Sold as Privacy | Reclusive Libertarian

The new way to ask if you are old enough is to ask the phone. Not the website. Not a scan of your passport stored in some adult site’s basement. The operating system answers, once, and passes a signal along. That is the sale, and it is being made in the language of privacy.

It is a good sale, which is why it is dangerous. Scattering government IDs across a hundred databases is a real failure. A face scan kept by a company whose whole business is traffic you would not want tied to your name is worse. Parents are not inventing the problem either. Children can reach things they should not reach. Anyone who pretends otherwise is arguing with a phone, not with a parent.

The cheat is in the comparison. They are not offering you the old internet plus a better lock. They are offering you a checkpoint at the layer every app has to run on, operated by the two firms that already sit between you and the network, and they are asking the law to make that checkpoint mandatory. Privacy is the wrapping. The product is the gate.

Two systems are being built, and the wrapping treats them as one.

The first is a credential. Apple’s Digital ID, made from a US passport in Wallet, started at TSA checkpoints. The Verify with Wallet API now lets a participating app or site request an age check from that credential: whether you are over some number, your age in years, who issued the document. Google’s Digital Credentials API is already live in Android and Chrome. Age verification is a listed use case. You present a proof from a wallet. The site, in the clean version, never sees the passport page.

The second is a signal. California already enacted it. The Digital Age Assurance Act, signed in October 2025, takes effect January 1, 2027. Operating system providers have to collect a birth date or age at account setup and send apps a bracket when asked. Under 13. Thirteen to fifteen. Sixteen to seventeen. Eighteen and up. In July, Senators Andy Kim, Adam Schiff, Cynthia Lummis, and John Barrasso introduced a federal bill of the same name that would do this nationwide: the OS collects the age, turns it into a bracket, and apps, stores, browsers, and certain websites have to treat that signal as the primary indicator of how old you are. Under seventeen, linked to a parent. The sponsors say they are keeping government IDs and face scans out of it. The first pass is a date you type in. That is not the same as a passport in Wallet. It is the same place: the operating system, answering for you.

On a phone, that place has two owners. Apple. Google. The federal draft also covers computers, which brings Microsoft into the room. The number that matters is still two, because that is the device people actually live on. A rule that says “operating system providers shall collect and transmit” is a rule written for the firms that already own the layer. Smaller systems do not become alternate checkpoints. They become compliance problems, or they get out of the way. The duopoly is not an accidental beneficiary. It is the only place the statute can land.

That is not a smaller state. It is a state that has deputized a vendor. I have written about the other version of this move, the government buying from a company what the Constitution will not let it seize. This is the same move facing the other way. Congress cannot easily put an identity checkpoint in front of the whole network, so it tells the two companies that already sit there to run one, and calls the result privacy because the porn site never saw the file. The file did not vanish. The question moved into the phone, and the phone companies were handed a duty to answer it.

The bill, as written, does not put that duty in front of every page on the internet. Covered websites are the ones already required by law to check. Browsers pass the signal when asked. Treat that limit as the feature if you want. Architecture does not stay inside the first statute that uses it. Once the device can answer, the list of who is allowed to ask is a legislative edit. Age is the attribute you can pass in public. The credential APIs are not limited to it. They are built to present whatever the issuer verified. Age. Identity. Later, whatever a later statute names. I am not going to pretend a Senate draft is a finished social-credit system. I am going to refuse to pretend a general-purpose identity pipe is still “just eighteen” because the first press release said children.

The privacy machinery is real as far as it goes. Brackets instead of a birthday. Selective disclosure. Zero-knowledge proofs, where they actually get used. None of that changes the two facts that matter. Someone holds the credential. Someone answers when an app knocks. Those someones are not a protocol. They are two companies, subject to the next statute, the next subpoena, the next “one more attribute, for safety.” The Database of Ruin is what you get when watching becomes cheap and every safety feature adds a field. This is how a field gets added: not as a secret police demand, as a parent-friendly API.

A parent locking a child’s device is not this. Individual responsibility still lives in the house, in Screen Time and Family Link and the unfashionable act of saying no. That is a person exercising authority over a child who is actually his. A national signal, collected at setup, queried by any app the law points at, is not a household rule. It is infrastructure. Confusing the two is how you talk adults into a checkpoint by showing them a teenager.

The populist right will hear porn and predators and reach for the bill. The progressive left will hear mental health and duty of care and reach for it too. Both are looking at a real harm. Children should not be left unsupervised in an adult internet, and I am not going to sneer “protect the children” as if the phrase were a joke. Adults should not have to authenticate to a duopoly in order to read. Those can sit in the same sentence. A phone that answers for you, on a duty Congress wrote, is not how you hold both. It is how you build a filter that starts at a child’s age and does not have to stay there.

California’s law is on the books. The federal bill is not. The APIs are already shipping. The wrapping will stay the same until someone notices what they bought.

Sources