EPISODE 1957 [INTRODUCTION] [0:00:00] ANNOUNCER: Age verification is reshaping how people access the internet. An ever-growing patchwork of laws can now require government IDs, facial age estimation, or behavioral inference before you can enter digital spaces. Discord, app stores, social media platforms, and AI chatbots are all being pulled into these requirements. Almost always, these measures are enacted under the banner of protecting children. However, beneath that goal lies a set of hard questions about privacy, anonymity, security, and the line between what a private platform may choose to do and what a government may compel. John Coleman is a legislative counsel at the Foundation for Individual Rights and Expression, or FIRE, where he focuses on artificial intelligence and free speech policy. In this episode... John joins Kevin Ball to discuss the different methods of age verification and their privacy implications, the long constitutional history of anonymous speech, how recent court decisions are reshaping what governments can require, the data breach and surveillance risks these mandates create, and what engineers and companies should keep in mind when they are asked to build these systems. Kevin Ball, or KBall, is the Vice President of Engineering at Mento and an independent coach for engineers and engineering leaders. He co-founded and served as CTO for two companies, founded the San Diego JavaScript Meetup, and organizes the AI in Action discussion group through Latent Space. Check out the show notes to follow KBall on Twitter or LinkedIn, or visit his website, kball.llc. [INTERVIEW] [0:01:50] KB: John, welcome to the show. [0:01:53] JC: Thanks for having me. [0:01:53] KB: Yeah, I'm excited to dig in with you. This is a different topic outside of my usual beat, but let's start with an introduction to you and maybe a little bit about FIRE and then what our topic is here. [0:02:05] JC: Absolutely. Well, my name, as you know, is John Coleman. I'm a legislative counsel with the Foundation for Individual Rights and Expression. That's a mouthful. We usually go by FIRE for short. Let me dive into our organization first. So we're a nonpartisan nonprofit that is dedicated to defending the free speech rights of all Americans. We've been around since 1999, primarily working on free speech issues on college campuses, defending students and faculty from overzealous college administrators or unconstitutional speech codes. But in the last few years, we've noticed a great need to expand our work to cover tech policy. I particularly work on artificial intelligence policy specifically for FIRE. But as we'll see, there are a lot of cross-crediting issues when it comes to how you deal with social media, how you deal with AI, particularly with regard to age verification. In terms of my background, I am an attorney by practice. I specifically do legislative work. So what that means is I either will lobby state legislatures. Meaning I have to go and register with the state or with Congress to talk to them about legislative issues. And that means writing letters, drafting legislation, trying to convince people, essentially, in legislatures, whether it's the elected official themselves or the staff, that FIRE's position is right and the First Amendment matters in whatever case that we're talking about. [0:03:46] KB: Yeah, that makes sense. When I think this question of age verification, that is the instigation for getting on here is something that a lot of folks in our audience have been running into in their day-to-day. There is this big thing about Discord starting to either use it or not use it in different domains and all this controversy. So let's maybe lay the groundwork here. So from a legal perspective, how is age verification defined versus I've seen other terms out there like age assurance, identity verification? What are all these different things? And when are people actually required or allowed to use them? [0:04:23] JC: Yeah, well, I think it's probably best to start with the definitions, right? Because it can get very confusing with phrases like age assurance, age verification, and one that we use, identity verification. Let's start with age assurance because it's really an umbrella term for a range of different methods, whether it's a simple age estimate or requiring government ID checks to figure out the age of somebody. And every method involves trade-offs between accuracy, privacy, convenience, and what FIRE is particularly interested in, the loss of anonymity. So perhaps it's a good idea just to dive into the four main approaches of age assurance. And just as a little bit of a disclaimer, you're talking to an attorney, FIRE does not endorse in any way any particular age assurance method. In fact, we're pretty wary of any method that requires someone to identify themselves, but also what we'll see is layer someone's online experience with all these various methods that can figure out not only how old they are, but potentially who they are. And so just purely for your audience and for you, I just wanted to go through these so that we have a good idea of what they are. The first is self-declaration. And it's essentially an honor system where a user is asked to confirm that they're over a certain age. So you think of like going to the Corona beer website that has a lot of advertisements. And the first thing that you see is this pop up that says, "Are you over the age of 21?" And you can either click yes or no, relatively low threshold for figuring out someone's age. But in reality, we know that it's not really figuring out anybody's age because people lie all the time. [0:06:18] KB: Oh, yeah. My teenager will just be like, "Yep, give