>This system, referred to as “double anonymity”, means the porn site receives only a yes-or-no confirmation that the user is of legal age. The age-check provider knows who the user is, but not which sites they visit.
I don't know the specifics, but seems very reasonable if implemented matches the promise. If it's required also for some non porn sites (social media? gambling maybe), there should be no stigma attached either.
I believe that the EFF talks about it here: https://www.eff.org/deeplinks/2025/04/age-verification-europ...
They question the quality of the Zero Knowledge Proofs (something like "it's still new") and raise what I find the more interesting question: "who will be left out?". Not only for porn, that is.
To the "Who will be left out?" question, mandates like these should come with statutory {must issue} requirements.
Much of the Secure Boot crap could have been avoided if all devices had been required to have a user-accessible mode that trusted a must-issue signer of last resort, and that signer was broadly available.
E.g. LetsEncrypt for devices
If on the one hand we want to improve security via encryption/verfication, then on the other hand we must remove the governments' and corporations' abilities to abuse it.
At minimum, the government gets a "ping" when identified citizens visit adult sites requiring the age check, so they can keep a record. In worse scenarios, maybe some identifier leaks through that can also identify which site they visited. And of course, the identification apps can be hacked through supply chain attacks etc.
Without knowing the specifics, this is not necessarily the case. It could be implemented without needing to ping "the government". As a strawman idea, there could be a monthly refreshed distributed database of booleans per citizen identity and accessed through a keyed hash.
There is a very possible attack. Open a porn website, buy ad traffic in France, once users are here, claim identity needs to be verified. In the background, start the process to open a bank account in one of these online banks and act as a relay in the verification process.
Is that an actual thread model, and or are you just making stuff up?
I'm asking because even oauth would make this kind of attack vector impossible, as the referrer and redirect urls are verified - and I sincerely doubt they're so incompetent not to do something similar in such a context.
It is a relay attack.
There are a lot of verification platforms, so the idea is that the user is asked to be verified and that his proof of identity is reused in live for something else. In the addressbar, user sees "dangerousporn.com" -> "safeidentify.com"
The operator of "dangerousporn.com" starts (manually) an application to a [bank account / crypto exchange "bank.com"], using a fixed residential proxy (Luminati / Oxylabs, etc).
Once a victim arrives on "safeidentify.com", the user that is on "safeidentify.com" is asked to follow the actions that "bank.com" is asking to do (upload your ID, turn head left, turn head right, up, down).
"safeidentify.com" plays back the recorded video on the KYC platform of "bank.com" using an emulated Webcam.
Difficult ? Yes and no, but manually doable on a case-by-case basis, and you don't need thousands of victims as it is really worth.
to begin with, youve already switched the hacker from an advertiser to the operator running the website.
but ignoring that: none of what youve written there has been enabled by an identity provider hosted by the state. These scams already exists, today and various "special" users fall victim to them.
but lets ignore that too: these verifications are usually done interactively and cannot simply be played back, as you need to actually react to the actions of the person verifying your identiy
but lets ignore that too: its _highly_ unlikely the service will make users upload IDs and get verified via video etc on every connection. I'm gonna bet this is a one-time action, and after that you'll probably have to simply authenticate via 2-3 factors (username, password, biometric, sms, email, e-pass, certificate etc) - so what you're insinuating (this service makes people numb to such situation) is implausible. Especially in the context this scenario is in: merely verifying >18 yo
> you need to actually react to the actions of the person verifying your identiy
yes it's exactly the point, use porn websites as a hook to convince the user to do your actions to verify their "identity"
Is it financially viable? Do you happen to know roughly how much these services cost?
Because it's easy to say "just use that third-party service" but if the cost of that service is well above the profit margin of a porn site, the site cannot really do it.
I think it could be a government website that gives you an anonymous token. The government checks your age from your identity (some "eID") and gives you a token that is "difficult" for them to track (see e.g. Privacy Pass [1]).
Then you pass this token to your porn website and they can verify that this token means that you have the required age. But the porn website cannot identify you.
Not sure about the price of such a service, but it would be paid by the public.
It seems the law allows either a government website, or 3rd party provider for the age checks, it doesn't mandate either.
> Use an age verification provider that is legally and technically independent of any online platform hosting or providing porn content - https://www.yoti.com/blog/france-age-verification-law-adult-...
So, could be a government website, but likely for-profit companies will try to capture it by any means necessary, the very least a lot of lobbying.
In theory the government could operate a free service for the benefit of porn companies, but in practice I don't see that as very likely to happen.
> for the benefit of porn companies
Or for the benefit of the children who have a harder time accessing the porn sites, maybe?
It seems to me a much better way would be to require porn sites to check for an HTTP header that says the user is underage, and to require major consumer OS vendors to implement it.
There are minimal privacy implications; it could also be applied to privacy laws and the like protecting minors; it would be trivial for sites to comply.
Not sure if it's just a "trust us" thing, but a way to accomplish this would be anonymous credentials.https://csrc.nist.gov/presentations/2022/stppa4-anonym-cred
At the very least, wouldn't the age verification site know the API caller requesting verification? How else would it send a callback indicating that the user was or was not of legal age?
> This check must be carried out by an external service, not the porn site itself
> the porn site receives only a yes-or-no confirmation that the user is of legal age
What does the external service receive?
There are cryptographic ways to do that (e.g. [1]), making sure (or at least "difficult") that the external website cannot track you.
If 99% of reason to get verified is to look at porn (and let's be honest, near 100% of those who want to be verified after midnight), then the website doing the actual verification of identities has a list of people looking at porn.
No amount of cryptography can protect against this. Now, if the French government issued tokens preemptively to everyone, that would work, but then it becomes trivial for to copy the tokens.
> If 99% of reason
Sure, if you start with convenient assumptions, it's easy to prove your point :-).
Now let's imagine that people don't need a token for each session but to create an account. Suddenly they are not asking for tokens after midnight, and not repeatedly, right?
Let's push it as far as saying that other websites may need verification, e.g. social media. And for the sake of the argument, let's imagine that there are more than one social media. If the token issuer receives 4 requests from the same person, is it for 4 social media? 2 social media and 2 porn sites? Not so clear anymore.
Finally, let's pair it with an "eID" app. So people get the app to use an electronic ID (which is presumably useful for things that are not porn). Let's say that when you install the app, it gets 5 age tokens for you. You may or may not use them, it just creates them. Now the token issuer sees that everybody gets 5 tokens. Difficult to say that they all need to access 5 porn websites, isn't it?
I don't know if age verification is fundamentally a good thing. But "no amount of cryptography can protect against this"... I don't know.
> that would work, but then it becomes trivial for to copy the tokens.
Anyway it is trivial for a child to ask their parent to give them access to porn. The whole idea is that usually, parents won't do it.
There are always ways. But I asked what is that external provider actually receiving. Or to put it differently, what is it allowed to receive.
If the law forces down people's throats an intermediary between them and a porn site, then it better also force the intermediary to guarantee anonymity.
> There are always ways.
Hmm...
> But I asked what is that external provider actually receiving.
Sure, I don't know. What I'm saying is that at least it seems possible to make is reasonably private. That's better than if it was impossible, e.g. putting a backdoor in E2EE "only for the good guys". But then I would be contradicting your statement that "there are always ways", so... well.