Doctorow argues that the only way to stop platforms from spying on kids is to spy on every kid, every adult, and every device they touch, forever. He frames the global wave of age-verification laws (UK Online Safety Act, Australia's social media ban, France's SREN, US state statutes) as a Vietnam-era 'destroy the village to save it' policy that mandates universal identity verification through passports, face scans, and liveness checks.
By submitting Doctorow's piece under the framing 'Spying on kids to save kids from spying is stupid,' the submitter endorses the core thesis that universal surveillance is a self-defeating remedy for platform surveillance of minors. The 690-point score and 371 comments signal strong community resonance with this critique.
Doctorow names the shrinking vendor list — Yoti, Persona, Veriff, Incode, Jumio, AU10TIX, Onfido — as a five-vendor oligopoly that now runs the identity layer for Pornhub, Discord, Roblox, X Premium, Bumble, and Match Group. He stresses these companies are not regulated like banks, not chartered like utilities, and largely cannot be audited, yet have been made load-bearing infrastructure of the regulated internet by legislative fiat.
Cory Doctorow's June 23 Pluralistic post — titled with a Vietnam-era reference to the village that had to be destroyed to be saved — takes aim at the global pile-up of age-verification laws being passed in the name of child safety. The UK's Online Safety Act, Australia's under-16 social-media ban, France's SREN law, and the U.S. patchwork of state-level statutes (Texas HB 1181, Utah SB 287, and the dozen-or-so copies that followed) now all share a common architectural assumption: every adult on the internet must repeatedly prove they are not a child, and every child must be uniquely identifiable to the platforms they use.
Doctorow's core argument is that the only way to stop platforms from spying on kids is to spy on every kid, every adult, and every device they touch, forever. The mechanism is mandatory identity verification — uploaded passports, face scans, selfie-liveness checks, credit-card pings, mobile-carrier handshakes — performed by a small handful of private vendors who have quietly become the load-bearing infrastructure of the regulated internet.
The vendor list is short and getting shorter: Yoti (UK), Persona (US, $1.5B valuation), Veriff (Estonia, $1.5B), Incode (Mexico, $1.25B), Jumio (US, acquired by Centana), AU10TIX (Israel), and Onfido (acquired by Entrust in 2024). Between them they now run the identity layer for Pornhub's Texas pages, Discord's UK age gates, Roblox's parental controls, X's Premium tier, Bumble, Match Group, and an expanding list of platforms that previously asked nothing more than a checkbox.
The Doctorow piece is a policy critique, but the engineering reality underneath it is what should concern anyone shipping a consumer product. Every age-verification mandate is, in practice, a permanent government subsidy for a five-vendor oligopoly that nobody voted for and almost nobody can audit. These companies are not regulated like banks, not chartered like utilities, and not subject to the data-minimization rules that apply to the platforms they gate. They sit upstream of the regulated entity and collect, by mandate, the exact biometric corpus that the law is ostensibly trying to keep out of platform hands.
The numbers are getting hard to ignore. Yoti has publicly disclosed performing over 700 million age estimations. Persona processes more than a million verifications per day across its customer base. Incode claims to have onboarded over 350 million identities. The aggregate biometric database held by this handful of vendors now exceeds what most national DMVs hold — and unlike a DMV, there is no records-request process, no statutory retention cap that the public can verify, and no clear chain of custody when the data is sold, breached, or subpoenaed.
The breach record is already ugly. AU10TIX leaked admin credentials to a public Gitlab in 2024, exposing logs that included verification documents for TikTok, Uber, and Coinbase users. The 2023 Latitude Financial breach exfiltrated 14 million identity documents from a verification provider in Australia, a country that is now mandating that exact pipeline for every minor. Each new age-verification mandate creates a new mandatory honeypot, and the honeypots are demonstrably worse at security than the platforms they exist to police.
The second-order effect is the one Doctorow circles around most explicitly: the laws are inherently extra-territorial. A US developer with no UK users still has to either geofence or integrate, because the Online Safety Act's definition of 'in-scope' service is broad enough to capture any platform with 'significant' UK users — a number Ofcom has declined to define. The same holds for Australia, where the eSafety Commissioner's interpretation drives compliance, and for the EU's DSA, where the Article 28 'minors' provisions are being read aggressively. The practical effect is that the lowest common denominator of global ID-verification law becomes the default architecture for any platform that wants to scale.
Community reactions on Hacker News (690 points at time of writing) split predictably but with a noticeable shift in tone from prior threads on the same topic. The previously-loud 'just verify age, what's the big deal' camp has gone quiet as the actual vendor reality has become clearer. The top-voted comment notes that the UK's verification spend has already crossed £150M in vendor contracts in the first 12 months of OSA enforcement — a number that flows directly to private balance sheets and has no visible feedback loop into the child-safety outcomes the law was sold on.
If you ship anything with a user-generated content surface, a chat feature, a comment box, or a social graph, the regulatory direction of travel now assumes a paid third-party identity vendor between your users and your product. Pricing is non-trivial: Persona starts at roughly $1.50 per verification at low volume and negotiates to around $0.40 at scale; Yoti and Veriff are in the same band. At a million MAU with a re-verification cadence of every 90 days, that is a four-to-seven-figure annual line item with no product value other than regulatory survival.
The architectural implication is that your auth layer is no longer a binary 'is this a logged-in user' question. It is now a three-tier model: anonymous, authenticated, and verified-of-age — with the third tier requiring a vendor SDK, a webhook contract, a retention policy you cannot fully control, and an SLA that is upstream of your own. Most teams are still treating this as a checkbox feature and discovering at the worst possible moment that their chosen vendor's SDK does not support their mobile framework, their server region, or their disability-accommodation requirements.
The practical advice for builders is unromantic. First, abstract the verification layer behind your own interface from day one — do not let vendor SDK calls leak into your product code, because you will be swapping vendors within 24 months as pricing, breaches, and regulatory approvals reshuffle the market. Second, treat age-verification data as radioactive: never store the underlying ID document, only the vendor's pass/fail token and a re-verification timestamp. Third, geofence aggressively and explicitly — the cost of compliance in a jurisdiction where you have 2% of your users is rarely worth it, and a clean block is legally cleaner than a half-implemented gate.
Doctorow's piece is sharp on the politics but quiet on the trajectory, so it's worth naming it: the age-verification industry is on the same growth curve KYC providers were on in 2014, and it will end the same way — consolidated into two or three winners, embedded in every regulated workflow, and quietly setting the rules for what the consumer internet looks like. The window to influence which vendors win, what data they retain, and what auditing rights regulators get is closing fast. For practitioners, the choice is no longer whether to integrate an identity layer — it is whether you build the abstraction yourself or let a vendor's SDK become a permanent dependency in your stack.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.