Zurzeit sind leider noch viele Jüngere auf den Plattformen unterwegs. Wir sollten deshalb eine Altersverifikation einführen, bei der man den Ausweis präsentieren muss sowie den Ausweis der Erziehungsberechtigten.

Beyond the privacy issues, these systems also pose a cybersecurity risk. In a world where data breaches and cyberattacks are commonplace, we generally encourage the collection of less, not more, sensitive information. A stored collection of government-issued photo IDs and face biometrics is a glaring target for hackers and identity thieves.

Einigermaßen zuverlässige Alterskontrollen gibt es nicht ohne bedeutsame Nachteile. Viele Methoden erhöhen die Gefahr von Datenschutz-Katastrophen. Viele Methoden schließen vulnerable Gruppe von digitaler Teilhabe aus – etwa Menschen ohne Papiere. Wie man es dreht und wendet, unter den strengen Kontrollmethoden gibt es keine, die nicht schwere Bauchschmerzen bereitet.

Proponents of ID-based age verification compare this process to checking an ID at a bar to purcahse alcohol. But the situation online is quite different from that. When a bartender manually inspects an ID, we forgive this minor privacy violation partly because we deem it unlikely the bartender is going to write down our name and address, record our activities, and sell the information to others for profit.

Since today’s “Are you over 18?” checkboxes work perfectly fine to block accidental underage access, it would seem one of the goals of strict ID-based age verification is to block intentional access. But tools already exist that limit intentional access—and in a much more flexible and privacy-respecting way than ID verification. Parental controls on devices, operating systems, networks, and routers already limit access to these websites, and they do so without collecting any IDs at all.

While I share these policymakers’ desire to make the Internet a safer place for children, this is not the way to do it. This goes way beyond checking age. These laws effectively mandate the collection of an ID—the epitome of personally identifiable information (PII)— from all visitors to these websites. These laws are a disaster for privacy, and create incentives that will only worsen the problem over time. They will be a security disaster, since all the ID information is a gold mine for identity theft. This will not actually create the online environment we want for children.