Can they just stop pretending these laws are not about eroding privacy and be honest for ounce.
post
EU’s new social media
child protectionstate surveillance rules to require all social media accounts to produce state ID
FTFY
Eliminating online privacy has always been framed as "protecting children" and it's always been 100% about surveillance
I mean, why are they not using these resources to tackle child poverty, prosecute the epstein list or the panama papers if they want to help children so fucking badly?
The framework is anonymous and open source.
Even if it's secure (no software is ever 100% secure), it can't be anonymous. How could they verify your ID? Maybe they theoretically don't store the record, and the checks after the first don't provide it, it can't be anonymous or it's worthless for ID verification.
That's the cool part, they found a way to keep it anonymous and still be ID verification, it's called a white card, a simple yes or no if you're 18+, it's like you get a simple white card from a verified institution like a bank saying you're 18+ with no other information like... How is that not anonymous?
Search for zero-knowledge proof, and the techniques behind it
Whatsapp is less safe than this
Sources for ZKP: https://ageverification.dev/av-doc-technical-specification/docs/annexes/annex-B/annex-B-zkp/
https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm
Vulnerabilities: https://www.encryptionconsulting.com/education-center/what-is-ecdsa/
[Api2025] Rutchathon Chairattana-Apirom, Franklin Harding, Anna Lysyanskaya, and Stefano Tessaro, “Server-Aided Anonymous Credentials,” available at https://eprint.iacr.org/2025/513, 2025
If I'm understanding it correctly, and I'm pretty sure I am, it requires a witness, like I said. That witness has to be trusted to not reveal any information. The receiver doesn't get any information theoretically, but it requires that someone check your ID. That's pretty obvious though because how else could it work?
Well if everyone's identity is stolen then I guess your identity will mean nothing.
This will just push the actual criminals further underground, while everyone else gets spied on. lose-lose.
Ironically, kids might still get around the new restriction by using a virtual private network (VPN) connection, which virtually positions the computer in another country, at the time of signing up.
This is just going to be one long pointless game of whackamole and as effective as Prohibition was in the US.
The US claim they are going after the VPN companies now too. Of course it could be all lies and deflection like most things they say now.
That’s nonsense, VPN is tool needed to run companies. Even if they make VPNs business only, people will just register fake businesses
There is no such thing as "fake business". The point is that the government identifies you when you want to use a VPN, so it's either gonna be through your personal ID or through a business where you also register with the government and then they obviously also know your identity.
By fake I mean business which officially registered but effectively does nothing, files 0 profit tax forms and pays just enough fees to keep it formally open. It doesn’t hide your identity from government but it does allow you to access content via countries where there is no age verification thus companies don’t get your id
It’s not just about business use, but citizen access to content. I looked it up and this is the stage it’s at now https://gizmodo.com/the-first-us-law-targeting-vpn-use-takes-effect-september-3-heres-what-happen-2000805001
The new law is narrow. VPN companies say they can’t do it. Fines for businesses that don’t are real. It’s all a little strange.
Very few people will set up their own business or technical venture, though. That’s enough to have a chilling effect.
How else is Mrs. von der Leyen supposed to sue people that speak badly about EU politicians?
If she wasn't corrupt and incompetent people wouldn't say that about her, so maybe she should improve her bad reputation or step down as incompetent supreme.
That stuff would 100% get leaked and ruin many lives. Hell it would ruin lives even if only authorized authorities have access to it because some perverted cops or politicians will abuse it to stalk women and children. They‘re already doing it but getting a live feed of someone’s online activity by typing in a single number makes it so much more convenient for bad actors. And it would also get leaked on top of it.
Leak what? Nobody at any point stores any documents and you would know that if any of you read the OPEN SOURCE framework the EU developed.
It's not about storing documents but about privacy. Do you want police officer in front your doors that checks identity of people that come to your house to talk with you ?
How does the police officer know its you and where you live lmao? that's not how it works... the state ID produces a yes or no if you're older than 18 which can't be tracked, a yes or no has no information about the user... So a police officer can never know it was you lol what. Research zero-knowledge proof and the techniques behind it
Sources for ZKP: https://ageverification.dev/av-doc-technical-specification/docs/annexes/annex-B/annex-B-zkp/
https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm
Vulnerabilities: https://www.encryptionconsulting.com/education-center/what-is-ecdsa/
[Api2025] Rutchathon Chairattana-Apirom, Franklin Harding, Anna Lysyanskaya, and Stefano Tessaro, “Server-Aided Anonymous Credentials,” available at https://eprint.iacr.org/2025/513, 2025
Ok so imagine you have tablet on your door and anyone that can enter have valid signature stored but not on tablet but on police servers. Now guests are entering signatures on your tablet, that signature is then sent to the police server that accepts them or not and opens the doors as they wish.
