The post says the phrase "age verification" hides what is really being built: systems that force people to prove identity or adulthood before accessing ordinary online services, which creates a durable trail of who did what online. The core claim is not that protecting kids is fake in every case, but that the political and commercial path of least resistance leads to broad surveillance, outsourced to ID-check vendors, app stores, device makers, and governments.
That framing landed with most readers. The strongest consensus was that the technical details matter less than the institutional incentives. Even where cryptography can prove "over 18" without revealing a full identity, lawmakers, platforms, and verification vendors still want anti-sharing, anti-fraud, and compliance hooks. That pressure drags systems toward device binding,
remote attestation, account linkage, and logs. Several people walked through
EU digital identity wallet designs and showed where the privacy story breaks down in practice. Stable device keys can become tracking identifiers. Rotating or single-use credentials help, but introduce issuer-side logging and verifier collusion risks. The bigger practical problem is that these schemes often depend on secure enclaves, app attestation, and locked-down phones, which means more power for Apple and Google and less room for
Linux desktops, rooted phones, custom browsers, and generally open computing.
A lot of the useful discussion converged on a different model entirely. If the actual goal is to keep kids away from certain classes of content, the cleanest approach is to make websites and apps label their content and let the browser, OS, or parent-controlled device decide whether to show it. That avoids turning every site into an identity checkpoint. People pointed out that versions of this idea already exist in TV and web labeling, and that California-style proposals are moving in this direction. The thread was blunt about the tradeoff though. Any system strong enough to stop determined older kids starts to resemble device lockdown. Any system light enough to preserve user freedom is bypassable. Many commenters accepted that as fine. They argued age controls should be judged like alcohol rules or parental controls, by adding friction and shifting defaults, not by achieving perfect enforcement.
Where the conversation really settled was on trust. Very few people believed governments, platforms, or third-party age-check vendors would stop at narrow, data-minimized checks when richer tracking, liability shields, and competitive moats are on offer. That is why even commenters who said privacy-preserving age proofs are technically possible still opposed the laws as written. In practice, the likely rollout is more ID scans, face scans, provider logs, and pressure to use approved hardware and software. The thread treated that as the real warning sign, not the cryptography whiteboard version.