me access, give me access, whatever it is." [0:06:23] JC: That's right. So it's a simple method. Some people argue that it's not even like age assurance or age verification. No personal information is required unless it's something like inputting your birth date. But if it's just a click box, very simple and somewhat privacy friendly. Again, we're not suggesting that this is something the government should require. A lot of industries are already doing this, but it's one method out there. The second is age inference. And so this is where a platform estimates an age using existing account data or someone's behavior online. So it may rely on signals such as account history, payment methods, viewing habits, and social connections even. So think of someone buying something online or going onto Steam and using a credit card account. They're already going to have that information. And because only adults are usually issued a credit card, there's some inference that the person using the account, at least some of the times, is an adult. And so this has been explored and perhaps even used by some platforms such as Instagram and YouTube, particularly in the case of viewing things, is the kid or is the person viewing Minecraft videos and nothing else? Or are they also looking at how to do your taxes or how to fix your muffler? Those kinds of searches can be used to figure out maybe not your exact age, but a ballpark of where you're landing. Maybe with incredible metrics, you can put somebody in the 25 to 30 category. Or if they're concerned about retirement, you can go closer to 65. And I think there's enough data out there. This is me speculating, but there's probably enough data out there that you can get a high degree of accuracy here. The benefit from the perspective of someone implementing this or trying to comply with laws that require something like this is that users don't really need to submit an ID. The drawback is that it requires analysis of user data. And so that raises some significant privacy concerns when there's something operating in the background, constantly tracking your actions because the government requires it. And it creates a potential for scaffolding for a surveillance state, really. If a law is requiring inference and it has to go through this process of scanning everybody's data, there's a high likelihood that that could be used later for something else. And the fact that that structure is there - [0:09:17] KB: Well, and honestly, as someone who's been in the tech industry for a long time, I sort of assume that structure is there. The question is who has access to it and how is it shared? And is it in one place where somebody can just go or do they have to have distributed lookups? Google knows everything about me from what I can tell. [0:09:34] JC: They do. Yeah. And that's the business that they've built and they've been very good at what they do. So they have all this access. What makes it a little bit more creepy in my mind is if the government requires these types of methods and then now puts it inside of a compliance or regulatory structure where they're going to have either more access or more questions about how this operates. [0:10:01] KB: Yes, absolutely. And I feel like Google in particular has been pretty good about pushing back against the government. But if this is something going to all sorts of different companies and they have to do that, you only need one or two who are not good at pushing back. [0:10:13] JC: That's right. That's right. Or in the case of this being offloaded to third parties to handle, the federal government might not even need to deal with the big players if they have these smaller contracts, whether they're required or incentivized. Who knows? But there are plenty of avenues by which we could see mischief for sure. [0:10:36] KB: Well, and not to derail us too much, but it also feels pretty error prone. I mean, we're now on a family plan. But before that, my Spotify Wrapped had stuff from my little kids and me and my wife and all sorts of other different things. I was like, "You have a very mixed idea of who I am." [0:10:52] JC: That's right. That's right. And the approach that we're seeing now, particularly with legislation, is that no one method is being relied upon, particularly with the fact that we're going to see these kinds of methods come at various points of contact in someone's online experience, from purchasing a device, for example, or going to an app store, to using an app, to using a feature in an app. And then on top of that, if you're underage, you have to get parental consent in some cases. So now the parent has to go through identity verification, potentially. And this is just age estimation and self-declaration. I should go back. I described the inference method. But there's a third method before I get to age verification that it's worth a short discussion of. And this is where it's called age estimation as the general blanket term. But one of the more popular versions of this is facial estimation. As I understand it, it's different from facial recognition technology that matches two photos together to see if you are a person that is already known. But rather, this uses an algorithm to map your facial features and estimate your age based on it. Again, there is some data collection there with using an algorithm and then processing that data to come to some determination. And this is already being rolled out in multiple countries, as I understand it. The obvious benefit, again, on the scale of bad to worse, is that you still don't need a government ID to do this, right? You're just scanning someone's face. People can make the argument that - [0:12:39] KB: