We’ve said it before: online age verification is incompatible with privacy. Companies responsible for storing or processing sensitive documents like drivers’ licenses are likely to encounter data breaches, potentially exposing not only personal data like users’ government-issued ID, but also information about the sites that they visit.
This threat is not hypothetical. This morning, 404 Media reported that a major identity verification company, AU10TIX, left login credentials exposed online for more than a year, allowing access to this very sensitive user data.
A researcher gained access to the company’s logging platform, “which in turn contained links to data related to specific people who had uploaded their identity documents,” including “the person’s name, date of birth, nationality, identification number, and the type of document uploaded such as a drivers’ license,” as well as images of those identity documents. Platforms reportedly using AU10TIX for identity verification include TikTok and X, formerly Twitter.
Lawmakers pushing forward with dangerous age verifications laws should stop and consider this report. Proposals like the federal Kids Online Safety Act and California’s Assembly Bill 3080 are moving further toward passage, with lawmakers in the House scheduled to vote in a key committee on KOSA this week, and California's Senate Judiciary committee set to discuss AB 3080 next week. Several other laws requiring age verification for accessing “adult” content and social media content have already passed in states across the country. EFF and others are challenging some of these laws in court.
In the final analysis, age verification systems are surveillance systems. Mandating them forces websites to require visitors to submit information such as government-issued identification to companies like AU10TIX. Hacks and data breaches of this sensitive information are not a hypothetical concern; it is simply a matter of when the data will be exposed, as this breach shows.
Data breaches can lead to any number of dangers for users: phishing, blackmail, or identity theft, in addition to the loss of anonymity and privacy. Requiring users to upload government documents—some of the most sensitive user data—will hurt all users.
According to the news report, so far the exposure of user data in the AU10TIX case did not lead to exposure beyond what the researcher showed was possible. If age verification requirements are passed into law, users will likely find themselves forced to share their private information across networks of third-party companies if they want to continue accessing and sharing online content. Within a year, it wouldn’t be strange to have uploaded your ID to a half-dozen different platforms.
No matter how vigilant you are, you cannot control what other companies do with your data. If age verification requirements become law, you’ll have to be lucky every time you are forced to share your private information. Hackers will just have to be lucky once.
Privacy Guides
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We've tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the "official" Privacy Guides community on Lemmy, which can be verified here. Other "Privacy Guides" communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
- We prefer posting about open-source software whenever possible.
- This is not the place for self-promotion if you are not listed on privacyguides.org. If you want to be listed, make a suggestion on our forum first.
- No soliciting engagement: Don't ask for upvotes, follows, etc.
- Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
- Be civil, no violence, hate speech. Assume people here are posting in good faith.
- Don't repost topics which have already been covered here.
- News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
- Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
- No help vampires: This is not a tech support subreddit, don't abuse our community's willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
- No misinformation: Extraordinary claims must be matched with evidence.
- Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
- General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
Additional Resources:
- EFF: Surveillance Self-Defense
- Consumer Reports Security Planner
- Jonah Aragon (YouTube)
- r/Privacy
- Big Ass Data Broker Opt-Out List
view the rest of the comments
I agree with what you say, but how can we prevent kids to use those websites? Todays parents are too IT ignorant and they don't know that they can protect their kids by using tools that they already have (parental control on smartphones and routers). So, how do we protect those kids? Pornography (for example) can do huge damage to kids.
These laws don't help when it's insanely easy to install VPN clients on pretty much any device kids have access to. I have Adguard Home on our home network with the malicious and adult websites blocked. But still had a conversation with my kids about porn. And it turns out one of them had already been using a VPN on his phone and PC to bypass the local restrictions. We talked about it more, about being a good and safe "netizen" while discussing how unhealthy porn can be. I'm not anti-porn, but there is a lot of mistreatment of the people making it and can lead to some unhealthy misconceptions about sex and intimacy.
You guys do realize that porn has existed for generations right? You could get porn on the Internet back in like 1998. And before that people had magazines and vhs videos.
But for some reason people act like it's some recent immergent phenomena that's only NOW damaging kids. Makes no sense..
Just talk to your damn kids about sex. It's not a big deal. Just be parents for Gods sake. Stop outsourcing your parenting responsibility to our dysfunctional and idiotic government, and corporations.
Guys, come on, in the '80/early '90 it was almost impossible to have access to porn, maybe some magazine found somewhere. Today a 10 years old can see porn video on a smartphone everytime he wants! You can't say that it's the same!
P.s. In my original message I didn't say that I'm ok with that law, I was asking (to start a kind discussion) what other possibilities there are.
I’m in that age group. Kids had vhs and magazines. IMO the faces of death vhs going around was more scarring than any porn.
@peregus @ForgottenFlux
Education and trust. We should educate children and parents about the web, its advantages, and dangers. Parents need a starting point on what they can and can’t do to protect their children, and we (technical people) can provide them with best practices. We should also improve the mutual trust between children and their parents. If kids see something bad on the internet, they need to feel safe talking to their parents about it to get help instead of blame.
This sounds like the right answer at first, but really, the entire reason ID verification exists is because the whole "just parent your kids" thing already didn't work, and now here we are. You can't fix stupid, meanwhile the kids are still doing bad things, and everyone else doing nothing too, solves nothing.
Todays parents? No. The Boomer/Gen X parents of Millennials were also incredibly IT ignorant.
I know, but what were the risks there? There was no Internet! The firsts with wide Internet access were the late millennials.
I don't know what you lived through, but there was wider internet access in the late 90s and early 00s that caused widespread panic amongst the boomers when I was a kid (born early 90s). I grew up in the era of the first social networks, MySpace being the biggest early one I remember. What surprises me more is that so many millennials have grown up to be just like their parents in that regard.
In fact I wrote:
which seems to be you.
Yes. What is your point? I was commenting on the fact you thought this was a current parents problem when it's been a problem for over 20 years now.
My point is that you can't compare today's problem with 20 years ago! 20 years ago the access to the Internet was through the home PC for the amount of time the kid was allowed to use and with people in the house (usually); today the access to the Internet for a kid is 24/7 and everywhere. There is no comparison. Parents should be more present in the kids life? Sure! Parents should block Internet access to porn website at least until a certain age? Yes! But most of them doesn't even know that ths is possible. Maybe we (society, givernment) should work more here.
You invoked the comparison by using the phrase "today's parents are too IT ignorant". If anything, they know more about tech than ever before.
Edit: In response to the rest. Parents just don't want to have uncomfortable conversations with their kids, they never have. Because, no, it isn't actually easy to block all pornographic websites reliably.