this is very confusingly written. the use of "voluntary" makes it sound basically ineffective, as it can be read like "no id necessary for places that don't need id"
post
Signed.
This initiative is just a smokescreen; it actually pushes things down the slippery slope.
Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law. The legislation should require anonymous or pseudonymous proof-of-age, data minimisation, selective disclosure
Define "necessary". Define "by law". The pushers for proof-of-age already say it's anonymous – but it can't be.
Supported. Next, start a petition to criminalize politicians pushing the same crappy laws again and again in the hopes they at some point pass.
Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law.
Are you not aware of the Digital Services Act? This piece of legislation alone, provides all the incentives for service providers to do exactly that; unless they change their business-model, which is rather unlikely. By default, users should be treated as adults and therefore unrestricted in their access; rather than children unless proven otherwise.
If the EU would simply mandate operating systems sold within the jurisdiction, to allow specification of an optional 'date of birth' field, which is local and purely on a trust-basis (no external verification required); this should be more than sufficient for signaling an age-bracket to a service, which may then serve an "age-appropriate experience".
A digital identity wallet should be strictly reserved for matters that already required personal identification. Using such heavy-handed measures for controlling access to adult content, or even social media, is complete and utter overkill. I'm not interested in more empty, technical, server-side "trust me, bro" promises, for something that is fundamentally disproportional.
this should be more than sufficient for signaling an age-bracket to a service, which may then serve an "age-appropriate experience".
nothing should be signaled to any service. the service should signal its age limit, and the local software needs to compare the limit with the user age. that too could happen on a per content basis, I guess HTML or CSS could be extended with a new property for that.
then, if the user age is below the limit, the browser should continue loading the page as usual, but hidden from the user, to avoid introducing a new vector for fingerprinting.
A digital identity wallet should be strictly reserved for matters that already required personal identification. Using such heavy-handed measures for controlling access to adult content, or even social media, is complete and utter overkill.
or even to government services portals that did not require personal identification.
Everyone don't forget to Sign, Cross-post, Federate and Share everywhere you can !
This initiative is just a smokescreen; it actually pushes things down the slippery slope.
Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law. The legislation should require anonymous or pseudonymous proof-of-age, data minimisation, selective disclosure
Define "necessary". Define "by law". The pushers for proof-of-age already say it's anonymous – but it can't be.
I asked theses questions to the person in charge, and published the response, you can read both questions and answers here : https://lemmy.world/post/51227026/25554402
I find the person's answer very disturbing and twisted:
The battle that can still be won is over whether using them stays a free choice.
Note how he/she is speaking as if EU was Russia. There's a regime that governs on us; we can try to fight it. This is not democracy, where the goverment represents the people and the people's will. Either – very likely – this person has simply accepted (and I don't know how good such an attitude is) that EU is not a democracy; or they have unclear ideas about democracy.
“Unless strictly necessary, proportionate and provided by law”: this is not our invention and not undefined. It is the limitation test of Article 52(1) of the Charter of Fundamental Rights, the standard the Court of Justice applies to every restriction of fundamental rights.
Well they don't write that in the initiative's text. They just say "unless provided by law". This means that if a law passes that mandates chat control, or age-verification for accessing all internet, then it's OK with them – it's provided by law now.
I stand corrected, they specify "Articles 7 and 8 of the Charter of Fundamental Rights" in the Annex. But I still think this is poorly written: why not explicitly mentioning the main message of those Articles in the main text? That "unless provided by law" in the main text is extremely ambiguous without the Annex.
I agree it needs to be well defined. But there are government and private services that require identification and uploading selfies and passport pictures onto random websites is worse than a regulated ID service that can provide a trusted API.
There are tons of risks though: data gathering, privacy invasion, censorship, disproportionality...
That's why I prefer good regulation. One that also defines when it's "necessary" and when it's inappropriate to the point of illegal.
Let's add more conditions: privately owned or managed brings the risk to open up the "service" to more and more websites that don't need or shouldn't require your identity. If it has no monetary interests that risk is reduced. Not when you live in an oligarchy though...
do we sign it this way? it would just agree to doing nothing but with fancy words, wouldn't it?