And in theory, you don't have to store that information about them, right? You could just let it go. [0:12:44] JC: In theory, right. [0:12:45] KB: In practice, you're getting quite a bit of info about me if you're looking at me. [0:12:49] JC: I think most state laws in the United States require deletion or some sort of tailored approach to data collection and storage. But as we know, that could be far removed from reality when it comes to how these systems operate and what's permitted and what's not. And also, how do states know that the laws are being enforced if all of the data is being deleted? So there's some trouble in the joints of these laws and how they're enforced. So, yeah, no government ID with age estimation. But again, relying on biometric data, that can produce inaccurate results, right? If you haven't heard the stories already, I think it just came out within the last few weeks that kids were drawing mustaches on their faces to look older. And that was bypassing some of these systems. I'm sure this is going to be a particular cat and mouse game with government regulators and kids who are very good. I've got two young kids myself, two kids that - [0:13:52] KB: They will find ways around for sure. [0:13:55] JC: - know how to work the system. That's right. [0:13:57] KB: Yeah, absolutely. [0:13:58] JC: That's right. They do. So just to quickly go through these, the last one is age verification. And this is exactly what it sounds like. Users prove their age using a driver's license or a passport or some other government-issued ID. And it's generally the most accurate. If your goal is to verify someone's age, you know that this government-issued ID has gone through a process to make sure and verify that that's accurate. But if you have a driver's license, if you have a passport, you know that it doesn't just contain your age. It also has a ton of other information. All that other information like your name, your address, whether you're an organ donor in some states, all this information is captured when they either scan or require you to show your ID online. And so that's a lot of identifying information just to prove your age. And we describe this as the papers please approach, because users must present documentation before accessing a service. We think that is particularly onerous among all of these methods. [0:15:10] KB: Yeah, absolutely. And I think that's a useful metaphor, because it's very easy to get in the sort of frog and boiling water approach of like, "Oh, yeah, I'm used to trading off privacy for convenience in different ways and what have you." But if you imagine the types of countries and states where you've had to present your papers regularly, just meandering through public services or things like that, that's not a country we want to live in. [0:15:34] JC: No, no. And that's certainly what it's looking like if we're going to compare everyone's physical experience with the online experience, which I think both sides often do say, "Hey, why don't we match what people's daily life looks like with online life?" [0:15:54] KB: Well, I think that's worth really digging into, right? Because it gets into one of the core distinctions here between public and private. And maybe we can go back a little bit to the legal setting here. We have a longstanding belief that government is limited in various ways and what they can ask of us and what they are allowed to require of us. I think there's maybe a constitutional basis we could talk about here of what can the government ask us to do? What are they not supposed to? And how are we running into those barriers here? [0:16:26] JC: Yeah. So I think this is a good spot to drop my understanding of the First Amendment. I'm a First Amendment expert. This is what I work on every day here at FIRE. And so I want to start with the language of the Constitution, of the First Amendment itself. It states that Congress shall make no law abridging the freedom of speech. What does that mean? We know that it just doesn't apply to Congress anymore. And we know that it just doesn't apply to laws. The Supreme Court has interpreted this free speech clause of the First Amendment to cover any state action, whether it's the federal government, the state government, or local government. And it covers not just laws, but also regulations and individual actions by government officials. On top of that, free speech isn't limited to just you and me speaking in the public square. It covers all sorts of expression, from wearing an armband in protest of the Vietnam War, to scheduling a parade in a downtown city. And there are plenty other areas, including online, where the Supreme Court has found that people have expressive rights, including social media. So starting with that basis, we know that the First Amendment applies in all sorts of contexts, and particularly with government interference. Also, on top of that, people have certain rights with regard to what the government can and can't do. And one of those is the right to remain anonymous. That comes up quite a bit when we're talking about what happens when people must identify themselves to access otherwise lawful content online, right? So anonymous speech has a very long history in the United States. If you go back to The Federalist Papers, for example, written by James Madison, Alexander Hamilton, and a few by John Jay. All of those were written under a pseudonym. So imagine if Alexander Hamilton had to submit a government ID in order to post his Federalist papers online or for other people to view them. Again, making this comparison with the physical world, that doesn't sound so great, particularly if you're trying to convince people that we need