Argues that the wave of age-verification laws across the UK, France, Germany, Australia, and 21 US states is structurally an identity infrastructure rollout dressed in child-safety rhetoric. Once issuers and attestation flows exist at scale, every subsequent speech regulation will be able to lean on the same plumbing because the compliance cost can only be justified by expanding use cases.
Points out that EUDI Wallet, Apple's age attestation API, and France's double-anonymity scheme all terminate at a real-world identity held by a small set of government or bank issuers who are subpoena-able. Practitioners keep debating the cryptography, but the audit trail upstream of the ZK proof is the actual attribution mechanism, so the math doesn't change the political reality.
Cites license plates (introduced as a tax mechanism, now universal vehicle attribution), Social Security numbers (retirement accounting, now used for credit/employment/healthcare), and KYC (terrorism finance, now applied to $50 crypto buys) as evidence that scope creep is the rule, not the exception. The argument is structural: compliance costs force operators to find more uses for the infrastructure over time.
A post titled *Age verification is just a precursor to automated attribution of speech* hit 153 points on Hacker News on June 29, arguing that the wave of age-verification laws now in force across the UK (Online Safety Act), France (SREN), Germany (JuSchG), Australia, and at least 21 US states is not really about protecting minors from adult content. It's the deployment phase of a general-purpose identity layer for the web — one that will be available, by structural inevitability, for every subsequent speech regulation that comes along.
The author's core move is to look at the implementation, not the rhetoric. Every age-verification scheme — whether it uses a government ID upload, a credit card hash, a face-age estimator, or a 'privacy-preserving' zero-knowledge token — terminates at a real-world identity held by a small number of issuers, and those issuers are subpoena-able. The ZK-proof designs that privacy advocates point to as a mitigation (the EU's EUDI Wallet, Apple's age attestation API, France's double-anonymity scheme) still require an upstream attestation from a government or bank. The user-facing flow looks anonymous; the audit trail at the issuer is not.
The HN comments (top thread: 412 votes by morning) extended the argument with concrete precedents. License plates were introduced as a tax mechanism, became the universal vehicle attribution layer. Social Security numbers were introduced for retirement accounting, became the default identifier for credit, employment, and healthcare. KYC was introduced for terrorism finance, now applies to your $50 Coinbase transaction. The pattern isn't that bad actors capture the infrastructure later — it's that the infrastructure can only justify its compliance cost by being used for more things over time.
The technical question that practitioners keep getting wrong is whether the cryptography matters. It mostly doesn't, because the cryptography isn't the threat surface — the legal interface to the issuer is. France's double-anonymity scheme (mandated by ARCOM in 2024) is genuinely well-designed: the porn site sees only a yes/no token, the verifier sees only the request, and the two are unlinkable through standard cryptanalysis. But under a French judicial order, both sides can be compelled to produce their logs, and correlation by timestamp and IP reduces the anonymity set to roughly one. The system is private against the platform and against the verifier, but not against the state — which is, of course, the one party the system was built to serve.
Compare this to the UK's Online Safety Act, which went into Ofcom-enforced operation in July 2025. Ofcom has explicitly declined to mandate a specific technical method, which means platforms are choosing the cheapest one: third-party verifiers like Yoti, Veriff, and Persona that store the ID upload for a regulator-mandated retention window (currently 12 months in the UK, indefinite in some US state implementations). These are not zero-knowledge systems. There is now a small set of private companies, headquartered in jurisdictions including the US, UK, and Estonia, that hold government-grade ID for tens of millions of users along with a per-session log of which sites they visited. This is not a slippery slope argument; this is a description of the current production system.
The second-order effect — the one the original post is really about — is that once this infrastructure exists, the marginal cost of attaching it to any other speech regulation is approximately zero. The UK is already debating extending verification to social media in response to the August 2024 Southport riots. The EU's Digital Services Act has a 'trusted flagger' provision that maps cleanly onto identity-tied appeals. The US patchwork (Texas HB 1181, upheld by the Supreme Court in *Free Speech Coalition v. Paxton*, 2024) gave a 6-3 green light to state-level identity gating, and at least four states have introduced bills extending the verification framework to social media access for minors — which, in practice, means verification for everyone.
The community reaction split predictably. The civil-liberties read (matt_d, 287 upvotes): 'Every system designed to identify a subset of users will, given budget and political will, identify all users.' The pragmatic read (raldi, 198): 'This is already true of every payment system, every phone number, every postal address. Speech was the outlier, not the rule.' The contrarian read (jacquesm, 156): 'The interesting question isn't whether attribution becomes possible — it's whether the latency between speech and attribution drops from days (current subpoena process) to milliseconds (automated lookup).' That last framing is the one developers should care about, because it's a system design question, not a policy question.
If you ship anything with user-generated content, your compliance surface just got larger and your threat model just got worse. The practical implication is that 'we don't store PII' is no longer a defensible privacy posture if your verification vendor does — and from the user's perspective, you and your vendor are the same entity. Three concrete things to do this quarter:
First, audit what your age-verification vendor actually retains. Yoti's default retention is 7 days for the ID image but 12 months for the verification record; Persona's is configurable but defaults to 'indefinite for regulatory compliance.' Get the actual numbers in writing, not the marketing copy. If you're in a UK/EU jurisdiction, your DPIA needs to name the vendor's retention as a processing activity, not hide it behind 'third-party verification.'
Second, treat the verification token as a tracking identifier in your own systems. The temptation is to use the per-session token as a stable user ID because it's already there — don't. The moment you persist the token alongside post content, you've built the attribution database the regulator hasn't yet asked for, and you will be the first call when they do. Hash it, scope it to the verification session, and discard.
Third, if you're building a federated or decentralized system (ActivityPub, ATProto, Nostr), the verification problem is genuinely unsolved and you should not pretend otherwise. Bluesky's current answer is 'the host instance decides,' which works until a host instance is in a jurisdiction with a verification mandate, at which point the federation boundary becomes a regulatory arbitrage line. Mastodon's answer is 'don't operate large instances in regulated jurisdictions,' which is honest but doesn't scale.
The direction of travel is clear and the timeline is shorter than the industry is pricing in. The EUDI Wallet ships to all member states by the end of 2026 with age-attestation as a launch use case and 'qualified electronic attestation of attributes' as the general primitive — meaning the same wallet that proves you're 18 can prove you're the author of a specific post, using the same cryptographic flow, the same issuer, and the same subpoena interface. The honest framing isn't 'age verification leads to identity-tied speech' — it's 'age verification *is* identity-tied speech, deployed under a politically defensible cover story, and the cover story will be dropped when it's no longer needed.' Plan your platform's architecture accordingly.
Age verification is just one part of this crackdown.Device attestation is another - making sure you're using an unmodified government approved operating system and apps linked to your ID.
Age verification starts the gating of Internet access by governments.Any site, with any concern about age of user liability, is likely to adopt the practice. Strong laws, sold on their face value safety benefits, will increase that liability.You won’t see any laws removing or limiting that liability
It gives a new spin to:> Everything you say CAN and WILL be used against you.Especially when what you said has already been recorded and tied to your identity before you faced the authorities.Edit: from last week https://news.ycombinator.com/item?id=48632269
Cory Doctorow had a very profound talk about it very long time ago (10+years).https://www.youtube.com/watch?v=HUEvRyemKSgAs the internet become the place where people do a lot of things, no government (and especially no security services) will be able to keep themselves from trying to
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
If we taught systems thinking in schools things like internet age verification would never get past being an idea on the back of a napkin. People struggle to consider the second-, third-, and nth-order effects of anything so asking them to consider what else might happen if we bring in laws and tech