dw_news | (no subject)

We founded Dreamwidth in 2008 with several guiding principles in mind, among them protecting your privacy and giving you as much control as possible over your data. Given those principles, we wish we could support California's AB 2273, the Age-Appropriate Design Act, a bill signed into law in September 2022 that California passed to put restrictions into place for children's online data privacy and protection. It's an important issue, and too many companies out there don't put enough attention towards protecting their users.

Unfortunately, the law as California wrote it is not a data privacy act: it's a backdoor censorship bill that threatens anonymity online, will require privacy-and-anonymity-conscious sites such as Dreamwidth to collect more identifying data about our users than we want or need to, and will force sites to remove or restrict access content the state of California feels is "harmful to children" independent of their own editorial judgement. Like the Communications Decency Act of 1996, overturned in the landmark Supreme Court case Reno vs ACLU (521 US 844 (1997)), we feel the law uses vague and undefined terms to impose prior restraint on the protected speech of adults. Its age-verification requirements will force us to violate your privacy and place an undue burden upon your use of the site by requiring us to use invasive measures to verify your ages: proposals for how sites should verify the ages of their users include requiring copies of government issued IDs (which would end anonymity online) and forcing sites to adopt unvalidated and scientifically bogus facial recognition technology to estimate user ages (which, in addition to ending anonymity online and being a breathtaking overreach, shuts out everyone who doesn't have access to a device that can capture image or video, blind people who struggle with lack of visual cues during the facial recognition process, and everyone whose age that technology mis-estimates).

Worse, though, the law also allows the state of California to determine, through an unaccountable administrative process, what content is "harmful to children" and force sites to age-lock that content. That will force us to designate a large amount of legal, protected speech as available only to accounts that have verified their age as being over 18. Given the terrible, hot-button political environment today, and using examples of laws that have already passed or are in the legislative process in other states about what sort of content is "harmful to children", that provision could require us to age-lock an entry written by a Black Dreamwidth user talking about experiencing police violence, a Muslim user talking about experiencing discrimination at work because of her choice to wear a hijab, a trans user talking about seeing their doctor for gender-affirming health care, a user talking about the process of accessing abortion services -- or even an entry that I post with an offhanded reference to my wife bringing me candy that went on half-price sale after Valentine's Day. There's a long history of content by marginalized people talking about their lives being considered "harmful for children", and we have no interest in furthering that disparate impact at the government's directive. We offer you the ability to age-lock your content for you to have more control over who can see it, and we object most strenuously to the idea that the government should force us to force you to use that ability when you don't want to.

There's been no shortage of terrible online content regulation bills that we strenuously oppose lately, so why are we telling you about this one? Because we were invited to provide a third-party declaration in support of the motion for a temporary injunction to stop the law taking effect in Netchoice v Bonta, the legal effort to invalidate the law as unconstitutional, in order to demonstrate to the court all the ways the law as written will impose a significant undue burden on small sites like us and on our users and to provide some examples of how the law will have a significant disparate impact on marginalized groups. We're proud to contribute in some small way in the fight against this terrible overreach of a bill. As a small site with a legal budget of, like, $3.81 and the lint I turned out of the pockets of my hoodie, we're thankful to industry advocacy group Netchoice for leading the fight (and giving us the chance to stand up with them) and to the kickass lawyers at Davis Wright Tremaine, who have been a delight to work with throughout the process of turning my tl;dr rant about why this is a terrible bill into something that we hope the court will find helpful.

You can read our declaration, which was filed today with the motion asking the court to stop the law from going into effect. The full docket for the lawsuit is available via RECAP, including the motion for injunction.

Flat | Top-Level Comments Only

Like, as a user, I don't want to be forced to identify myself with facial recognition every time I load a site on the internet, and as a site owner, I absolutely don't want to make y'all do it either!

