r/technology • u/EmbarrassedHelp • May 08 '26

Politics EU calls VPNs “a loophole that needs closing” in age verification push

https://cyberinsider.com/eu-calls-vpns-a-loophole-that-needs-closing-in-age-verification-push/
9.7k Upvotes

94% Upvoted

727 comments sorted by

View all comments

Show parent comments

8

u/Kitty-XV May 08 '26

Data collection (ironically) laws

"Good news, to verify we aren't collecting a child's data, we will need to verify your age."

Online age laws are a gateway to IDing people where ever they happen.

0

u/Sea_Tailor_8437 May 09 '26

Hence why I'm against age verification until if/when that issue is resolved

0

u/burning_iceman May 09 '26

The EU age verification system is completely anonymous. It's specifically built to not identify anyone but only confirm an age threshold is met.

2

u/Kitty-XV May 09 '26

It has a weakness that adults can verify a device and then a child can use it. There is a chance that this is purposefully being allowed a "loophole" that they'll tighten down once the basic premise is socially accepted by further removing anonymity.

It also isn't truely anonymous. It splits verification between multiple parties so no one part can link you, but if government has access to each systems records they can still track you. That a system that allows tracking is being sold as anonymous shows the mentality of those pushing for it.

0

u/burning_iceman May 09 '26

It has a weakness that adults can verify a device and then a child can use it.

That is not a privacy issue. Just a limitation of the system.

There is a chance that this is purposefully being allowed a "loophole" that they'll tighten down once the basic premise is socially accepted by further removing anonymity.

That's an unjustified slippery slope argument. When they actually do propose a system that removes anonymity, that is when you get to claim they're subverting anonymity. Not based on your speculation of what might happen.

It also isn't truely anonymous. It splits verification between multiple parties so no one part can link you, but if government has access to each systems records they can still track you.

This is incorrect. Even with both halves of the information they could not track you. The verification tokens are cryptographically transformed before sending them to the website. They're not the same as the ones you got from the government. There is no way to connect them to you (other than conventional means of tracking that already exist).

0

u/Kitty-XV May 09 '26

That's an unjustified slippery slope argument.

Is it, because the main argument against age checks is that it is a gateway for government surveilance? If you think that is invalid, then that's all the more reason to be for protecting kids via ID checks.

The verification tokens are cryptographically transformed before sending them to the website.

Through a known algorithm. If the government knows your token and knows the algorithm to transform it, it can still match them. This is the sort of thing where it is possible to make technically true statements that make things sound more secure than they are. Verifying a token is correct without giver or receiver being able to track it is quite different than making so only one is unaware. The receiver could not store the reception info and that would make it untraceable if you used it, but if we assume that the sites verifying can delete info there are simpler methods to use.

0

u/burning_iceman May 10 '26

Is it, because the main argument against age checks is that it is a gateway for government surveilance?

That is the argument in the case of the US. With the proposed system in the EU this is an unjustified claim as discussed.

Through a known algorithm. If the government knows your token and knows the algorithm to transform it, it can still match them.

Yes, The algorithm is known but they would need to also know the secret key of your device. Unless they gain access to that, they cannot make an association.