With U.S. states implementing various online age verification laws, the U.K. looking to implement its own similar law, and Australia having already implemented its own nationwide law, I thought I’d look into a way to meet in the middle. While I’m under no illusion that these laws are about controlling speech and messaging and not actually about protecting children, I thought I’d discuss a privacy-preserving method to accomplish the goal of “protecting the children” while still respecting citizens’ rights.
I suggest using a privacy-respecting platform to perform and authenticate the age. For this, I am again going to suggest Nostr. First, let’s look at a definition of Nostr from Wikipedia:
“Nostr (Notes and Other Stuff Transmitted by Relays) is a decentralized messaging protocol at its core. But it can be tweaked to allow the creation of a new private network for the shipping industry with just a bit of work. Every server and on-site piece of hardware would act as a relay, passing messages in an encrypted format that only the parties authorized to view could see.”
As I am not a programmer, I will not be proposing a formal NIPs (Nostr Implementation Possibilities), but this would have to be written and proposed by someone with the skills and a better understanding of Nostr. But it is my hope that projects already looking into this idea can pull some kind of as of yet thought of idea from this post and create something viable.
The NIPs
Obviously, the first thing that needs to be done is to propose and approve a NIPs that would allow for age attestation by a trusted third party. I would suggest a new event kind that includes the following:
- The issuer, not the user, signs the event
- The event says “this pubkey is over X age”
- No birthdate, no ID, no name is attached to the event.
Clients can then verify:
- Signature
- Issuer trust
- Expiration
Signature verification: Any QR code scanner should be able to perform this check with a simple software update.
Issuer Trust: There will need to be standards and certifications set out for who can be an issuer. I would say trusted parties such as the USPS, DMVs, and possibly banks and credit unions.
Expiration: I feel that having a 4-year expiration date of verification would be sufficient. This allows for confirmation that age verifications are being misused as best as possible while still preserving citizen privacy.
Issuing a physical card
Every person who verifies their age would be issued a physical card. Why not just add this to a driver’s licence? Well, first of all, not everyone has a driver’s licence, and second, a driver’s licence has a ton of personally identifiable information on it, and that defeats the purpose of privacy protection.
So this card would have a QR code printed on it with your unique age ID and the age group you belong to in a large font size. Then, on the back, there would be a photo of the person the card is tied to. This gives three forms of verification in one card: a cryptographically secure QR code, a text-based assortment, and a photographic verification for in-person use. By placing the bearer’s photo on the back of the card, it also preserves the privacy of the bearer when used online. While not ideal for universal privacy protection, some allowances will have to be made.
The printing of the card should also take steps to preserve privacy. Each issuer would have two machines, one connected to the internet that would issue the event and print the QR code and text-based age group, and a separate non-connected machine that would take and print the photo. I would say that the photo would be optional, but that would lead to adults getting the verified “over 21” IDs and then allowing under-21 individuals to have their photo placed on the back. So that is a no-go; it would have to all be done by the same verifier at the same time to be considered valid.
So how would this all work?
It’s your 21st birthday, you go to the DMV with your driver’s license and any other required documents (with Real ID, you shouldn’t need any other, but who knows) and request an over-21 age card. The DMV representative would take your driver’s license and any other documents and verify that you are the person in those documents. Once satisfied, the representative would request that an over-21 card be printed, and an event would be created on the Nostr network.
Once your new over-21 card has been printed, you will head over to the second machine and place your card QR code side down in a tray, and then it will retract and take your picture. That picture would then be printed on the back of the card, and the tray would extend, allowing you to retrieve it and leave.
Obviously, I’m simplifying the whole process; there would have to be checks completed and payments made, be the basics are there, and that’s really what I’m trying to convey with this post.
Age groups
I would suggest the following age groups; these are based on U.S. laws, so they could be adjusted accordingly per your local laws.
- Under 13 – anyone under 13
- 13-17 – Anyone between 13 and 17
- 18-21 – Anyone between 18 and 21
- 21 – Anyone over the age of 21.
Possible addition for senior benefits: 65 – Anyone over the age of 65
You could even color-code the text based age identifier for an added level of security. Possible colors are:
- Under 13 – Orange
- 13-17 – Green
- 18-21 – Red
- 21 – Black
- 65 – Yellow (gold)
This would make it so that if someone with an age card tried to purchase alcohol, the moment the clerk saw the red age group on the card, the purchase could be denied without having to go through the step of scanning the card.
Conclusion
Is this perfect? No. But it is, in my opinion, a step in the right direction towards preserving citizens’ right to privacy while allowing governments to say they are taking steps to protect children. Of course, the real way to protect children is to empower parents to do the job of educating and protecting their children, and then give them the tools to do so, and this may be one of those tools.