get a grasp of it.
https://www.w3.org/TR/did-1.0/
https://www.w3.org/TR/vc-data-model-2.0/
A note: it’s one of the healthy byproducts of the blockchain age, don’t get sidetracked by some hyped videos from crypto bros.
userbinator
It's a "solved problem" that didn't ever need solving in the first place.
0x073
There was a time that parents control what websites children can access.
Now there is a time politicians control what websites we can access.
kro
VPN usage increased, but how to they draw the conclusion that this is children. I think it's more likely that adults are using VPNs to not have to deal with the ID process. I would do that.
As VPNs usually cost some money, which is already a barrier for minors.
harvey9
The people who really want to stop VPNs are commercial streamers, especially for live sports. Regardless of state, or governing party, it always comes back to money.
9753268996433
North Korea calls VPNs “a loophole that needs closing” in age verification push
spacedoutman
We desperately need a new internet
Get the top HN stories in your inbox every day.
In case people no longer remember, when China started to require websites to register for a license before be allowed to operate, it was for "protecting the children" too.
This simple policy then goes on to silence most individual publisher(/self-media) and consolidated the industry into the hands of the few, with no opportunity left for smaller entrepreneurs. This is arguably much worse than allowing children to watch porn online, because this will for sure effect people's whole life in a negative way.
Also, if EU really wants "VPN services to be restricted to adults only", they should just fine the children who uses it, or their parent for allowing it to happen. The same way you fine drivers for traffic violation, but not the road.
And if EU still think that's not enough, maybe they should just cut the cable, like what North Korea did.