Privacy-Preserving Age Verification via Bank

[Chailotl]

Problem

Fluxer has no mechanism for proving you're an adult, as all the popular methods are privacy-violating or infeasible for Fluxer to do.

Proposed solution

There is a proven and privacy-preserving method for age verifying an account, and that is to have your bank send Fluxer Platform AB an email stating "this user is an adult and the person they claim to be". This assumes the government making the laws trusts the bank for this purpose.

Notes (optional)

No response

Checks

• I searched for existing discussions and didn't find a duplicate.

[Mystery24601]

Interesting solution.

[jilek-josef]

this will likely need to be done by per country basis
however EU has zero knowledge verification app in pilot program (not full release yet)
only the age information is transferred
it is opensource so people can test it even now

[TheNamlessGuy]

Could you name (or link to) this app?

[jilek-josef]

Could you name (or link to) this app?

https://digital-strategy.ec.europa.eu/en/news/commission-releases-enhanced-second-version-age-verification-blueprint
https://github.com/orgs/eu-digital-identity-wallet

[hazencruz]

this should only be asked of anyone who is logging into fluxer from a country that legally requires this kind of verification, and it should absolutely be optional on self-hosted instances.

[Chailotl]

Fluxer already operates this way if you read their help center page on regional restrictions.

[ANRKJosh]

Some other platforms have used a valid credit card on file/credit card transaction as age verification, so could be a good viable alternative in those specific areas?
Preferably this won't impact self-hosted instances as mentioned above

[spectrapulse]

In the Netherlands and some other EU countries, but especially the Benelux doesn't utilize Creditcards as commonly and are even uncommon to have... People tend to have Debitcards which sometimes aren't even Mastercard or Visa.

So this would be a very poor way of doing age verification. Also there's countries where paying is done in very uncommon but regional ways... So I don't really think this is as viable of a solution as people think it is.

[merppr]

In the Netherlands and some other EU countries, but especially the Benelux doesn't utilize Creditcards as commonly and are even uncommon to have... People tend to have Debitcards which sometimes aren't even Mastercard or Visa.

So this would be a very poor way of doing age verification. Also there's countries where paying is done in very uncommon but regional ways... So I don't really think this is as viable of a solution as people think it is.

Same in Ireland, people rarely have credit cards, everything is done with debit. I wouldn't want to be ordering credit cards just to confirm I'm an adult on a messaging app.

[ANRKJosh]

Probably a bit out of hand on this one, this is more merely suggested as one of potentially many more privacy respecting options as that's what's realistically being discussed here as both many people and Fluxer has/have mentioned:

Some regions have enacted laws that require online platforms to verify users' ages using methods we are either unable or unwilling to implement, such as government-issued ID uploads, biometric scans, or mandatory third-party age verification services. Rather than implement these methods, we restrict access to Fluxer from affected regions.

Realistically, I'd presume, at least for a while that age verification would probably not be done as it's mentioned above - at least this is my understanding.

Though, not saying this solution I briefly mentioned is the be all and end-all, I'm not 100% sure on how the other proposed solution would work, as having the bank email Fluxer would likely cause a larger amount of admin on Fluxer's end - if said Bank(s) are willing to do this? I've not personally heard of this but presume it may exist in some places.

It's not uncommon for kids to have access to their parent's credit card number, and I don't imagine countries with age verification laws would accept this as valid.

This is a true and valid criticism of the way age verification currently works however, Ofcom (UK Regulations) says the following:

... sets out a non-exhaustive list of methods that we consider are capable of being highly effective. They include: open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation;

If the regulations allow for a more privacy respecting option, then surely it's best case and we can't really guess what's coming for any one particular country.

Same in Ireland, people rarely have credit cards, everything is done with debit. I wouldn't want to be ordering credit cards just to confirm I'm an adult on a messaging app.

Agree, with the statements mentioned, however again this is more about what Privacy Respecting options there are, and this currently seems to be one of the better, and allowed options at this current moment in time. Plus as mentioned in comparison, larger multi-national corporations like Valve are doing this, so there is proof that this at least works in the UK.

[spectrapulse]

Plus as mentioned in comparison, larger multi-national corporations like Valve are doing this, so there is proof that this at least works in the UK.

It works for steam because steam supports just about any payment method you can throw at it even highly localized ones such as iDEAL which is used in The Netherlands.

[MiniGrief]

I cannot buy anything on Steam which is marked as adult-only now even though I am an adult. There are a large number of adults who refuse to own a credit card or cannot own one. I personally cannot own one as I cannot work, so my income is not large enough to be accepted for one (I also do not want one). This form of verification is extremely flawed for this very reason, not every adult can be reasonably expected to own a credit card as not every adult can own a credit card. At this point, if I ever do want to buy an adult-only game, I will have to do exactly what kids can/will do: borrow my parents' credit card. There was a rather large outcry in the Steam discussions when it was first implemented with similar sentiment so I know I'm not alone with that.

For any form of verification to work, it has to be something easily accessible to all adults while also not revealing too much or any identifiable information.

(Simply having it an an option is fine, but having it as the only option just doesn't work.)

[Doot-Doot-Snoot]

How feasible is this? Would biometric identity be attached or no?

[Chailotl]

Your bank already knows your real age when you sign up with them, and it is in the bank's best interest to keep your data secure, because that's how they keep trust. So if the government trusts the bank for this purpose, then Fluxer does not need any identifying information other than being told a specific account is owned by an adult.

[Doot-Doot-Snoot]

I see, thank you for the explanation.

[Kamalaja]

We will likely not support this within the Fluxer software.