a new type of government, right? [0:18:53] KB: Yeah, I think this is really important, right? Because you'll hear arguments saying, "Hey, we shouldn't have pseudonymous social media accounts. Everything should be attached to the person." And that creates this insidious structure where no one can go against the popular norms without suffering tremendous consequences. And so, yeah, historically, we've said as a society, our society started by saying, "Hey, we should be able to call things out when they're not good. And we should be able to do that in a way that is safe for us." [0:19:24] JC: There are all sorts of very good reasons why someone wants to access information anonymously. I think what's often trot out is that this only protects child sex predators. The Federalist Papers is a really great example in history, but we can think of plenty of other circumstances where anonymous speech is absolutely crucial for someone finding information or connecting with other people online. Think of political dissidents who don't want to be tracked. Think of whistleblowers, whether in the government or in the private space. Also, abuse victims seeking help, whether they're minors or adults, with these kinds of age assurance methods in place, that's going to greatly reduce the amount of people willing to put up their ID or in any way reveal themselves and be able to access much needed information that the internet provides. [0:20:25] KB: So let's talk a little bit about the current state of play. What's going on right now? I have this uninformed opinion observation that it feels like we're getting a lot more pressure right now from the government to impose these oversight, draconian style things. But what exactly is happening at the different federal and state level things? [0:20:46] JC: So we've seen the fight on age verification play out in the past few years. Several states are introducing measures. I alluded to this before. They're taking a multi-layer approach to instituting age verification. So some are coming in at the app store level. Some are coming in to regulate access to social media. In some cases, social media features. Others are what are known as obscenity to minor statutes that target a particular kind of content. And we're seeing courts now deal with all of these different types of laws. For the most part, district courts, so federal district courts, the lowest court in the federal system, has been pretty favorable to the First Amendment argument that anonymous speech is a right and it's worthy of protection. And they're wary of laws that are going after people's access to social media. On the other hand, you have a Supreme Court case that came down last year that kind of redefined this whole space in terms of what kind of scrutiny the court is willing to apply to these types of cases, but also creating an avenue for more regulation of social media content. So let me back up for a moment and say one of the biggest mistakes in this debate is treating social media laws like obscenity to minors laws. They're not interchangeable. I think lawmakers often talk about them using the same language, right? That we want to protect children online. We want to protect them from online harms. But constitutionally, those two categories are very different. So if you're trying to understand where these cases are heading, again, on the one end, these obscenity to minors laws, which I'll get into, and social media laws, we need to keep a very clear understanding of what the distinction is. The first thing to understand is that age verification for obscenity to minors is not the same constitutional question. So adult content, age verification laws are also known as obscenity to minors' laws. So we think of pornography, for example. But these laws are so broadly drafted that they could include other things under the test for obscenity that regulate material that adults have a constitutional right to access, but minors do not. So last year, as I alluded to, the Supreme Court upheld a law in Texas that provided one of these statutes that says we can restrict certain access for minors to - I'll just say pornography here. That's probably clearer for listeners. I use the obscenity to minors' term because it's more precise. And I want to make it clear that - [0:23:51] KB: It includes more things, but the most common example would be pornography. So we can use that as a stand-in for now. [0:23:56] JC: Absolutely, yeah. Texas's pornography law restricted access for minors and required age verification. The Supreme Court in this case recognized that requiring adults to verify their age placed some burden on adults, right? But they concluded that the burden was a byproduct of making sure minors can't access this material and that the government may constitutionally restrict it. So we actually disagreed with the outcome of this case, and we found the dissenting opinions much more persuasive. Some justices did not agree with the court's position, just to be clear here, and they wrote their own opinions, and they argued that the law should have faced a much higher judicial scrutiny. And our central concern was that age verification can become identity verification, where you are going to be providing information that will reveal who you are. [0:24:55] KB: Right. What I'm hearing is essentially this law, which nominally is here to prevent minors from accessing pornography, becomes a tracking infrastructure to be able to track exactly who is looking at what pornography. [0:25:06] JC: That's the fear. I mean, and that's the discomfort for adults is if they have to identify themselves before accessing this material, some of them are going to avoid it altogether. And