After Discord fiasco, age-check tech promises privacy by running locally. Does it work?

GMBigKev

Ars Praefectus
5,671
Subscriptor
As a bi transgender woman who probably wouldn’t have made it out of high school without accessing online discussions around gender and sexuality that were definitely not easily available in my southern curriculum, this is absolutely my concern as well. I can’t promise I perfectly toed the line at all times (the early 00’s were a different time to be online), but that lifeline (and knowing I wasn’t alone in my feelings, even if my egg hadn’t cracked and I didn’t have quality trans resources at that the time) was so important to me and my survival. It is so much more essential now.

Especially now with the animus towards transgender youth. There's bound to be a lot of them who need to find ways to escape home, or for parents to find access to things that they're not allowed anymore through their governments - or for them to find a way to escape their states.
 
Upvote
10 (10 / 0)
“Let me be upfront: we knew this rollout was going to be controversial,” Stanislav Vishnevskiy, Discord’s chief technology officer, wrote. “Any time you introduce something that touches identity and verification, people are going to have strong feelings. Rightfully so. In hindsight, we should have provided more detail about our intentions and how the process works.”
This wouldn't have changed the outcome much. Telling people upfront would have simply pushed the backlash sooner. Discord knew it was going to be controversial so they didn;t tell anyone (or delayed whatever announcements they did make to the last minute) because they knew.
 
Upvote
3 (3 / 0)
Discord also vowed to be more transparent about age-check partners, with Vishnevskiy agreeing that “you shouldn’t have to guess who’s handling your information.”
This is partly easy > Discord leaglly would have to disclose this information to Europeans under the GDPR and to citizens of California under the CCPA > so they might as well open the same data options up to all users.
 
Upvote
3 (3 / 0)
“We’ve set a new bar for any partner offering facial age estimation, including that it must be performed entirely on-device, meaning your biometric data never leaves your phone,” Vishnevskiy said.
Interesting, I only use Discord on my desktop gmaing rig. Which has zero camera hardware or functionality available. So if the platform ever flags me to run some bullshit age check I suppose I'll need to stop using the platform.
 
Upvote
3 (3 / 0)

Sadre

Ars Scholae Palatinae
1,008
Subscriptor
I started college at age 20 in NY state and most dorms had a beer-and-wine-only small lounge in the basement. My freshman year Reagan threatened all the states about highway funds (hmmm) if they didn't rais the drinking age to 21.

The next year the dorm bars were gone and drinking went way up.

Maybe youthful human behavior has changed. But I think raising the drinking age to 21 was one of the most socially destructive things we have ever done. We ensured college would become an alcohol management and supply environment as something very much front and center, in loco parentis etc..

That was not something that automatically occurred to you if you were 20 years old before Reagan and going to college. One did not say, "Cool, college = beer!" You already had been drinking on and off -- and pretty easily getting into bars -- since 16. See how it works?

Good luck, Australian youth.
 
Upvote
9 (9 / 0)
With FaceAssure, the age check is initiated without requiring a download, instead relying on an age-aware camera that returns “a vector back to the relying party,” such as Discord, which signals “that this vector will be similar for people of similar ages.”
There is no such thing as an age-aware camera, and the marketing term should be quoted to indicate that.

I'm assuming a program is downloaded (how else would it magically appear on the device) and executed. Said program probably takes a photo using a camera and analyses it returning... something.

Next nonsense term, which is at least quoted: vector. I hope it's not a picture of the user converted to a vector graphic... A C++ resizable array? A nickname for a domain specific perceptual hash?
 
Upvote
6 (6 / 0)

djstunami

Seniorius Lurkius
7
The Operating System Age Check laws in several US state legislatures are being promoted by a Facebook backed organization, and they will host the data exclusively. There is no carve out for open source organizations or devices or privacy, and the data will be in private corporate hands at all times, by law.

It's appalling. Haven't we fallen far enough?
Let's not forget that Meta did this in secret while astroturfing a "grass roots" movement, spending over $2 Billion with a B! While I'm sure it was technically legal, talk about manipulation, sheesh.
 