No, we don't; it's exactly as you say. My impression is that this is something organized by the pro-chat-control and pro-age-verification lobbies, to deceive with words people who are against. They get them to sign and then they can say "people signed for this!".
Yeah, I was about to "sign" until I had to provide the data which we sign to not have to provide. Great. I mean I get it, but feels weird still
Déanta ✍️
Signed, but be careful, the website is shitty and does not let you out with the back button.
We call on the European Commission to propose legislation ensuring that digital identity and age-assurance systems used to access online services in the Union remain voluntary, privacy-preserving and non-discriminatory. Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law. The legislation should require anonymous or pseudonymous proof-of-age, data minimisation, selective disclosure, open-source implementation, independent security audits, prohibition of cross-service tracking by relying parties, and equivalent alternatives for citizens who do not use a digital wallet.
Yeah, nah.
I get the feeling the StopKilling[Thing] people are starting to push for weaker and weaker laws just so that they can say they did something. EU commission shot down your games initiative? No worries, the already proposed Digitial Fairness Act does the same thing anyways!
California's proposed bill completely ignores preservation by allowing games to be deleted so long as purchasers receive a refund? That's a win!
Also I just looked up the California bill, it has been amended.
It used to read:
A refund in an amount equal to the full purchase price paid for the digital game by the purchaser
Now it reads:
A refund in an amount equal to the highest price of the digital game offered by the digital game operator within the 12 months before the digital game operator ceases providing services necessary for the ordinary use of the digital game.
So if the studio drops the price to $1 a year before taking the game away then they can delete everyone's copy by giving them $1 without breaking this law.
The StopKillingGames people made a fanfare about the initial legislation, but they seem to be silent on this amendment.
Yeah, I read the language on their website and they seemed to be holding a much stricter line. Here the line seems more blurry where :
- in that same paragraph they say "remain voluntary" and "should require"
- "unless strictly necessary" is undefined. Is it all adult contents or banks, insurance and administrative procedure (which already often require IDs) that count as necessary ?
- Do they have solutions for that "privacy preserving" proof of age ?
I am not part the campaign so I'm only trying to guess.
Edit: I have mailed up the Representative of the ECI, I will send an update if i receive a response.
I have a response from the representative:
Dear [NAME REDACTED],
Thank you for reading the registered text this closely. Allow me to explain our choice of text and language.
The short version: the title states the political goal, the registered text is the legal instrument. "No Digital ID & No Age Verification" means no mandatory digital ID and no mandatory age verification as a condition for using the internet. It has never meant that no identity tool may exist. What we fight is compulsion: the situation where you cannot read, watch, play or speak online without first proving who you are.
Why the text is written the way it is: a European Citizens' Initiative is not a petition, it is a formal request for legislation, and the Commission only registers initiatives that ask for something within its legal powers. A demand to abolish digital identity as such would not have been registrable, and it would also miss the actual danger. Digital ID systems already exist, eIDAS 2 is in force. The battle that can still be won is over whether using them stays a free choice. So the text demands binding law that keeps these systems voluntary and forces privacy into their design.
On your specific questions.
"Remain voluntary" versus "should require": these refer to two different subjects. Use must remain voluntary for citizens. The requirements apply to the systems themselves, as conditions any digital identity or age assurance tool must meet before it may operate. The legislation should require of the systems: anonymous proof of age, data minimisation, selective disclosure, open source, audits, no cross-service tracking. It should require nothing of you. There is no contradiction, one clause binds the citizen's freedom, the other binds the technology.
"Unless strictly necessary, proportionate and provided by law": this is not our invention and not undefined. It is the limitation test of Article 52(1) of the Charter of Fundamental Rights, the standard the Court of Justice applies to every restriction of fundamental rights. It means identification duties are only lawful where a law establishes them, courts can review them, and they pass a proportionality test. Opening a bank account, notarial acts, tax procedures: these are existing legal identification duties and the initiative does not touch them. Watching videos, reading media, playing games, using social networks is lawful activity where mandatory identification fails that test. The crucial point of the clause is who decides: necessity must be established by law and reviewable by a court, not declared by a platform's terms of service or a Commission recommendation.
