Summary
Not everyone has or wants to have proprietary phones that they do not control, therefore an alternative is needed, and I propose one which uses the chip, which is already embedded in ID cards of EU member states.
Current specification text
No response
Proposed change
A protocol should be added, which is mandatory for member states and all age-restricted platforms to implement and accept:
- The user tries to access an age-restricted platform.
- The platform presents them with a random token.
- Here, it should be allowed for the client to have a few minutes of delay in order to prevent timestamp-based deanonymisation.
- The user logs in to the government portal using the ID chip in a card reader or even an account activated at an institution.
- If the user is old enough, the government portal allows them to use the token signing service.
- The token is blinded on the client. The specification for how to do this and the API of the government portal should be open, so that anyone can implement a client for any OS and they can be assured about its security, though, for convenience, the government portal would provide JavaScript to do this without needing to use any extra software (said JS should be libre too).
- The government server signs the blinded token.
- The client can now unblind the signed token.
- The client sends the signed token to the platform which the user wants to access.
It should be an alternative to the Android/iOS app, not replace it.
Rationale
Users of Internet services in the EU should not be forced to have a proprietary Android/iOS phone that they do not control.
Change type
New requirement
Impact
It would require governments to provide an extra service and for platforms to implement it, though the implementation is quite simple and does not depend on special browser or OS APIs (even if they could be used to enhance the user interface).
Alternatives considered
I would accept any reasonable alternative that is also private and doesn't depend on a particular OS. Or, find a way to regulate the platforms so that age verification is not needed at all.
References
It would resolve many, many, issues, such as #19.