Upvote
6 (6 / 0)

Ravant

Ars Scholae Palatinae
1,355
I remain puzzled as to why anonymity on the internet is considered sacred (or even desirable). In the pre-internet world I grew up in, there was no expectation of anonymity—if you walked into a public space and spouted insanities and threats to others, you could expect to be held accountable. If you went into libraries and researched subjects related to bomb-making, you could expect the paper trail to incriminate you. As for our democracy, it appears to have suffered its greatest damage in the past few decades from anonymous and unaccountable purveyors of online bullshit.
I can think of at least four major use-cases for internet anonymity, in the United Sates alone:
1) Shitbirds in GOP states insist on making medical decisions political, and outlawing often-times life-saving procedures in an effort to control women. Ask for advice online about what to do post-miscarriage? Straight to jail, apparently.
2) Shitbirds in GOP states targeting trans people with harassment over what should be a private medical decision between the trans person and their doctor.
3) Shitbirds in GOP states trying to make speaking out against their golden calf a legal problem for both non-citizens with legal visas and even some naturalized citizens, and get ICE involved.
4) Shitbirds in GOP states doxxing and harassing anyone speaking ill of Mango Mussolini, creating potential safety issues surrounding individuals exercising their 1st amendment rights.

I'm sure there's more, but that's a quick 5-minute pull off the top of my head.
 
Upvote
10 (10 / 0)

Aurich

Director of Many Things
40,904
Ars Staff
I can think of at least four major use-cases for internet anonymity, in the United Sates alone:
1) Shitbirds in GOP states insist on making medical decisions political, and outlawing often-times life-saving procedures in an effort to control women. Ask for advice online about what to do post-miscarriage? Straight to jail, apparently.
2) Shitbirds in GOP states targeting trans people with harassment over what should be a private medical decision between the trans person and their doctor.
3) Shitbirds in GOP states trying to make speaking out against their golden calf a legal problem for both non-citizens with legal visas and even some naturalized citizens, and get ICE involved.
4) Shitbirds in GOP states doxxing and harassing anyone speaking ill of Mango Mussolini, creating potential safety issues surrounding individuals exercising their 1st amendment rights.

I'm sure there's more, but that's a quick 5-minute pull off the top of my head.
None of those are actually arguments for being anonymous though, not really.

They're arguments against shitbirds.

Now from a practical standpoint I of course get your point, we live in the world we live in. But if we're striving for ideals I'd rather live in a world where you were free to speak your truths, about being trans, or wanting an abortion, or telling Trump to go fuck himself or whatever.

Having to hide isn't what I want to fight for, at least as a more end game goal.
 
Upvote
-1 (6 / -7)
I don't think i am anonymous at all when i speak about the US regime. Many people must know, legally or not, what i think of this regime, the people who supported it and the people who refused to vote against its candidate for stupid reasons.

I don't care.

But i don't want random bozos on the net knowing my real name. I talk about my medical history elsewhere and it is not the business of a prospective employer, for example. Or simply strangers on the net. Or even worse those multitudes of witch hunters. Or others groups of morons who want to rid the world of evil. This is also why i am not on social networks.

Few of the people whom i talk to on the net know my real name. And i don't want to be reachable by people i consider stupid.
 
Upvote
6 (6 / 0)

Ravant

Ars Scholae Palatinae
1,355
None of those are actually arguments for being anonymous though, not really.

They're arguments against shitbirds.

Now from a practical standpoint I of course get your point, we live in the world we live in. But if we're striving for ideals I'd rather live in a world where you were free to speak your truths, about being trans, or wanting an abortion, or telling Trump to go fuck himself or whatever.

Having to hide isn't what I want to fight for, at least as a more end game goal.
Oh, I agree. In an ideal world, all 4 of those arguments wouldn't have to be even a remote thought in anyone's mind.

However, where I grew up on Long Island, and where I live now, bad actors have made the need for anonymity an unfortunate reality. And because I'm not the best communicator in the world, let me put it this way: It's an optimization problem. You have to optimize for the parameters that exist, not the ones we wish existed.

I wish autism weren't vilified to the point where certain subsets of people would prefer their child die of a horrifying disease than end up being a "person like [me]." I wish being part of the LGBTQ+ community wasn't getting so viciously attacked that denying ones' own perception/reality and living in the closet was the "safe" option. I wish women and minorities could be treated like fellow human beings, being granted all the same rights/protections/doctor-patient-confidentiality/access to the Bill of Rights as old white men.

