There should be a children’s Internet, just like there are children’s libraries, and child-locked devices should give access to it. Adults should be able to use the children’s Internet to see what’s there and children should be able to use the adult Internet when supervised by parents and teachers.
Technically, the only thing cooperating websites need is an http header indicating that the client is a child-locked device. Websites can disallow creating accounts or logging in from child-locked devices when they’re only appropriate for adults. There can be laws prohibiting advertising on the children’s Internet, etc, and legit websites will have to follow them. At no point does a website need to know a child’s age or anything else about them. Vendors selling devices are responsible for not selling unrestricted devices to children, but that’s easier than making every website do it.
Since the Internet is still a dangerous place, for non-cooperating websites, child-locked devices do still need the usual whitelists and/or blacklists.
Instead, there should be an HTTP header indicating that the server is an adult-only website. Then, child-locked devices can refuse to show the content to their users. Moreover, this can be more granular than just a single adult-only bit.
This standard has existed for 30 years and was supported in Internet Explorer 3; it's called PICS: https://en.wikipedia.org/wiki/Platform_for_Internet_Content_...
If the current age verification controversy was intended to protect children rather than destroy anonymous speech, it would be focused on requiring the implementation of PICS or something similar.
what happens when the request goes through a proxy and that proxy is configured to strip this header?
All the age verification is is creeping totalitarianism by governments.
No, that leaves vulnerable adults unprotected. It should be "Is my thing in one of the categories of things that this device says this user is not permitted to do? If so, I shall not permit this user to do the thing.".
Nothing stops software authors from providing pre-built bundles of categories that they believe fit certain types of vulnerable people [0], but the fine-grained control must be there so that guardians can choose to set things up for those they guard so to adequately protect them while minimizing the amount of stuff that they're blocked from.
[0] Like: "Overly-trusting human who needs protection from scams", "Dementia-damaged adult who cannot be trusted to manage their finances", "Median sixteen year old USian", etc, etc.
I think the problem with this debate in general is that people aren’t recognizing the harm, and are clinging on to old ideas about how the world should work, ideas that just don’t acknowledge the reality of how things change as technology changes, or even just spreads. Rejecting the idea that there are harms, and thus nothing should be done, just ensures you don’t have a seat at the table at all when it comes to the inevitable decision to do the regulation.
However, the other harm is the recent IDScan hack which leaked 153M people's IDs. And regulation is not a solution here, we don't know how to implement a regulatory regime that will prevent these sorts of privacy disasters. Even if IDScan gets fines which kill the company (and I suspect they will not) it's not enough of a deterrent because no one will pay enough to actually provide proper security here.
Meta, Google, Anthropic, OpenAI etc can afford to pay for and deal with licensing. They also created these issues and would very much prefer not to have to mitigate the harm they do to adults (i.e. people with money to spend). Furthermore, it'd be great if they didn't have to worry about small time competitors emerging and growing too fast. Licensing under the guise of "think of the children" is perfect for them.
Meanwhile, the age flag in the operating system will be used for other forms of authoritarian control. It will have actually accomplished nothing other than limiting peoples' fundamental civil liberties.
Leaving it all completely deregulated and/or letting platforms implement it themselves to varying levels of success and personal invasion feels like the worst option to me.
"an RFC that gives parents the ability to communicate their underage child is using the device without revealing or verifying any further information." is no different to "turn on age lock?" that you see on website now. It requires the parent to be present, engaged and 1 step ahead of their kids, and if we could depend on that, then we wouldn't even be having this discussion.
For all the protections that the ISP cannot reasonably provide, one can consider creating a nation-wide (or EU-wide, or US-wide) official label, that device makers can obtain if they meet certain requirements. Parents can them make their choice. We have that for food etc., so why not for internet access mobile devices. Because from my perspective, the main problem that needs to be solved is that parents cannot monitor 24/7 what their children do on their phones.
Yet another solution is to create a top level domain for kids, restrict kid devices to that domain, and allow sites enter this domain only if they meet defined criteria.
Oh, and prevent ISPs and phone makers to sell 'for kids" products at a higher price. People can whine all they want about free market, but it's to protect our children.
Besides, I read about what happened with Spain and football, and from my understanding the issue was that they blocked not DNS but IP addresses. And problem domain is also vastly different, a priori: in that case, they faced sites that were actively trying to avoid blocking, while in our case, I doubt pron sites and such will try to do the same, because children are not their target audience.
An alternative could be to create a top level domain (TLD) "for kids" and restrict kid phones to it. Then in your TLD you can admit sites that meet minimum criteria (no pron, no terrorism, content and chat moderation for SNS).
I benefitted greatly from early access to computers and the full scale of their capabilities. It was a constant issue in my family limiting screen time, and who knows what the exact rules should be for everyone. For me it was a dynamic ruleset I was actively involved in the development of.
I could make compelling arguments to my Mom, that will not be the case with Meta, or Apple, or Anthropic.
Accepting "OS level" age validation is surrendering to a system meant to protect the industry, not our kids future. And while there are serious conversations we should be having about how to control technology use, it should be about parental controls and sane defaults, not age validations and legally restricted access by providers.
I hate how even the most progressive-minded people on most fronts are falling into this trap because big tech has failed them and they are angry at it all.
Some kind of "child lock" on the device makes more sense to me; a parent or whatever can child lock the device before handing it off, no need to collect images of the child in question and store them in some big pile at a private company.
As an example this would means that if this exists in iOS, everytime a safari loads a webpage it has to send this additional verification identifier as a header or a query param to the web server that serves the request and based on that the web server deny the request if the identifier is present (that means a minor is trying to access the web page).
But this client side identifier can easily be bypassed via a proxy that strips the identifier from the request because not matter it's configured in the OS of the device, ultimately request would just goes out as HTTP and that can be manipulated. That's why it has to be a server side verification of the age/identification.
https://www.eff.org/deeplinks/2026/03/ab-1043s-internet-age-...
They exempted Linux, from what I remember reading.
Anything like that should be configured by the parents. Your child is your responsibility. I shouldn't have to take a picture of my passport just because someone is a neglectful parent.