To be clear, I’m not advocating for online age verification. I’m very much against it in any form. I’m just curious from a technical standpoint if it’s possible somehow to construct an accurate age verification system that doesn’t compromise a user’s privacy? i.e., it doesn’t expose the person’s identity to anyone nor leaves behind a paper trail that can be traced to that person?
I worked in this field for 3 years, a lot of the core parts are written, but there are a few key pieces missing and no one has taken it to real production.
You can use a passport in pretty much any country and prove you’re over a certain age. Here is a demo: https://github.com/dog-18/dog18
The parts that are missing are primarily around making secure nullifiers, which prevents someone from reusing identities, but also without revealing any private information. We were pursuing research that allowed nullifier generation in MPC where none of the servers or the users knew the “salt” that their identity was hashed with, so no one could recover the original piece of unique data (like their passport number, even if a govt had a hunch about which passports signed up to a service) but it would also prevent them from signing up with multiple accounts. We got our funding cut pretty bad and management was a mess, so I left and that research I think was shut down. This really is the key part to actually make that viable in the real world though. It’s maybe a year worth of research and a year worth of production left to make that practical.