But in America in 2026, none of those wishes are presently a reality. And the fact that "Think of the Children" is being an excuse to whittle away at the one bit of anonymity that affords all of those vulnerable people a chance to communicate without fear of reprisal should be pretty obvious by now.

Do children need to be protected? Yes, as kids we were all bloody stupid. We lacked life experience, we lacked a fully functioning prefrontal cortex. We lacked a lot of things. That's what parents are for. Parents should be protecting their kids. Not the rest of us. We shouldn't be handing over our last bastions of sanity to a cabal led by a 34-time-convicted felon with further allegations of pedophilia against him. And we certainly should not be handing over further biometric data to data brokers that will further profit off an ever-increasing surveillance state.

Should there be basic gates in place to prevent a minor from accidentally stumbling over something potentially permanently-scarring or damaging? For sure. But the proposed methods are untenable and far overreaching.

Let me get an anonymized one-time-use credit card number from my financial institution that can be recycled/thrown away after its one-time use, instead.
 
Upvote
5 (5 / 0)
Online age checks will forever be illogical and inherently worthless because there's no way to prove that the current user of the device on the other side and the ID they're providing for that check are actually the same person. None. Zero. Nada.

Like I don't even understand how people don't see this. It seems like the most basic logical reasoning to me.
 
Last edited:
Upvote
6 (6 / 0)

jdale

Ars Legatus Legionis
18,261
Subscriptor
I post all over the internet under my real name. Not just here at Ars.

It's not hard to find me in other communities, I'm pretty much the opposite of anonymous. When I speak it's not hiding behind an identity.

I'm not suggesting everyone else needs to do that, simply that I made that choice decades ago, and I speak my mind on things still. So do plenty of other people. Frankly once you become any level of public figure with any kind of reach with your voice it's actually very difficult to be anonymous.

None of that stops people from using the internet. Or participating in debate or democracy.

There was a quaint period of time when sites flirted with the idea of "if people post under their real name they'll be better behaved!" That uh, didn't pan out. Turns out people are happy to show their whole ass even when their first and last name is attached to it, see Facebook.

There are all kinds of reasons people might still wish to stay anonymous. That's fine, I'm not arguing against it. Simply stating that I don't believe being anonymous has anything to do with a functioning democracy or society.

And honestly people are way less anonymous than they think they are even when not posting under their real name. And that's because the laws that allow scummy tracking are a real problem.

You are being fingerprinted at every turn. You are on camera when you leave the house. You are profiled left and right.

If I had a choice between two binary decisions, protecting being anonymous or protecting people's data and privacy rights even if every post they made had their full birth name attached to it I would take the privacy protections every time.

Now it doesn't need to be a binary choice! It shouldn't be. But in terms of ranking importance that's how I would put them.
It's kind of a false choice. If all your communications are signed with your name, aggregating them is trivial, and associating them with your other data is trivial. In that scenario, you could have laws protecting your privacy but they would be largely performative; in reality, you have lost significant privacy there.

I get where you are coming from, and acknowledge the point that anonymous speech can do considerable harm. That might be better addressed by taking threats and slander more seriously than the legal system currently does.
 
Upvote
6 (6 / 0)

Aurich

Director of Many Things
40,904
Ars Staff
It's kind of a false choice. If all your communications are signed with your name, aggregating them is trivial, and associating them with your other data is trivial. In that scenario, you could have laws protecting your privacy but they would be largely performative; in reality, you have lost significant privacy there.

I get where you are coming from, and acknowledge the point that anonymous speech can do considerable harm. That might be better addressed by taking threats and slander more seriously than the legal system currently does.
I think it's more about scope and context. For instance, walking down a street you might be recorded—you're in public, that's probably something reasonable to expect. But there's imo a world of difference between walking in front of my neighbor's doorbell camera and being on their personal recording vs being recorded everywhere I go by Flock cameras that are compiling and cross referencing all my movements.

My expectation of privacy is about data collection, not being masked in public in other words.
 
