I’d be fully in favor of hardware-level age verification. And by that, I mean we already have the technology to securely and privately verify your age directly with the government, (not using a third-party), and so no single organization has a chance to collect more than a salted hash of your info. Then your user account (or the entire device, if you’re using a phone) would be considered verified. It would require governments to actually cooperate and be technologically literate, (which… Yeah… I know that makes it a pipe dream) but it is technologically feasible to implement.

The short version is as follows:

1. Governments have citizens create a password. Ideally this would happen when they’re applying for their ID, which they would need to have to verify their age anyways. This password and salt is used for their hashed info.
2. The government sets up a database of salted hashed info, along with a simple pass/fail for whether or not the individual is an adult. Again, this is only using salted hashes, (the same method we use to send passwords to a website) so no recognizable data even if it gets intercepted in transit.
3. The government publishes a service that intakes a hash, and returns a true/false for whether that hash is an adult. Again, no actual PII is stored in this database, only salted hashes.
4. The user who wants to verify their age inputs their info into their device using standardized inputs, along with the password they created when they applied for their ID. This is hashed directly on the device, just like a password is hashed before it is sent to a website. This hash is the only info that leaves the device.
5. Whatever service that is trying to verify your age takes this hash, passes it to that government database, and receives a pass/fail result. If you pass, your age is now verified.
6. Note that the company never received your PII, they only received the salted hash, and only received a basic Boolean 1/0 response from the government server. And the government never received any info about your device, so they can’t use it to track you at a hardware level.
7. Now that account is verified, and can be used to confirm your age on any devices it is used on. For example, if your Microsoft account is verified, any computer you log into with it will also be verified. If your Apple/Google account is verified, your phone is verified when you’re logged into it.
8. This could even cut out the middleman and verify the device directly using that same government service, but that would need to come with some extra security precautions to be sure the government isn’t able to collect verification attempts and tie individuals to the specific hardware devices that made those requests.

And then the verified device can directly pass a “yes this user is over 18” flag directly to any service that needs it. This could be done securely during the TLS handshake, before the site even begins to load. Ideally, it would be a fairly wide age range. So for instance, maybe we group it into child, teen, and adult. So sites that need to verify age for regulatory purposes can do so without actually collecting your personal data.

This would allow websites to verify ages on the backend, without actually needing to use third-party services. It would also allow for a much smoother user experience, with verified adult users being able to bypass any kind of age gates. And unverified users would automatically get redirected to a “your device isn’t verified, here is why, here is how to verify it” page. No concerns about kids lying and clicking the “yes I’m over 18” button, because they never even see a button to click. They just immediately get redirected as soon as the site sees that they’re not verified as an adult.

It’s really the best of all worlds. It allows for secure verification, where the only info leaving your device is scrambled. It appeases the “think of the children” crowd. It allows us to ditch the stupid fucking “click here if you’re over 18” pages. And most importantly, it would actually protect kids, because now preventing them from accessing mature content is as simple as protecting your passwords. Because they can’t just steal your ID to verify their device without also having your password.