Great, this might actually kill centralized social media in a long run. Future generations will grow up on decentralized web because it will be the only one they can access.
Ursula von der Leyen, making the internet progressively worse year by year. Cookie banners, GDPR consent dialogs, and now ID verification. Please just retire and take up a different hobby, like knitting.
Neither Cookie banners nor GDPR consent dialogs need to be bad. They are only bad because companies try to do their shit. It's companies not regulation that make Cookie banners and GDPR consent dialogs bad.
That said, the id-verification stuff is just pure awful for privacy concerns.
I'm always ready for some ursula blaming but the first two are really not the fault of the law. majority of the companies "comply" maliciously, often also illegally, to make people hate privacy laws
Honestly? State ID is better than the current solution which is giving Thiel-affiliated companies photo and other data.
Ideally I'd rather have a governments provided digital ID that's more secure and just gives the company limited metadata instead of full ID info provided from gov't to company. Put in rules requiring warrants or subpoenas for lookups.
Who do you think is checking those ids? Hint: it's not the government, it's some 3rd party company, always.
With cryptographic systems like the EU uses, it must go through the government because a 3rd party can't implement that verification/response pattern without access to the proper gov't cryptographic secrets.
Did you at any point actually read the open-source, anonymous age-verfication framework to be used by the EU?
People are morons. Here we have an open source and anonymous framework for age-verifcation (free for anyone to read and check the source code: https://ageverification.dev/) developed by a people's institution and people lump it into the same boat as some private USA company photocopying your ID.
Many half-assed ideas will never make a full-assed idea.
Between this and Wsocial, it is pretty clear that whoever is making IT decisions needs to be let go.
This is not Doctorow's enshittification; this is an attempt at domesticating users into thinking it is a normal thing to upload your ID to random cloud servers or hand over your biometric data to use WhatsApp??? This isn't protecting children. It is giving the social media giants permission to allow ads for things like gambling and line their pockets. If I worked in advertising, I'd be pretty happy.
You not uploading to cloud, you validate your docs locally
Locally, how does that work?
FWIW, identity verifications schemes that attempt to maintain privacy are a contradiction in terms and cannot work. Same as encryption that both works and doesn't work (backdoors).
Verbose version here: https://pluralistic.net/2025/08/14/bellovin/
Based on paper here: https://www.cs.columbia.edu/~smb/papers/age-verify.pdf
If anything truly local and zero knowledge was allowed, there would be someone sharing their access eu-wide and everyone could install that and be done with it. One person authenticating millions.
Just due to that every system proposed has at minimum a central authority that does rate limiting.
And the anonymous internet gets another nail in the coffin. Endgame is every comment identifiable and legally (unlike state intelligence agencies) actionable against you, and the chilling effect that will have on free speech, communication, and organization.
Hail the rise of techno fascism, the entire internet will be facebook.
Can they not palm it off on the corpos to do for them? The states already have the identification apparatus, they should step up and provide age verification services. Meta and Steam do not need my photo ID, just that I'm over 18. If we can't have freedom, at least minimize the harm.
Do the EU citizens want this? Where's the democracy?
The democracy is in the process. Stuff like this gets introduced all the time by some politicians and pushed by some lobby groups, with counter-arguments from other lobby groups, and then gets rejected by other politicians and/or by the courts.
It's how a functioning democracy is supposed to work.
If you're an EU citizen and worried about this there are many ways to contact EU representatives and also to track what your EU MEPs are up to.
This kind of empty sentences do not make EU a democracy. "The democracy is in the process" – no, the process shows that there's no democracy. "It’s how a functioning democracy is supposed to work" – no it isn't. A democracy establishes a referendum for such invasive measures.
We aren't speaking about empty technical definitions here. Also China is a "republic of the people" then – it's even in its name.
This kind of empty legalese, this Newspeak, does not help anyone. Call slavery 'freedom' and then tell the slaves "you're free! you see? This is how functioning freedom is supposed to work. It's in the process".
But there's no absolute truth so the best you can do is try to come to compromises and offer processes to arrive at them fairly. All democracies out there have differences in a lot of factors. You can place some safeguards so the idiots or the evil people can't take over easily but eventually if enough people want something (even if misguided) it's gonna happen.
Call slavery 'freedom' and then tell the slaves "you're free!
Be fair now. I'm not talking about outright twisting of words. I'm talking about concrete processes for considering competing points of view before making something into a law.
And you need to strike a balance because if you make such processes very rigid and inaccessible then you may not be subject to new bad ideas but you also won't be able to shift to new good ideas. Speaking of slavery, it was once upon a time habitual in many societies, but it was the ability to shift our points of view that changed that. Same goes for a lot of other antiquated ideas.
all 42 comments