FIRE argues that age is a single bit of information, yet the verification regimes being deployed collect government IDs, face scans, and device fingerprints — then store the linkage on third-party servers. The piece frames the cumulative effect of UK, EU, and 20+ US state laws as a 'papers, please' internet where the intersection of compliance regimes becomes 'always verify, everywhere,' regardless of any single law's literal text.
FIRE highlights that no single regulation mandates universal ID checks, but the overlap of Ofcom's 'highly effective age assurance' standard, Texas HB 1181 (upheld 6-3 by SCOTUS in June 2025), Mississippi/Utah/Louisiana social media laws, and EU DSA pressure forces platforms to verify everywhere. Each jurisdiction picks a different threshold and acceptable proof, so the rational compliance posture becomes blanket verification.
FIRE calls out Yoti, Persona, Veriff, and Incode for repositioning their sales pitch around the assumption that ID checks will be mandated everywhere, rather than around any genuine user-experience or safety benefit. The argument is that the vendor ecosystem now has a structural incentive to expand the scope of verification mandates, creating a feedback loop with regulators.
The Foundation for Individual Rights and Expression (FIRE) published a long-form piece arguing that the current wave of age-verification, ID-check, and 'duty of care' laws — UK Online Safety Act, EU DSA carve-outs, the patchwork of US state laws now numbering past 20 — is collectively reshaping the internet into something that looks more like a regulated bar than an open network. The piece landed at 608 points on Hacker News, which for a privacy-policy essay is the kind of signal that means practitioners, not just activists, are paying attention.
The specifics are familiar to anyone who has read a compliance memo recently: Ofcom now expects 'highly effective age assurance' for any UK-accessible site hosting content deemed harmful to minors, which the regulator has interpreted broadly enough to cover Wikipedia, Reddit, and any forum with a NSFW corner. Texas HB 1181, upheld 6-3 by the Supreme Court in June 2025, requires government-ID upload or facial-age-estimation for adult content. Mississippi, Utah, and Louisiana have extended similar regimes to social media writ large for minors. The EU's DSA has been used to pressure platforms toward age gating regardless of what the regulation literally says.
The pattern isn't a single law — it's a compounding compliance surface where every jurisdiction picks a different threshold and a different acceptable proof, and the intersection is 'always verify, everywhere.' Vendors like Yoti, Persona, Veriff, and Incode have moved fast to fill the gap, and their pitch decks now anchor on regulatory inevitability rather than user experience.
The technical critique in the FIRE piece — and in the HN thread underneath it — is that the verification industry is selling a category error. Age is a single bit of information; the systems being deployed to prove it collect a government ID, a face scan, and a device fingerprint, then store the linkage on someone else's server. The 'token-based' and 'zero-knowledge' designs that privacy researchers have spent a decade prototyping (Google's age-signal API, Apple's Declared Age Range, the EU Digital Identity Wallet's selective-disclosure spec) exist, but they aren't what most sites are actually wiring up. What's actually deployed is a third-party SaaS that takes a photo of your driver's license and stores it, indefinitely, against a contract that says 'we delete it,' against a track record that includes the AU.10tix breach in 2024 that exposed verification data for users of Coinbase, OkCupid, X, and others.
The HN commenters who run actual consumer products were blunt about the operational reality. One thread traced the choice matrix: integrate Persona ($0.50-$2 per verification, lose the user who won't upload an ID, eat the breach risk), build it yourself (illegal in most relevant jurisdictions unless you can prove 'highly effective'), or geofence the EU/UK/Texas/Mississippi (acceptable until your investors notice the TAM cut). The cynical equilibrium is that small operators geofence, mid-size operators integrate a vendor and pray, and only the hyperscalers can afford to build the privacy-preserving primitive properly — which is, by no coincidence, exactly the market structure the laws produce.
There's a second-order effect that the policy debate keeps missing. Once a site has wired up an identity verifier for one regulated content category, the marginal cost of using it for everything else — ad targeting, fraud scoring, dispute resolution, account recovery — drops to near zero. The verification flow becomes a de facto login. Apple and Google have spent fifteen years building 'sign in with' flows that minimize PII exposure; a Persona or Yoti integration undoes that in a single product cycle. The privacy ratchet only turns one way.
The community pushback also surfaced an uncomfortable empirical point: the studies cited in the legislative findings — that age verification meaningfully reduces minor exposure to adult content — don't hold up to scrutiny. Pornhub's traffic in states with verification mandates didn't disappear; it moved to VPN-fronted sites and non-compliant offshore operators with worse safety practices. The compliance burden falls on the operators who were already trying to do the right thing.
If you ship a consumer-facing product with any user-generated content, treat age verification as a feature you will have to ship within 18 months, whether you want to or not. The architectural decision worth making now is whether to integrate a vendor SDK directly (fast, expensive, ties your liability to theirs) or to abstract behind an identity provider you already trust (Apple, Google, a national eID where available) and treat the verifier as swappable. The latter is more work upfront and dramatically cheaper when — not if — the first wave of verifier breaches forces a vendor swap.
For the auth layer specifically: stop storing 'verified_at' as a boolean. Store the issuing jurisdiction, the verification method, the vendor, and the proof artifact reference separately. When Texas updates its definition of 'highly effective' or Yoti gets breached, you want to invalidate a slice of your user base, not all of it. Add a column for 'verification_token_revoked_at' before you need it; retrofitting that under a deadline is how breaches turn into customer-comms disasters.
For anyone building developer tools or B2B SaaS: this is mostly somebody else's problem until your customers ask you to forward identity assertions through your platform. If you run any kind of marketplace, forum, or community feature, it will become your problem. Read the UK Online Safety Act's 'in-scope service' definitions before your legal team has to.
The interesting question isn't whether age verification spreads — it will, the political coalition behind it is bipartisan in a way few tech issues are — but whether the privacy-preserving primitives win the implementation race against the data-hoarding ones. Right now the data hoarders are winning, because they ship faster, integrate more easily, and the regulators haven't yet started fining the verifiers themselves for breaches. The first $100M FTC settlement against a verification vendor — and one is coming — will reset the market. Until then, every consumer product is one regulator-letter away from wiring a permanent identity layer into a web that was built to not have one.
> You’re not happy about it, but you hand over a photo of your passport and hope it doesn’t come back to haunt you.I think for this argument to carry weight with voters, privacy advocates need to be much more specific about what "coming back to haunt you" looks like. They do a little bi
> you’re criticizing a powerful politician, or talking about your experiences with abuse or addiction, or discussing embarrassing medical issues you’re facingThis is not the problem. Even if, like millions, you are not talking about these things online, these systems still place you in danger. Ev
Assuming no revolutionary changes are coming to the USA, I am planning to opt out of the digital world when I retire. Physical media only. No subscriptions. Spend lots of time in the library. Find like-minded people and meet in person. Will only keep the bare minimum for survival, like banking.
The path ahead in the next few years (at least for the UK)1. Age gating + VPN ban under the guise of protecting children from social media2. Few years pass, Identity Passport gets ushered in under guise of convenience of not having to repeat those pesky age verification checks.3. Utilities start to
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
There are at least some technological solutions here, such as anonymous credentials. [1] Modern versions of this technique allow one to associate metadata (like a proof of age exceeding a threshold) in such a way that the verifier can't even correlate repeated requests across users.Governments