Doctorow: you cannot spy on only the kids, so age checks watch everyone

Why you can't watch only the children

Cory Doctorow's piece ran originally under a sharper headline — "Spying on kids to protect kids from spying is very, very stupid" — which a commenter flagged as the real title before HN's own editors swapped the submission to the line about mass surveillance.

The argument is a mechanism, not a sentiment. To confirm a user is over or under an age threshold, a system must establish who every user is. So a regime sold as protecting children resolves, in practice, to identifying and logging everyone, "so invasive and pervasive that it makes the ad-tech industry's commercial surveillance look like some kind of cypherpunk darknet pirate utopia." Doctorow then traces the escalation: mandates teach kids to reach for VPNs, and the next legislative move is to ban VPNs. His proposed alternative is to stop building the identity layer and instead fix actual privacy law — US consumer privacy rules untouched since 1988, plus real enforcement of regimes like GDPR.

The thread that tried to engineer its way out

Much of the discussion ignored the framing and went straight to design, which is itself the story. A high-karma regular argued the dystopia isn't structurally required:

"The new laws in the US don't require any real verification. Parents who care will just select a flag on device/OS setup that gets passed to websites… In the EU, they are trying to verify age with zero knowledge proofs." — Aunche

A PHP developer sketched two concrete, identity-free mechanisms:

"Yubikey-like tokens supporting attestation and sold at places not accessible to minors like liquor stores… 'parent mode' on desktop and mobile devices — the device would refuse to load any inappropriate sites." — a developer in the thread

One reply named what all that engineering misses — the question of whether to build it at all:

"This whole shitshow thread is a bunch of techies coming up with more inane and erudite ways to implement spying… people here are NOT asking why it's even needed at all. This is what those ethics classes are for." — a commenter on engineering ethics

"I watched this narrative play out from behind the curtain"

The reversal that gave the thread its weight came from someone who said he'd built exactly these systems and thought better of telling the full story:

"I typed out a whole story and thought better of it… if the government says any age verification technology is for the kids' safety it is most definitely not their idea — they are being worked like a sock puppet by the real corporate power and the shadowy contractor intelligence gradient. I watched this same sort of narrative play out from behind the curtain with a project in US back in the day." — a commenter who says he built similar systems for the US

The most uncomfortable counter came from a regular who refused the privacy framing as selective outrage:

"Our lives are being thoroughly surveilled by a combination of phone tech, financial records tracking, pervasive internet user tracking, smart appliances, data brokerages, and our cars. That this is what triggers an avalanche of pushback while the rest of it is ignored wholesale reeks to high hell of either an overt astroturf campaign or industrial grade hypocrisy." — forgetfreeman

A commenter pointed at Australia as the live case: ordinary posts on X already trip an ID demand, the chain having started with a campaign against Steam's adult catalog and run through Visa and Mastercard, with the predictable epilogue being "millions of people having their personal information leaked". That is the point where Doctorow's mechanism stops being theory: the identity layer doesn't have to be abused to harm you. It only has to be breached.