Post

Excited that my grad student @shreyasminocha.me's work on Age Verification has been accepted to IEEE S&P! You can read about it in Ars Technica: arstechnica.com/tech-policy/... Preprint: mikespecter.com/assets/pdf/A...

Michael A. Specter 👻

@mikespecter.com

18 Mar

(also with the fantastic @harryoppy.bsky.social and @pearce.bsky.social) We performed the first large-scale analysis of age verification providers on the web. We scanned the top 1m sites from states with age verification laws (GA & TX) and one without (NY), and then RE'd the top provider.

Michael A. Specter 👻

@mikespecter.com

TL;DR: 1. Compliance is low: for sites that admit to age verification, roughly 15% deploy age verification in covered states 2. There's a spill-over effect: quite a few sites require verification in NY, despite there being no law there.

18/3/26, 2:11 pm0 reposts2 likes

Michael A. Specter 👻

@mikespecter.com

18 Mar

3. Yoti, the dominant provider in the US, collects significant private information. Data is sent to 3rd, 4th, or even 5th parties, including (in at least one case) the original site the user came from. 4. Yoti's security claims are... interesting

Michael A. Specter 👻

@mikespecter.com

18 Mar

For context, the privacy concerns we found, as well as the compliance, and spill over effects directly contravene the logic in the recent Thomas's FSC v Paxton Supreme Court decision.