There should not be an HTTP header indicating that the client is a child-locked device. That puts the onus on the server to respect the header, and HTTP doesn't require any action on unrecognized headers. Also, it reveals to the server that the client's user is likely vulnerable to manipulation — exactly the opposite of what you want!

Instead, there should be an HTTP header indicating that the server is an adult-only website. Then, child-locked devices can refuse to show the content to their users. Moreover, this can be more granular than just a single adult-only bit.

This standard has existed for 30 years and was supported in Internet Explorer 3; it's called PICS: https://en.wikipedia.org/wiki/Platform_for_Internet_Content_...

If the current age verification controversy was intended to protect children rather than destroy anonymous speech, it would be focused on requiring the implementation of PICS or something similar.

100% agree, and no OS should be forced to implement this "child-locked" signal. the existence of OSs that do implement it should be enough (if you want to lock your child's device, use a lockable OS).

> http header indicating that the client is a child-locked device

what happens when the request goes through a proxy and that proxy is configured to strip this header?

There could be lock levels to this. By default everything is unlocked (level = 0), but if a content provider / host receives a signal/header with lock-level > 0 they should be required to honor it. Something like this would require government which means it will probably never happen. Much more power asymmetry to just track you.

If you want to make a child-safe website that is OK, it can go be in it's walled garden g-rated brand-safe reality. But that is retarded. The rest of the internet still exists, and will not stop existing. Porn/defense distributed/much more insidious things will still exist.

All the age verification is is creeping totalitarianism by governments.

> It should be “is this a child-locked device?”

No, that leaves vulnerable adults unprotected. It should be "Is my thing in one of the categories of things that this device says this user is not permitted to do? If so, I shall not permit this user to do the thing.".

Nothing stops software authors from providing pre-built bundles of categories that they believe fit certain types of vulnerable people [0], but the fine-grained control must be there so that guardians can choose to set things up for those they guard so to adequately protect them while minimizing the amount of stuff that they're blocked from.

[0] Like: "Overly-trusting human who needs protection from scams", "Dementia-damaged adult who cannot be trusted to manage their finances", "Median sixteen year old USian", etc, etc.