Practical privacy preserving proof of age: yes, this exists and has for years. Attribute based credentials and zero knowledge proofs let you prove the single statement "over 18" without revealing your name, birthdate or documents, with the data on your own device and no central database. The IRMA architecture developed at Radboud University in Nijmegen is a working, open source example. Or the Belgian ItsME app (I am using it for example). Acceptable for us is exactly what the registered text lists: voluntary, anonymous or pseudonymous, on your device, data minimising, selective disclosure, open source, independently audited, no tracking across services, and with a real alternative for people who do not use a wallet at all. Not acceptable: uploading ID documents, face scans to third party verifiers, or any scheme where a wallet becomes the entry ticket to the internet.
Your final question, answered directly: we advocate both, because they are the same position. No one may be forced to identify themselves to use the internet. For the systems that exist anyway, binding law must make them voluntary and privacy preserving. A world where a voluntary, anonymous, audited age proof exists and nobody is compelled to use it is a world in which the title of our initiative is fulfilled. A campaign title compresses, a legal text has to be precise. Stop Killing Games did not literally outlaw killing games either.
You are right that this deserves to be explained without anyone having to email us. We will put this clarification into the FAQ on the website.
Thank you for the scrutiny. This is exactly the kind of engagement the initiative exists for.
Maybe I am going on a limb here, but it seems you truly care. If you want to support the initiative in some capacity, do let me know!
Best regards, [NAME REDACTED] Representative of the Group of Organisers
The mail i sendt:
Hello,
I was looking at the language on the ECI for "Stop Killing The Internet: No Digital ID & No Age Verification" and the description seems to contradict your title and the https://www.stopkillingtheinternet.com/%C2%A0website.
This is why i would like to ask for clarification on the following text from https://citizens-initiative.europa.eu/initiatives/details/2026/000011_en : We call on the European Commission to propose legislation ensuring that digital identity and age-assurance systems used to access online services in the Union remain voluntary, privacy-preserving and non-discriminatory. Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law. The legislation should require anonymous or pseudonymous proof-of-age, data minimization, selective disclosure, open-source implementation, independent security audits, prohibition of cross-service tracking by relying parties, and equivalent alternatives for citizens who do not use a digital wallet.
There is a lot of language that seems to accept the idea and implementation of digital IDs and age checks, in total contradiction with the "No Digital ID & No Age Verification" title. It even reads like it seems to advocate for the existence of age and identity verification as long as it follow some privacy & discriminatory requirements (left undefined). There is even contradiction within this paragraph: “remain voluntary” and “should require” is said about age assurance. Which is it ? I would like to know what are your exact position on this as well as responses to the following questions:
- “unless strictly necessary” is undefined. Is it all adult contents (games, video, media, etc...) or banks, insurance and administrative procedure (which already often require IDs) that count as necessary ?
- Do you have any practical solution for that “privacy preserving” proof of age ? What is acceptable for you ?
And most important : Are you advocating for "No Digital ID & No Age Verification" as the title indicate or for the creation of a digital identity and age-assurance systems that are "voluntary, privacy-preserving and non-discriminatory" ? This is large difference to the point of complete contradiction.
Best regards, [NAME REDACTED].
In the US, you have a lot of this stuff coming in via the lawsuits against Meta for which so many people here are cheering. For that matter, the EU is also seeing lawsuits of that type.
Stop Killing Drinking: No ID & No Age Verification for buying beer.
We (as a society) recognize narcotics, such as alcohol, as bad, so we ban the children from taking them. We don't burden the parents, because we recognize that there're parents who won't care.
Predatory online platforms are the same. If you don't want to verify your identity, don't use them.
If you are forced to be verified (but age verification is not the same as age declaration) without using those services, then it's a valid compliant.
Honestly I think what is needed here is something similar to TLS: build a chain of trust with multiple "authorities" that can validate your age.
Then we can potentially have open identity issuers that validate age, minimum/no logging, ram servers, periodic power cycles, and independent audits. Assign the cert to an email address or something. Only include age >16/18/21 and a expiry date.