we're talking about constitutionally protected speech for adults. So now you have a burden on that right to access information. [0:25:24] KB: That might be worth now stepping back from the overgeneralization we did in calling this pornography, because I think it's easy to say, "Oh, yeah, why should pornography be constitutionally protected?" You don't actually need that, right? That type of thing. But this is a little broader than that. This includes all sorts of gray types of writing. And maybe, I don't know, does it include erotica? Does it include certain types of political speech dressed up as satire? There's a bunch of different things I could imagine this applying to. [0:25:51] JC: It's very broad. And we know that it only applies to this particular type of content. Again, this obscenity to minors standard, which borrows from obscenity law, but it could include anything that could fall under this standard. So again, the three basic prongs are, would an average person applying contemporary community standards, this work appeals to a shameful or morbid interest in sex? So that's the first prong. Are we talking movies? Are we talking, yeah, as you said, general erotica? But also, just the things that we watch every day. There was actually a footnote in this decision that seemed to say that a lot of this like more mainstream type material would be carved out. But it kind of renders the decision a little bit vague in a sense that you won't know exactly what the court is going to or what Texas - this law was in Texas. What Texas is going to do with this? Are they going to enforce it against just pornography? Or are there other things that could fall under this obscenity statute? The other two prongs, just so we finish it off, is it patently offensive? And does it lack some serious literary, artistic, political, or scientific value? Again, these are all judgments that are going to be made by a prosecutor. And we've seen arguments throughout history brought out to go after books, movies, comic books, you name it. There's been plenty of arguments that have been made to put content under a rubric where the government can regulate it. [0:27:27] KB: Well, and this maybe gets to - there was this recent example of Discord, right? And Discord has servers that have obscenity in them. Discord has servers that are purely gaming content. Discord has a bunch of tech-related servers. And the lines are not so sharp because people are people and they talk about all sorts of things and share all sorts of things. So when we start talking about platforms, technology platforms, how does this start to play in there and what are the boundaries? [0:27:59] JC: Yeah. So with this decision, you saw the dam break wide open. Now people are saying, "Hey, this now rationalizes new laws, new enforcement methods to go after not just obscenity as to minors, but social media and other communication platforms in general." And that's what we're seeing now. So the key constitutional difference is that pornography or obscenity as to minors is a category of content, whereas Discord and social media platforms, for example, are platforms for communication. They're two very drastically different things. And to treat them the same raises a lot of problems. So I think one of the best analogies here is to go with the court's rationale in last year's decision. And the case name, by the way, is Free Speech Coalition v. Paxton, if anybody's interested in looking it up or reading it. [0:29:02] KB: Oh, Paxton, man. Wish he'd get out of the news. [0:29:07] JC: No, I know. I know. And in fact, he is the one that is trying to enforce some other law against Discord right now, again, in the name of protecting children. [0:29:18] KB: So any software engineers voting in the Texas Senate race, bear that in mind. [0:29:24] JC: So the rationale, or at least the analogy that they used in the FSC decision was, "Oh, checking someone's ID to access pornography is like checking someone's ID at a gas station to buy a nude magazine behind the counter." Right? A kid walks in and provides interest in the magazine rack behind the clerk and the clerk kind of eyes it. Maybe he's doing some analog facial estimation. It's like, "Oh, it doesn't look quite old enough." So he can go and ask the kid, "Let me see some ID." And that's the analogy that Justice Thomas, who drafted the FSC decision, borrowed from was that we have some of these kinds of checks in the real world that we can borrow for online. Again, we disagree with that position. And we think that the obscenity as to minors is covering much more than just a kid walking in to a gas station. But now compare that to a clerk at a bookstore checking everybody's ID to go even view the books. [0:30:39] KB: Yeah, no, absolutely. Well, and even without that, right? That clerk is not remembering all the details on this ID. That clerk is eyeballing me and the gray hairs on my head lead to me. I no longer get carded. So he has no view of my identity, right? There's all sorts of different limitations that apply in the physical space and judgment that applies in the physical space that is not happening online. [0:31:02] JC: Oh, absolutely. And particularly as AI gets rolled out, we're going to have an internet with a memory stronger than we've ever had it before. [0:31:10] KB: We already have one. I mean, if I'm blunt, the people who I know who worked at Google are the most paranoid about anything they ever do being online because it's already there. [0:31:21] JC: Good to know. So, yeah, there is this disconnect between the physical world and the online space in terms of checking someone's ID and the implications of that. Even if we were to buy into the