Thank you for taking the time to properly respond

I appreciate your civil response here. We may or may not disagree (it honestly might just be different words/talking about different things, despite a fundamental agreement on what makes for good policy), but this feels to me like good respectful discussion, and I appreciate that.

My slow responses are mainly just because I'm very busy IRL at the moment and not spending much time on the fediverse.

“Noble” intentions, at poor implementations lead to exactly bad outcomes.

Full agreement here. Please don't misunderstand me. The Australian government's policy is a bad one. I just think it's important to distinguish between policies that have bad intentions and ones with good intentions bad bad implementations. Because our approach to the two is not necessarily going to be the same.

For example, a few years ago the Australian government passed a policy that gave the government the power to require any tech company in Australia to put in back doors at the government's request, with no notice to customers or users: it has to be completely secret. There was even some talk about how it could require an individual developer to sneak in the backdoor against their company's knowledge, though I believe that last part was not accurate. This is bad policy with genuinely bad surveillance-oriented intent.

I don't believe the social media minimum age laws are in that category.

I will assume you meant Australia’s implementation

Yes, I do. Because this is an instance run by an Australian, using the Australian ccTLD. I cannot comment with any degree of intimate knowledge about how other countries are doing it, nor do I think it's relevant in this community.

I do not want to “protect”-wash laws meant to survey people

If it's meant to survey people, I absolutely don't want it. If it's not meant to survey people, but could incidentally have that effect, I also don't want it. But in the latter case, I might be happy with tweaks to it which achieve the intended outcome while avoiding that problem.

If I can step back a minute, I believe—and I hope we can agree—that social platforms run by big tech companies like Meta are causing harm to children (and probably to adults as well, but let's focus on children for now). And that, therefore, if you could wave a magic wand and prevent children from using these platforms without any other effect or any data collection/processing, that would be a good thing. If you don't agree with that, then I don't think we can ever agree in this conversation at large, but hopefully you can at least respect that position.

I personally believe the best way to achieve this is without any real verification. The answer is to use parental control systems that run on individual devices. Mandate that operating systems and browser vendors include a flag that can be set by its users and locked with a password. That flag would be available to all apps running on that device. Then parents could, at their own choice, set that up for their children. There's no looking at ID. No AI analysing faces. Just parents setting their child's device up how they want it. And social media sites, if designated by the government, would be required to access that flag via an API and honour it. Small sites that don't use addictive user-tailored algorithms would not have to fear being designated, but Facebook and Instagram definitely would be.

An alternative approach that I would also be ok with is one I've explained a few times on my account @zagorath@aussie.zone. You can search for it if you're interested in the details. But in summary, it involves blinded signatures so that there is serious age verification, but it's done in a way that is technologically impossible to track. The social media site can verify that you were age verified, but not see any information about what you provided to the age verifier in order to get that verification. And the verifier can see what information you provide them to do their job (e.g. a photo of your ID or video of your face), but it is impossible for them to know which sites you are accessing using their verification. It's technically possible to do this, but it would require a government mandate for companies to actually implement it this way. A data leak could expose "Zagorath on Quokkau was verified as being old enough", or "John Smith born 1st Jan 1970 was verified as old enough and here's a video of his face" (depending on whether Quokkau or the age verifier had the data leak), but it could not make the connection that "Zagorath on Quokkau is John Smith born 1st Jan 1970".

Pretty much any other approach, including the one our government went for (which was basically "you figure it out. You have to do it, but figure out how by yourself—oh and you're not allowed to keep the data.") goes too far into the realm of risking users' privacy. If everyone's following the law and has good technology and security practices, it's actually kinda ok. But I don't trust that they'll follow the law, and I definitely don't trust that their security will be good. Because we've seen both of those problems happen in the past far too many times.

Does that all make sense?