a couple thoughts about discord and age verification

14 Feb, 2026

let me get this out of the way first: I think "age verification" is a stupid idea. it has been cheated for centuries, it will continue to always be cheated, and it is a hideous attempt to wallpaper over a culture of parenting and structural business incentives which are completely misaligned to nurturing and protecting children in a real way. we all know at this point that the realm of stuff which is "inappropriate for kids" is not a concrete category and people are in a continuous struggle to keep it from expanding to cover perfectly chaste information which can comfort and educate young people who aren't straight or cis.

however, I think people online who expect tech companies to resist age verification where and when it becomes legally required are delusional. governments make it clear up front what the cost of not enforcing age verification are: massive ongoing fines or being completely prevented from doing business at all in their jurisdiction. with very few exceptions¹ I don't think any tech company has the practical ability to force a state to cave on this, especially in an environment where materially, the social media landscape is maybe a dozen different companies competing to blast more effective advertising at people 168 hours a week, and without a unified front, the issue will quickly be reframed as "oh so Yoyodyne is going to the mat attempting to defend their god-given right to show hardcore sex to children, I see how it is. if your kid has Yoyodyne installed on their computer, uninstall it and tell them to go use Facebook or Roblox instead. neither of those companies have ever harmed a child."

I'm not sure abandoning existing oligopolists for market entrants that claim a position of noncompliance is ultimately tenable either -- the idea that organizations that are smaller will be more able to fight City Hall is obviously foolish, so ultimately I think you're relying on being able to find gathering places that are both vibrant and also too small, or too difficult to identify the ownership of, to be subject to government enforcement.

https://www.tumblr.com/foone/808375158324756480/the-annoying-thing-about-the-privacy-nightmare

the annoying thing about the privacy nightmare that is age verification is that this is 100% doable with double-anonymity: The verifier doesn't know what site/app you're verifying your age on, and the site/app doesn't need to know your personal information.

The fun part is that you could do this extremely easily by just bundling a key with an item you can't buy unless you're 18. Like a beer that includes a PGP key, or a pornographic magazine with a page that's a randomly generated key.

The site/app doesn't need to know WHO you are, only that you have access to something you can only get by being 18. This way they're putting the burden of verifying your age onto someone else, someone else who is already legally required to do exactly that.

foone, I love you but this is one of those One Weird Tricks that sounds good at first but is maybe even worse than the status quo.

to begin with, there's something comical at a fundamental level about it: "simply verify the user's age by tying age verification to an object that everyone knows it's impossible for teen boys to get access to, like beer or porno mags."

second of all, Ye Olde Vices of alcohol and paper pornography² are also in a state of active struggle. there are parts of the US where you can't buy beer on a Sunday. there are parts where you can only buy beer in a private club. even in the US, tying people's access to community to their access to alcohol could create, say, small towns where access to reproductive health depends on whether you can order a drink at the bar under the Baptist church run by three good ol' boys who are hopeless gossips and friends with the police chief. and this is leaving alone the fact that these vices are completely inaccessible to large numbers of people on a global scale for reasons of state religion.

obviously, this was a Modest Proposal and I'm not gonna dig at you too hard over it, but it helped me realize something that I think is worth stressing: tying age verification to something with significant uncontroversial use (driving a car, getting a bank account or credit card) is actually a feature, not a bug. for the purposes of uniformity of documentation, the licensing bureaux have already congealed up to the state and federal levels over a century; this means that they are governed by large political divisions, which lots of people are stakeholders in. the government issues IDs to you at cost, and even in the driest, reddest county, nobody will say that you shouldn't be able to get a photo ID unless you go to a private club, and nobody is trying to claim that gay people shouldn't be able to drive cars³.

that said, you're right -- the thing that verifies your age doesn't have to, and shouldn't, be the thing that carries all of your PII. one could easily imagine a driver's license which has a machine-readable barcode on the back⁴, separate from your PII, that, by statute, contains the exact same cryptographic proof of how old you are that would theoretically be on The Beer That Lets You Use TikTok, and nothing else. there would be no PII to safeguard because there was no PII in the photo to begin with.

which gets us to the other, harder problem: nobody actually wants to build privacy-preserving age verification; this isn't just confined to the advertising-industrial complex. age verification's most fervent advocates don't give a shit if people who were looking for porn or mifepristone or gray-market HRT get doxed by doing so; age verification's biggest opponents don't yet consider it a fait accompli so they're not tempted to participate in building new tools which could help make it easier to swallow; governments don't want to reissue entirely new driver's licenses again, right after they got done reissuing entirely new driver's licenses the first time because the Bush administration decided your driver's license should tell the cops whether you're a citizen or not⁵; companies in the age verification sector want to keep their hands on as much PII as possible so they can keep making increasing profits after the initial rollout finishes.

meanwhile, the communications platforms which are most subject to these requirements are hoping for this all to blow over without too many data leaks, a far-right boycott, or all the monetizable teens getting locked out of their accounts, all of which are bad for business. (supposedly, the reason Discord was able to do age verification with "video selfie"-style facial scans that never left your cell phone was because, once you looked old at your phone, Discord got a secret API call that said "this user is above 18" with no further information provided, flagged your account, and you went on your merry way. a little reverse-engineering immediately revealed this, and people posted publicly about it, and now, the rumor is, Discord is going in search of other, more intrusive service providers for age-verification facial scans. the lesson: sometimes a poorly implemented security measure isn't a sign of incompetence, it's a small courtesy from people who didn't want to build it either, and calling too much attention to it is bad for everyone.)

maybe -- hopefully -- the dynamics will change in a couple years, as civil libertarians give up hope on killing age verification entirely (or maybe win the fight⁶), and as the far right gets increasingly despondent about how its kids continue to be gay in spite of them having to scan a photo ID to talk to other gay people, and moves on to doubling down on seed oils or phytoestrogens or whatever.

#online #politics