fact that checking an ID at a bookstore is somehow okay, it's totally not. But if it's okay, again, to your point, the clerk is not going to have infinite memory to know who you are in all contexts. Online, they're always going to know. They're always going to have all these various methods. And what that means is you're going to be much more easily identified, or you're going to think you are, and you're going to have greater discomfort to go and look at things that you want to look at or interact with people or join communities merely by the virtue that the government is putting in place these layered ways of figuring out not only your age but incidentally - or actually who you are. And that's something that people have rightfully concerns about giving up to access information. [0:32:33] KB: So I think if we think about the folks who are listening to this, or I think about myself, right? I don't feel like I have that much influence over what's happening legally, but I might get asked to implement something like this inside of a company. I might be asked to do this. So if somebody is like, "Oh, my company is talking about implementing age verification." What can I push back on? What are the angles that I can take to say like, "Hey, we don't actually need to do this. Here's our avenue out." [0:33:02] JC: Yeah, that's a really good question because it gets at this idea of private companies dealing with a perception that the Internet is dangerous. And don't get me wrong, there are parts of the Internet that are very dangerous. We can't deny that. But these laws are so overbroad that they would restrict anybody from going online without identifying themselves or eventually getting to a point where you have enough information about them that you're effectively identifying them. The thing is, Fire's position is that private companies can actually institute these measures on their own. We're not fundamentally opposed to private platforms creating communities that they want to have, whether that's through the type of content they want to share, or who they want on their platform. The key problem is when government mandates this, it is now a one-size-fits-all internet because every platform has to conform to these requirements. So the pushback on the idea that we're putting in baby gates for the internet, it's kind of true. If every platform has to cater to these particular kinds of requirements, you're not going to have the intellectual diversity or even the diversity of design that makes the internet what it is. And so this raises a question about who should be responsible. Should the platforms be responsible for their design elements? Absolutely. Should they, like an artist, be responsible for how viewers interact with it? It seems less so, right? That responsibility exists somewhere else. And that's the position that particularly I personally take with this idea. So we're not opposed. Again, if you're bringing this back to the company, it should be more of a question of design. What is your software doing? How is it interacting with people? Who do you want on your platform? Those are all absolutely valid conversations that you all should have. The problem is, is when government comes in and says, "No, no, no, we're flattening everything. All must be the same." [0:35:26] KB: No, that makes sense. Also, the technologist in me is like, "Is there a technological solution here?" And where I go with that is increasingly for things like passwords and that type of thing. We're moving to a world where there's an exchange of information or actually even a better, maybe a more familiar example, something like Apple Pay. It used to be everywhere we would go to pay, I would distribute my credit card number. And I was trusting that those people charging me were going to be good actors, cautious, not charging other things to this. And there were checks and balances, right? I could go and dispute charges and what have you. But with something like Apple Pay, I only have to trust Apple. And they distribute a one-time use token that allows someone to charge. And I could imagine something similar that is a local verification, you have one trusted entity that maybe is offline or some other thing where you trust one provider to say, "Oh, this is some key information about me, my age," or whatever it is that actually needs to be verified. They can assert that and then share only the assertion of, "Yes, this person meets your needs or not." But not having this data going everywhere on the internet. [0:36:37] JC: Certainly, yes. And the risks of that are certainly not theoretical, right? Not to beat up on Discord too much, but one strong example of what these systems end up doing is making the companies much more vulnerable to privacy concerns and data breaches, right? You can look to Australia as an example. Australia instituted an age ban for social media under 16, instituted very strong age verification requirements. Discord used a third party to comply with the law and to process age verification. And it resulted in 70,000 - this is all reported, right? 