Upvote
5 (5 / 0)

Korios

Ars Scholae Palatinae
1,470
I've used Yoti in the past for ID/age verification. It was very cumbersome and time-consuming, with multiple failed efforts. In fact it took me weeks to make it work; it would not accept my oldish National ID or work via my laptop's 720p webcam. Eventually I managed to do it, again after failing a few times, via my mobile phone's high res camera and my newly issued passport.

I've used a few other ID/age verification systems too, such as (Twitter)X's, Meta Verified (FB, IG and Threads) and Stripe (to get paid). The simplest system I've used, and the only one that worked with the very first try, was that of LinkedIn. If you have a passport with an NFC chip (like all modern EU passports and I believe US passports) all LinkedIn needs to verify your ID and age is to install its mobile app and pair your passport with your mobile. That's it.

I don't recall being asked for a face scan by LinkedIn (unlike Yoti and Meta), nor did i need to send a photo of my passport. The NFC chip contains all the required data. And, last but not least, unlike X Premium and Meta Verified, LinkedIn's verification is fully free. It has a Premium plan too, but that's distinct from its verification.
 
Upvote
2 (2 / 0)

Korios

Ars Scholae Palatinae
1,470
Upvote
7 (7 / 0)

Korios

Ars Scholae Palatinae
1,470
Online age checks will forever be illogical and inherently worthless because there's no way to prove that the current user of the device on the other side and the ID they're providing for that check are actually the same person. None. Zero. Nada.

Like I don't even understand how people don't see this. It seems like the most basic logical reasoning to me.
Indeed, there's no way to prove that via ID alone. Which is why Yoti and similar systems do not rely just on an ID/passport. To get ID/age verified via Yoti et al you need a gov ID, passport or driver's license and a live scan of your face matching your ID picture.

Some verification systems additionally even ask for a video where you need to speak your name, the current date, and mention the service you apply for verification.

If your current face does not match your ID picture the verification will fail. If your ID is old, wrinkled or expired it will also fail. If your webcam is low res, your ID document is glossy, and your lighting's glare obscures anything in the document, the verification will, again, fail - particularly with Yoti.

If you go through a modern age verification system you'll understand intimately how it works, and why it's virtually impossible to fool them. I have gone through many, or else I couldn't get paid. Yoti was the worst by far; it was designed by sadists. LinkedIn's system was the direct opposite. It was a piece of cake to get verified, since they do it via NFC and their mobile app.
 
Last edited:
Upvote
2 (2 / 0)

AliSard

Smack-Fu Master, in training
66
Subscriptor
I want to back this up. Used to work in primarily low-income schools. As in 90-97% free and reduced lunch. I worked with a lot of kids who had siblings and single mothers that worked multiple jobs just to keep a roof over their heads and some food on the table. A lot of kids barely see their parent or parents. Or guardians.

It does suck and it's bad for the kids. And it's bad for the adults. And you can rewind as far as you want to say "you shouldn't have had kids then" but that doesn't fix a thing. "Shouldn't have" isn't a workable solution. We have layer after layer of systemic problem that does make parenting and supervision really, really hard. Universal childcare and healthcare would go a long way towards fixing that.

But ultimately, this is the system working as intended to keep the underclass on that edge of precarity. And I get very frustrated with people who should have the context and knowledge to know better continuing to believe it's just a matter of bad parenting.
First, thanks for not jumping on the tiresome blame-the-parents bandwagon.
My point was that any such system is doomed to fail (a popular line unless you bring parents into it apparently), and in fact will do worse than fail because it might provide a dangerous false sense of security.
All the tech, all the good parenting, is NOT going to keep kids from eventually finding 4chan, porn, climate denial nonsense, NONE of it.
The only way is to prepare them for when they do.
 
Upvote
5 (6 / -1)

MedicalGeek

Ars Scholae Palatinae
879
Subscriptor++
That has nothing to do with what I was responding to though.

In a world with sensible and enforced data privacy laws for instance that wouldn't be an issue. That's entirely separate from anonymity.

The problem isn't that they know who you are, it's that the information on who you are and where you go and what you do is collected and sold.
If they know who you are they will sell and spill all your info.
 