There would be a problem with tracking accounts across services, but if the cert name is only tied to an email, it wouldn't offer any more tracking info than the email used tied to your online accounts.
Do you know how the implementation proposed by EU works?
How would that be a better solution? It is more complicated, more expansive and I see no benefits with it, in comparision to what the EU proposes
I'll start off by saying I'm not super familiar with the EU proposal for digital IDs (other than looking at a few articles here and there), but
-
I'm not in the EU. The EU proposal is tied specifically to the EU. And without documents that establish physical presence in the EU it makes it hard to interact with EU services. A cert with an email doesn't have this problem.
-
There are more problematic cases than "non-EU citizen outside of the EU want to access EU services". There are always edge cases where there's a piece of document that establishes the person is legally allowed to be here but is glossed over as an "ID". Usually, you can present these in person and a human would be able to check it. It's much harder to convince an automated machine to do so, especially when it isn't in a drop down list. Which means no digital ID for this person (since the system can't verify). This is not hypothetical. I have actually encountered this myself outside of the EU. Impossible to submit rental applications, trade-ins at Best buy, rent cloud servers, etc. A verification system backed by multiple non-government entities can alleviate this by 1) only verifying age and 2) verifying age through different methods, sometimes even through human vetting.
-
Data protection is governed by policy in the EU proposal. Policy can change. It's a lot harder when something is technically impossible by design. A cert with only an email cannot produce a name in it, even if storage was implemented incorrectly.
-
My understanding is that while the digital id wallet is supposed to be open source, currently it depends on Google attestation framework and can't even work on GraphineOS. You don't run into this problem with a file.
1 & 2: it would work the same as all other EU specific things. You don't need to comply with GDPR for people outside EU, you wouldn't need to verify users outside the EU.
3: I don't know what you mean. It could be easy to modify spec of those certs to include names.
4 You don't know how this proposition is supposed to work.
In short:
There're officially approved apps (you can't just create you implementation arbitrary, but if you implementation meets all standards, you can work to have it approved). Using those apps, your credentials are secured with one (or many, I don't understand that part) of:
- Hardware secure element
- Software secure element
- External device
- Server HSM operated by the provider
Those apps must also use some defined encryption standards.
When you create your app, it needs to be approved by one of the member states.
The app can store all kinds of personal governmental things such as your ID, bank account number, drivers license, etc.
When a service wants to know whether you are 18 or more, you can give them your wallet. The wallet app will show who demands what informations and a reason they put in the request. You can approve or reject the request.
It doesn't have to be tied to google or anyone other.
Yes, those apps won't be libre, but (and you don't need to agree with me) in my opinion this is better than letting people create any implementation they want.
GrapheneOS can create thier implementation, that relies on hardware security chip. Linux distros can create a joint implementation reliant on yubikeys and alternatives.
Also, alternatives must remain.
Response to 1: funny thing is that one of the ID verification issues I specifically had is with Hetzner. They need to do a ID verification, recognizes my address is from Country A outside of the EU, so it goes through a Country A specific verification. Then rejects my ID because it's a rare form of ID in Country A. I also have an ID for Country B but they won't recognize it with a Country A address.
Response to 2: I'm specifically referring to people residing in the EU for this one. People in the EU that "slip through the gaps" since their ID is somewhat uncommon, thus getting locked out of digital services since they can't validate and obtain a digital ID easily.
Response to 3: the counterpoint here is network transport protocols, such as TCP and UDP. At this point, it is no longer possible to build new protocols or modify these protocols because of how entrenched the infrastructure hacks surrounding these protocols are, such that no new protocol header would be possible to get through the Internet without it being dropped by middleboxes. I'm suggesting utilizing this technical moat as a feature here: have a simple proposal spread so wide that it becomes almost impossible or economically unfeasible to switch to something invasive.
My issue with 4 is more about current implementation rather than the proposal. So far, the main (or only functional implementation, I'm not sure) is the one that depends on Google attestation. While this could change, I'm not the biggest fan of trusting something to "policy/proposals". X509 is robust, has key management sorted out, and doesn't have this specific issue. While anyone can create a cert, that doesn't mean the cert is useful if it's not signed by an approved CA.