70,000 IDs or photos of people being leaked out into the universe for anyone to see or have or use. That's going to become much more common, I think. if we're moving towards a pay-per-play's internet, but also using all these various methods. We kind of talked about this before, that we're going to have multiple parties involved, whether it's third parties doing these or an App Store level. To your point, Apple might have a very good way of doing this. The problem is, is if the government comes in and mandates that, what does that look like for other platforms that aren't using Apple. It's going to have to be this system that the government gets really deep into the weeds on. And we're going to have these layers of checks with a system or with IDs or estimation. [0:38:23] KB: It reminds me - I mean, to use the financial analogy again, right? When the internet started, there were no guardrails and people were put - once we started doing payments and things like that, there were all these security things and cards being leaked and whatever. And then so we added layers of requirements and compliance and other different things, and adds all this requirement if you're handing financial data, and then things centralized. And so we got to a place that was much higher burden. And then it centralized into a few companies dealing with that and everyone working with those companies. Now, in the financial case, we kind of need that. We need to be able to transact things online. Here we're talking about something where we're instituting these requirements that are not only probably not required. They may well be unconstitutional. And we're going to put all these layers of burden and security risk on ourselves for that. [0:39:11] JC: And to distinguish this from the financial sector, we're talking about speech. We're talking about content generated online, whether it's Discord that provides this live experience more often than not. I know that they also have what's akin to a social media type scrolling effect in individual chat rooms and elsewhere. But on the most popular social media channels are just people talking. There are people communicating their ideas, their thoughts. There's communities that form. And so what we're really talking about is not something like a product but an expressive experience that people are joining and communicating with each other about. [0:39:59] KB: So we talked a little bit about what are the possibilities for an individual in a company or things like that? What about in terms of getting involved with legislative, regulatory, et cetera, proceedings? What can someone who hears this and says, "That sucks. I want to do something about that," what can you actually do? [0:40:18] JC: I'd say if you had to do something, it's to pay attention. There's so much happening right now at the state and federal level. For example, just this week, a bill dropped called the Kids Act that would effectively require age verification across multiple platforms. And for the software space, this might be really important because if you're working on AI, you now have these certain disclosures that are required. If it's a chatbot, there's social media requirements. There's even video game requirements in this bill. All of them predicated on figuring out someone's age. Now, the standard that they use is if you know their age. But we also know that companies are already collecting this information or knowing this information already. We've heard multiple platforms roll out age verification, often because of government pressure. So to go back to that question, pay attention. Pay attention to what your legislators, what your elected officials are doing. [0:41:21] KB: Well, and let them know, right? Let them know, "Hey, this is not okay with me." [0:41:24] JC: Let them know. Sure. Absolutely. Right. That's part of our system of government. We're a self-governing society. That's why the First Amendment is so important. It's because we must be able to communicate our ideas to the people representing us in government. So absolutely. If you feel called to talk about these bills with legislators, to talk to your communities, get out there and do so. Absolutely. On top of that, you can also keep track of how cases are going. Just get more involved in this space by keeping an eye out for which prosecutors are bringing cases, what they're saying in them, how that affects you. Because there's going to be this huge compliance regime that's going to be rolled out if all of this is somehow considered constitutional. I don't think that it will. I think we're going to go through a long, drawn out process where we're going to have multiple courts deciding yes or no, this is constitutional. And it's going to go through appeal. It's going to go up to the Supreme Court. Some things are going to come back down. It's going to be more than, I think, a decade before we find out. [0:42:32] KB: Let's kind of spell out that process, actually. Because I think for you being in this space, you know what that looks like. But I think it's not always obvious. When a law is passed, say, at a state level or something like that, that's not the end of the road, right? There's all of these different layers. So what actually happens? Say law is passed, challenged in court. What do I, as a company, need to do there? Or what do I as an employee who's being asked to implement age verification, and I'm paying attention, so I know this thing is being challenged? What are my options? What does this sort of time course of a decade look like? [0:43:07] JC: That's a great question. And the lawyer in me has to say, "Go talk to your attorney." Go talk to your attorney. [0:43:14] KB: Okay, so knowing enough to say like, "Hey, this is in contention." So I can talk to my attorney and ask where my levers are. That's something. [0:43:22] JC: And I know not every software developer, particularly startups, often don't have a legal team on hand to handle those types of things. There's a real struggle there. That's why paying attention really matters, not just for any advocacy that you want to do, but also for the compliance reasons that are coming down. And that's something that we're trying to fire as filed cases, fighting against age verification. And we're always looking for start-ups or any groups