Upvote
2 (2 / 0)

balthazarr

Ars Tribunus Angusticlavius
6,838
Subscriptor++
"In a world with sensible and enforced data privacy laws for instance that wouldn't be an issue."
Pfft... that requires:

1 - actually following the law(s). With this (mal)Administration? Good luck; and
2 - no "workarounds" completely neutering the intent, like how the USA circumvents the 'no spying domestically' by leveraging their Five Eyes partners to do it for them, or just buying data that the Constitution says they need warrants for (so can't have wholesale, but need a judge's sign off on a case-by-case basis).

Bottom line, if the data exists, someone, somewhere — lots of someones, most everywhere — will abuse it.
 
Upvote
6 (6 / 0)

jdale

Ars Legatus Legionis
18,261
Subscriptor
There is no such thing as an age-aware camera, and the marketing term should be quoted to indicate that.

I'm assuming a program is downloaded (how else would it magically appear on the device) and executed. Said program probably takes a photo using a camera and analyses it returning... something.

Next nonsense term, which is at least quoted: vector. I hope it's not a picture of the user converted to a vector graphic... A C++ resizable array? A nickname for a domain specific perceptual hash?
I'm not finding any direct matches, but in general, a vector is a direction and a magnitude. One might encode the age and the other the certainty level.
 
Upvote
0 (1 / -1)
“Age verification tech is coming” not if we fight it. And we must fight it. Because it’s bad for everyone.

It doesn’t protect children, it actually makes them more vulnerable by exposing their ages

It exposes everyone else to hacks of our most sensitive information. And they will get hacked because there’s no such thing as perfect security

And even worse, it’s going to be used by repressive governments like the one currently in power in the US

It’s insane to give governments this kind of power during a global crisis with fascism and authoritarianism.

And it’s insane to think the same government that continues to cover up the Epstein files cares about the safety of children. If anything, they’ll use it to find the children online and target them
 
Upvote
8 (8 / 0)

Quixotic999

Smack-Fu Master, in training
70
Indeed, there's no way to prove that via ID alone. Which is why Yoti and similar systems do not rely just on an ID/passport. To get ID/age verified via Yoti et al you need a gov ID, passport or driver's license and a live scan of your face matching your ID picture.

Some verification systems additionally even ask for a video where you need to speak your name, the current date, and mention the service you apply for verification.

If your current face does not match your ID picture the verification will fail. If your ID is old, wrinkled or expired it will also fail. If your webcam is low res, your ID document is glossy, and your lighting's glare obscures anything in the document, the verification will, again, fail - particularly with Yoti.

If you go through a modern age verification system you'll understand intimately how it works, and why it's virtually impossible to fool them. I have gone through many, or else I couldn't get paid. Yoti was the worst by far; it was designed by sadists. LinkedIn's system was the direct opposite. It was a piece of cake to get verified, since they do it via NFC and their mobile app.Phone i
Phone image capture is never a single iteration. So frustrating and will drive customers away! It depends on the camera/software capability (optics, sensor resolution, near focus, low light sensitivity, contrast, image stabilisation, image processing etc). For instance, where the contrast is low or you shake too much and the detection algorithm is very prescriptive or has to err on the side of caution.
 
Upvote
1 (1 / 0)

stoattiep

Smack-Fu Master, in training
53
I think this is the real crux of it. These days applying a voice/face filter can be done on modest hardware, and if that's what it takes to trick these solutions then a bunch of businesses will rush to market with software offering exactly that.

Then these age verification firms will want kernel level access to verify that nothing is altering camera or audio input...

And this is before even considering that the easiest method of bypassing these controls is to simply visit sites or use services that don't implement them. Something which we have absolutely no realistic way to prevent.
No, that's like saying "we don't have to worry about AI because it's bad so no one will use it" and then AI got good enough that too many people use it.

Or like "It's okay that Microsoft makes you sign up for an account in Windows 10 because it's easily bypassed" but then they made it harder in Windows 11.

What we need is strong protections AGAINST identity verification. Age verification, imo, is technically okay because if I only have to prove my age, not my identity. But it's one small step away from your real identity being tied to your all your online activity, which is a terrible for privacy and free speech.

Saying "well the evil system doesn't work very well so don't worry about it" assumes the evil system can't be improved.
 
Upvote
7 (7 / 0)