Thanks for the headsup. Signed it and passed it on to a few friends who also care about this stuff.
I'm not inherently against the EU providing a means to verify age and/or identity online, but the legal framework proposed by this Citizen's Initiative seems entirely reasonable, and even preferable, to me.
Edit: I do find it a bit funny that I signed a petition about online ID checks using my country's e-ID.
e-ID wasn't mandatory, was it? I was able to sign with just filling the form
e-ID isn't mandatory (it's not even available in every country), but the form should be filled in with correct personal information.
They will need to verify whether the people who filled in the form are actual people who are eligible to sign the citizens' initiative.
Using e-ID just makes the whole verification easier for everyone.
Hopefully you'll one day reach your goal of having to send physical mail to sign online petitions.
Look at chad finland at 6.36% threshold met. Not only do they defend Europe militarily but also digitally.
I hate uploading selfies and pictures of my ID to prove my age online. I would much prefer the age verification system that the EU is building.
And then you have to give all your data to sign it?
That's just how these Citizen's Initiatives work.
Since there are requirements for the European Parliament to address the concerns, they need a way to verify that the signatures are actually real and match to EU citizens.
They need some way to prevent spam which would make this democratic tool meaningless.
As the Citizen's Initiative says:
Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law.
I would argue in this case e-ID verification (or other verification of identity) is necessary and proportionate.
Is it really "strictly necessary"?
(I also wasn't given the opportunity to use my e-ID, only to fill out my address)
Given that this is part of the legislative process, and there is legal requirements for European Parliament to adhere to if the Citizen's Initiative meets the threshold, I would argue that signing the petition has a similar weight to casting a ballot in an election.
Just like how you need to verify in an election that someone is legally allowed to vote in that election, this petition needs to verify whether someone is legally allowed to sign the petition.
If there was no verification of identity, hypothetically someone could fill the platform with junk petitions, which could all be signed by a bunch of Russian bots. It would completely undermine the democratic process.
So yes, I do believe identity verification is "strictly necessary" in this case
Small price to pay. At least it’s not some random company.
This initiative is just a smokescreen; it actually pushes things down the slippery slope.
Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law. The legislation should require anonymous or pseudonymous proof-of-age, data minimisation, selective disclosure
Define "necessary". Define "by law". The pushers for proof-of-age already say it's anonymous – but it can't be.
Lol, legit counter-privacy campaign.
If you're not arming yourselves and physically demanding pro-privacy internet, you're performing counter-privacy.
Cloudflare says recent statistics indicate about 57% of internet traffic is already non human. The thing is, the internet was sold and operates on the ecomonic model of advertising to humans. If humans become a declining portion of the internet, who will pay for advertising? Something else will emerge. Who knows what that will be. But lobbying to eliminate digital IDs so a diminishing number if humans stay anonymous seems like a waste of time.
This initiative is just a smokescreen; it actually pushes things down the slippery slope.
Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law. The legislation should require anonymous or pseudonymous proof-of-age, data minimisation, selective disclosure
Define "necessary". Define "by law". The pushers for proof-of-age already say it's anonymous – but it can't be.
How it's written seems suspiciously similar to how it's currently being pushed to be implemented. Additionally it opens up the possibility of it being "pseudonymous", that in practice terms is equivalent to "anonymous unless you put in some effort to identify the person"
As a US American with a social security number: please give us them eIDs.
I want a cryptographic key card that can be used to prove my identity in a way that's not vulnerable to replay attacks. I'm tired of my identity being stolen by someone who buys my data off the darknet, which is sufficient for someone to "prove" that they're me and then take out a credit card in my name.
Obviously this should be implemented with a way that's good for privacy, but the current system of KYC photos is a fucking nightmare
This initiative is just a smokescreen; it actually pushes things down the slippery slope.
Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law. The legislation should require anonymous or pseudonymous proof-of-age, data minimisation, selective disclosure
Define "necessary". Define "by law". The pushers for proof-of-age already say it's anonymous – but it can't be.
all 4 comments