Argues that age-gating laws across the UK, EU, France, and US states are deploying a reusable cryptographic primitive that binds verified real-world identity to HTTP requests. Once shipped, the distance between proving age and proving identity collapses to a configuration flag — the same signed-assertion infrastructure can pivot from `age_over=18` to `subject_id=<persistent>` without new engineering.
Point out that the W3C Verifiable Credentials spec, OpenID for Verifiable Presentations, and the EUDI ARF reference implementation already contain the fields needed for attribution — they're simply unused in the current age-gating profile. The technical wall does not exist; the only barrier is policy, which is precisely the variable that legislatures can flip.
Notes that double-blind tokens from Apple and Google, plus ZK attestations from EUDI wallets, all produce stable per-site pseudonyms presented as privacy-preserving. But a stable pseudonym is exactly what attribution requires, and a single policy change — court-ordered linkability across relying parties — converts the 'privacy' primitive into a cross-site identity graph.
A post titled *Age verification is just a precursor to automated attribution of speech* hit 285 on Hacker News this morning, written by an author at nonogra.ph and dated 06-29-2026. The piece is short, technical, and unusually careful: it argues that the dozens of age-gating regimes shipping in 2025–2026 — the UK Online Safety Act's Part 5 duties, the EU's DSA Article 28(3) implementing acts, France's SREN law, and the US state quilt now covering Texas, Utah, Louisiana, Mississippi, Virginia, Arkansas, Montana, and Florida — are not really about kids. They are about deploying, at internet scale, a reusable cryptographic primitive that binds a verified real-world identity to an HTTP request.
Once that primitive ships, the author argues, the legal and engineering distance between 'prove you're 18 to view this page' and 'prove who you are to post this comment' collapses to a configuration flag. The mechanisms being standardized — zero-knowledge attestations from government eID wallets (EUDI), third-party AV providers like Yoti and Persona, double-blind tokens from Apple and Google — are all designed around the same shape: a signed assertion, scoped to a relying party, with a stable per-site pseudonym. Flip one parameter from `age_over=18` to `subject_id=
The HN thread is mostly senior infra people, and the top comments are not the usual libertarian boilerplate. They are engineers pointing out that the W3C Verifiable Credentials spec, OpenID for Verifiable Presentations, and the EUDI ARF reference implementation already contain the fields needed for attribution; they're just unused in the age-gating profile. The wall isn't technical. It's policy, and policy is the part that moves.
The usual rebuttal to slippery-slope arguments is that the slope isn't actually slippery — that each step requires a fresh political fight. The author's strongest point is that for identity infrastructure, the slope is greased by the same vendors who built the first step. Yoti, Persona, AU10TIX, Incode, and Jumio are not age-verification companies. They are KYC companies that pivoted into age verification because the regulatory tailwind was stronger. Their SDKs already ship attribution-capable flows; the age-only mode is a feature flag.
Compare three implementations that are live today and tell the story. The UK's approach, under Ofcom's March 2025 guidance, permits 'highly effective' AV including photo-ID matching and credit-card checks — both of which produce a persistent identity record on the provider side, even when the assertion to the relying party is a single bit. France's SREN law, after the Conseil constitutionnel partially struck it down in 2024, mandates double-blind architecture — but the double-blind only protects against the AV provider learning *which site* you visited, not against the site learning a stable per-site ID. Texas HB 1181, upheld by SCOTUS in *Free Speech Coalition v. Paxton* (June 2024), has no architectural requirements at all; sites are free to retain whatever they collect. Three jurisdictions, three privacy postures, one shared substrate — and the substrate is what gets reused when the next law lands.
The community reaction worth taking seriously is the one from people who've worked on actual identity systems. A top-voted comment from someone who claims to have shipped at one of the EUDI pilot member states notes that the wallet spec's `selective disclosure` feature was specifically designed so that the same credential can answer 'over 18?' today and 'are you @username on this forum?' tomorrow, without re-issuance. The credential doesn't change. The query does. That is the engineering reality the post is pointing at, and it's the part that doesn't show up in the public debate, which is still framed around kids and porn.
The second-order effect is on the existing speech-restriction stack. Germany's NetzDG, the UK's Malicious Communications Act, France's loi Avia (the parts that survived), Singapore's POFMA, India's IT Rules 2021, and Brazil's Marco Civil amendments all currently rely on platforms to identify users, which means they rely on subpoena cycles measured in weeks and on platforms that frequently refuse. An identity ledger queryable in milliseconds turns every one of those laws from a slow, expensive enforcement mechanism into a cheap one — and cheap enforcement gets used. That's not a prediction about authoritarian regimes. It's a prediction about Western democracies, where the binding constraint on speech prosecutions has always been cost, not law.
If you operate anything with user-generated content — a forum, a comments section, a Discord-style chat, a code-hosting platform, a federated instance — the threat model is shifting under you and the change is mostly invisible from inside your own logs. Three concrete moves are worth making in the next two quarters.
First, audit your auth layer for what identity material you're actually persisting versus what you think you are. The new AV SDKs return more than a boolean; the responses include provider-side correlation IDs, device attestations, and sometimes signed credential hashes that survive account deletion. If you're storing the raw response 'for compliance,' you're now sitting on the attribution layer for someone else's future subpoena. Strip to the minimum bit you need and discard the rest at ingress, before it hits any log aggregator.
Second, treat third-party AV integration the way you'd treat a payment processor handling card numbers — assume the data is radioactive, scope the relying-party config to the narrowest possible claim (`age_over_18` only, never `date_of_birth`), and refuse provider SDKs that don't support claim-level minimization. The EUDI ARF and Apple's `DCMVPElement` both support this; most US-state-driven vendors do not, and the difference will matter when the same vendor is asked to extend the same integration to attribution next year.
Third, if you run any kind of proxy, anonymizing service, or end-to-end-encrypted product, the regulatory framing is going to start treating you as an evasion mechanism rather than a privacy mechanism. The UK's Online Safety Act already contemplates this in its 'duty to prevent' language around encrypted services. Get your legal exposure mapped now, while there's still a public debate, rather than after the first prosecution under a statute that wasn't written with you in mind.
The author's framing — age verification as a precursor — is the right one, but the timeline is the part to argue with. The wallet infrastructure is shipping in the EU through 2026, US state laws are stacking faster than they can be litigated, and the SCOTUS decision in *Paxton* removed the strict-scrutiny ceiling that had constrained the design space. The next eighteen months are when the substrate gets poured. After that, the marginal political cost of extending it is borne by whoever objects, not by whoever proposes — which, historically, is when these things stop being debatable and start being inevitable.
Age verification is just one part of this crackdown.Device attestation is another - making sure you're using an unmodified government approved operating system and apps linked to your ID.
Age verification starts the gating of Internet access by governments.Any site, with any concern about age of user liability, is likely to adopt the practice. Strong laws, sold on their face value safety benefits, will increase that liability.You won’t see any laws removing or limiting that liability
It gives a new spin to:> Everything you say CAN and WILL be used against you.Especially when what you said has already been recorded and tied to your identity before you faced the authorities.Edit: from last week https://news.ycombinator.com/item?id=48632269
Cory Doctorow had a very profound talk about it very long time ago (10+years).https://www.youtube.com/watch?v=HUEvRyemKSgAs the internet become the place where people do a lot of things, no government (and especially no security services) will be able to keep themselves from trying to
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
If we taught systems thinking in schools things like internet age verification would never get past being an idea on the back of a napkin. People struggle to consider the second-, third-, and nth-order effects of anything so asking them to consider what else might happen if we bring in laws and tech