Post

Excited that my grad student @shreyasminocha.me's work on Age Verification has been accepted to IEEE S&P! You can read about it in Ars Technica: arstechnica.com/tech-policy/... Preprint: mikespecter.com/assets/pdf/A...

(also with the fantastic @harryoppy.bsky.social and @pearce.bsky.social) We performed the first large-scale analysis of age verification providers on the web. We scanned the top 1m sites from states with age verification laws (GA & TX) and one without (NY), and then RE'd the top provider.

TL;DR: 1. Compliance is low: for sites that admit to age verification, roughly 15% deploy age verification in covered states 2. There's a spill-over effect: quite a few sites require verification in NY, despite there being no law there.

3. Yoti, the dominant provider in the US, collects significant private information. Data is sent to 3rd, 4th, or even 5th parties, including (in at least one case) the original site the user came from. 4. Yoti's security claims are... interesting