And a person might think that, given how far our governments trust age verification by facial recognition when it's done by actual humans for purposes of not selling alcohol to minors, the idea of doing it by AI for similar legal purposes would be a completely laughable non-starter. But here we are, apparently.

On the plus side, if it does become a deployed technology, I'll give you dollars-to-donuts that some clever kid figures out how to trick it within a week using the equivalent of a mustache on a stick.

Oh, that's not going to happen, says the main company pushing facial recognition for age verification (literally the people who own Pornhub); they're going to make you record yourself reading phrases they tell you to read. Because there's nothing wrong with teaching kids to scan their faces and record themselves saying whatever words pop up on the screen, right?!

Oh, I see, this whole thing is some government sponsored gimmick to get them more money for a lousy piece of software.

The only thing they would get is the parts of my face that showed around my upthrust middle finger.

Okay, the equivalent of a mustache on a stick and putting their microphone in a soup can for bass reverb.

And MindGeek are apparently claiming to be able to tell the difference between "age 17 and 11 months and 30 days" and "age 18" this way. Wow.

Although, given that much of the rest of their business existence also depends on the claim that there is a readily-visually-verifiable difference between those two ages, I suppose that's at least consistent.

They're going to WHAT???

I wish I were joking.

:goes scream sweary things in Old Internetish.

I just saw this, and... welp.

Reading this, there's another thing I can't help but notice that I haven't seen touched on. Namely, part of the process that the AVPA spokesperson was describing involves making sure that subsequent re-checks are done by the same user who completed the initial check:

How often you need to prove it is still the same user who did the check is a matter for the services themselves and their regulators. Some low risk uses might only check every three months – higher risk situations might double check it is still you each time you make a purchase.

This implies that the service would have to hold enough (presumably biometric) data about you to make this determination - which by definition means it's personally identifiable information, even if they can't get a name from it.

It doesn't take much to imagine a scenario where law enforcement could give such a service a high-resolution photo of the face of someone they're interested in and get back a record of which sites that person has been validated on, and when.

[edit: And while I do realise this is one of the least horrifying things about this whole thing, it's... still pretty horrifying, which says a lot about everything else about this.]

Edited 2023-03-17 21:20 (UTC)

....Jesus.

Oh, that's not going to happen, says the main company pushing facial recognition for age verification (literally the people who own Pornhub)

WHAT. WHAT?!!!

Mindgeek, the owners of Pornhub, are the ones who own AgeID, which is one of the prominent age verification providers. (I did get them mixed up with the "Age Verification Providers Association", who are the ones specifically pushing for facial recognition for social media here, but I think AgeID are members of AVPA.)

...which does exactly what for people who are totally nonverbal or... oh, god, this is such bullshit.

Oh, good gravy, I get carded buying beer, not as a formality, and I turn 40 this year. I would need the mustache on a stick.

This. I post very little on sites like Facebook, because of their "real" (wallet) name policy. I have used this pseudonym online for nearly 30 years. During that time I have gone from "female" to "non-binary", and may eventually make further changes.

The idea of having to log in with my face to make a post is simply horrible.

There are way too many laws "to protect chiiiiiiiildren" that stomp all over the free expression and association rights of adults. I believe it is the parents responsibility, not a government's responsibility, to keep their precious children away from content they don't approve of.

Me making a post about why I don't consider myself a women, or even swearing against the assault on our reproductive rights and bodily autonomy, should not have to be censored at the behest of the government because some parent somewhere might be offended that little Johnny might see it.

Also, facial recognition schemes are expensive and don't work very well. I would not use it as a login for anything I cared about, like my bank.

IMO, the whole law is a solution in search of a problem. If parents would do their job they wouldn't have to ask the government to censor adults.

As someone who works tech support, this would fail laughably fast even if the technology itself worked flawlessly (which, uh). Accounts locked for failing age verification too many times. Incompatible browsers. Updates that conflict with cached site data so seven eighths of your users (the ones that don't know to clear cache for all time) can't access the site abruptly.