out there that are coming into or having concerns with age verification. Also reaching out to organizations is a really good way to feel connected and get the information that you need. There are compliance organizations, but there's also advocacy organizations that stay on top of these issues and help people navigate it. Particularly on the First Amendment front, FIRE has been doing this for a number of years now. On top of advocacy, on top of compliance, where compliance needs an attorney, obviously go talk to one. But adjacent to the advocacy, go talk to organizations. Call FIRE. Let us know your problems. [0:44:31] KB: Yeah. No, that makes sense. Okay, so we're getting kind of close to the end of our time here. Is there anything we haven't talked about that you think would be important for us to discuss? [0:44:42] JC: You know, how can these laws go horribly wrong is something that we touched on a little bit, but not as like a topic in and of itself. And age assurance has weaknesses from age verification that we've clearly talked about where there's identity verification involved. So none of these processes, no matter how well this technology advances, is ever going to be perfect. And I think that's something important to keep in mind that kids are always going to play a cat and mouse game with the technologies out there trying to prevent them from accessing content. People lie about their age. So when it comes to self-declaration, people are lying about their age all the time. Age estimation systems make mistakes. I have a baby face, so I can look like I'm probably 20-something, but I'm 41. [0:45:36] KB: I was so proud when I went to buy a drink at a concert and they told me they didn't need my card. Like they were carding everybody coming up, and then they're like, "No, we don't need yours." And I'm like, "Okay." So now I'm officially crossed into the looking old. [0:45:50] JC: Hey, you know what? That's great. I still get carded for everything. And then people are so surprised when they look at my birthday. These technologies, if they're getting fooled by kids drawing mustaches on their face, even if they overcome that struggle, there's still going to be problems in the future. But if all of these are acceptable means for, the government to implement, we're going to have a host of problems with their accuracy and the fact that they're required, right? That we have to live in a world where we're having these imperfect checks that are either going to wrongfully prevent you from accessing information or are easily being bypassed. So the actual effectiveness of these laws come into question. And so the added layers is the approach lawmakers want to take here to help combat that. But the end result is going to be, again, this internet where we have multiple age checks depending on what you're doing. There's just going to be a problem with complexity, the cost of implementing these, the friction that it has with your user base, right, that people just simply aren't going to want to do these. And again, that data collection component that people are just going to be concerned about. [0:47:06] KB: Yeah. I mean, I think as you highlight, bureaucracies in general and our legal system in particular have a tendency towards accreditive, right? They just like to add things and add things. And you have a problem, you add things. It's far harder to remove things. And so there's a lot of value in just pushing back against that accretion of burden. Even if we thought there was a way to implement these in a way that was constitutionally valid and all of these things, it's going to be a lot of overhead for dubious value. [0:47:35] JC: Yeah, exactly. Especially because if ID verification is raising so many constitutional problems. Ultimately, going to these other methods, that might eventually lead you later to having some form of ID verification is still going to be problematic. So let me break that down just for a moment. So imagine that you're a 16 year old kid that wants to go and download an AI chip companion chatbot. So assuming that all these laws are in place from device level to feature level age verification requirements. So you go to your phone, which you've already had to verify your age, or your parent did. You go to the app store where you've already had to verify your age. You go download this app, assuming that a 16-year-old is allowed to download this app, but you want to use it to create funny videos and share it with your friends. So you have to use your face and you want to use your face and create a funny AI background. Well, that feature under this hypothetical law would require you to get ID verification. But you're 16 years old and you don't have a driver's license. So knowing that, the system instead kicks you over to get parental consent. But since this is a feature that's not necessarily tied to the other verification methods, you now have to get your parent to - [0:49:13] KB: Identify themselves. Oh my gosh. Yeah. [0:49:16] JC: They have to provide their ID and then perhaps even some identity measure to prove that they're your parent or guardian or someone that can make decisions for you. And so it just becomes a mess. So like you're going from top to bottom a massively intrusive process that is going to affect people wanting to access this information. So you might have a very enthusiastic 16 year old who wants to go through that. But if you're just an adult who also has to go through that process just to ensure that you are still an adult, that could be enough for people to stop using these technologies or these apps. [0:49:55] KB: All right. I think that's probably a good place to wrap. [0:49:57] JC: Great. [END]