FIRE argues the internet is entering a 'papers, please' era where routine browsing requires government ID, face scans, or credit-card checks. They emphasize that the polite fiction of verification — a boolean returned and forgotten — diverges sharply from the deployed reality, where a handful of vendors (Yoti, Persona, Veriff, Incode, AU10TIX) sit as mandatory toll booths logging every check.
By submitting the FIRE essay to HN, bilsbie surfaced the argument to a technical audience and implicitly endorsed its framing that the regulatory wave is reshaping the open web's privacy architecture. The 967-point score signals strong resonance with the position among working engineers.
FIRE points to the UK Online Safety Act, the EU Digital Services Act, and 24+ US state statutes modeled on Texas HB 1181 (upheld in Free Speech Coalition v. Paxton) as evidence of regulatory sprawl. They argue the statutory definitions sweep in social platforms, app stores, video sites, forums, and any UGC service where a third of content could be deemed 'harmful to minors' — far beyond the porn-specific pitch.
FIRE acknowledges that zero-knowledge proofs and on-device age estimation are technically permitted under most statutes, but argues the deployed reality is almost always a document upload paired with a selfie. The implementation gap — not the headline policy — is where the privacy damage actually happens, because vendors retain logs regardless of what the law allows.
The Foundation for Individual Rights and Expression (FIRE) published a long-form essay arguing that the internet is entering what it calls the 'papers, please' era — a regime in which accessing routine websites increasingly requires uploading a government ID, a face scan, or a credit-card check. The piece hit #967 on Hacker News, with the comment thread dominated not by free-speech abstractions but by working engineers asking the practical question: what does the stack look like when anonymous browsing is illegal?
The trigger is regulatory, not technical. The UK's Online Safety Act went fully live in July 2025, the EU's Digital Services Act now requires 'highly effective' age assurance for any service likely to be accessed by minors, and at least 24 US states have passed their own age-verification statutes — most modeled on Texas HB 1181, which the Supreme Court upheld in *Free Speech Coalition v. Paxton* (2024). The laws were sold as porn-specific. In practice, the definitions sweep in social platforms, app stores, video sites, forums, and — under the EU's reading — any UGC service where a third of content could be 'harmful to minors.'
FIRE's core claim is that the implementation details matter more than the headline policy. Verification is being outsourced to a handful of vendors — Yoti, Persona, Veriff, Incode, AU10TIX — who now sit between the user and the open web as a mandatory toll booth. Even where the law permits 'privacy-preserving' methods like zero-knowledge proofs or on-device age estimation, the deployed reality is almost always a document upload and a selfie.
The interesting engineering question is not 'is this bad' — most readers here will have an opinion already — but 'what is the actual data flow, and where does it leak?'
The polite fiction of age verification is that the verifier checks your ID, returns a boolean to the site, and forgets you. The deployed reality is that the verifier keeps a log, the site keeps a token tied to your session, and your ISP, your verifier, and the site all now hold correlatable records of which adult visited which URL at which time. That's three new parties in your threat model, none of whom you chose. The AU10TIX leak in 2024 — which exposed admin credentials that could have unmasked verification records for TikTok, Uber, and X users — is the genre-defining incident, and there will be more.
The second-order effect is on the structure of the web itself. Compliance has fixed costs that scale terribly for small operators. A solo-maintained forum with 5,000 users cannot afford a $0.30-per-check verification SDK with a $5K monthly minimum, so it either geo-blocks the regulated jurisdiction (Pornhub's response in 17 US states), shuts down (the wave of small UK forums that closed in Q3 2025), or sells to someone large enough to absorb the overhead. Age verification is, in practice, a consolidation subsidy for incumbents — the small-web tax disguised as child safety.
There is genuine disagreement among practitioners on the right response. The cypherpunk read, well-represented in the HN thread, is that this accelerates the migration of meaningful conversation to Tor, I2P, Nostr, and end-to-end-encrypted group chats — that the 'papers, please' web becomes a sanitized mall while the actual internet retreats. The institutional read, voiced by a smaller faction, is that mandatory KYC for online speech is a one-way ratchet that ends authenticated-pseudonym systems (think: a verified-adult token bound to a stable handle) being the least-bad equilibrium. Both can be right. Neither is comforting.
The technical state of the art is more honest than the policy debate. The W3C's Verifiable Credentials work and Apple/Google's mobile driver's license (mDL) standards do support genuine zero-knowledge age proofs — you can cryptographically prove 'over 18' without revealing your name, address, or document number. But every shipping implementation in 2026 still requires the issuer to know you requested the proof, when, and for which relying party — which means the unlinkability is theatrical the moment the issuer is subpoenaed.
If you operate any service that accepts user-generated content, comments, or video — the compliance surface just expanded and you probably don't know it yet. The UK's Ofcom has been issuing Section 121 information notices to services with as few as ~700K UK users, and the penalty regime tops out at 10% of global revenue. Three concrete things to do this quarter:
First, inventory your jurisdictional exposure. If you have measurable users in the UK, EU, or any of the 24 US states with age-verification laws on the books, and any portion of your content could be characterized as adult or harmful-to-minors under their definitions, you are in scope. The definitions are deliberately broad. A Discord-style chat with NSFW channels qualifies. A subreddit-style forum with unmoderated comments qualifies. 'We're a B2B tool' does not get you out if consumers can sign up.
Second, read your verifier vendor's data-retention contract before you sign it, not after. The default contracts give the vendor a perpetual right to retain verification artifacts 'for fraud prevention and regulatory cooperation' — which is the legal phrasing for 'we keep your users' faces forever and will hand them to any government that asks.' Yoti, Persona, and Veriff will all negotiate this down to 24-48 hours if you push, but you have to push.
Third, architect for the day your verifier is breached, not the day they aren't. Treat the verification token as PII-equivalent, salt it per-session, never store the raw vendor response, and design your audit logs so that an 'I was here' query from a subpoena returns the minimum legally required answer and nothing more. The verifier is now part of your blast radius whether you like it or not.
The optimistic scenario is that mDL adoption and EU Digital Identity Wallet rollout in 2027 make genuine zero-knowledge age proofs the default, and the current document-upload regime gets remembered the way we remember storing passwords in plaintext. The pessimistic scenario — which the FIRE piece is implicitly arguing — is that the verification layer becomes load-bearing infrastructure, the vendors consolidate to three, and 'log in with your government ID' becomes the new 'log in with Google' for anything more controversial than ordering pizza. The decision window for which path we get is roughly the next eighteen months, and it will be settled by what developers build now — not by what policymakers wrote last year.
> You’re not happy about it, but you hand over a photo of your passport and hope it doesn’t come back to haunt you.I think for this argument to carry weight with voters, privacy advocates need to be much more specific about what "coming back to haunt you" looks like. They do a little bi
> you’re criticizing a powerful politician, or talking about your experiences with abuse or addiction, or discussing embarrassing medical issues you’re facingThis is not the problem. Even if, like millions, you are not talking about these things online, these systems still place you in danger. Ev
Assuming no revolutionary changes are coming to the USA, I am planning to opt out of the digital world when I retire. Physical media only. No subscriptions. Spend lots of time in the library. Find like-minded people and meet in person. Will only keep the bare minimum for survival, like banking.
The path ahead in the next few years (at least for the UK)1. Age gating + VPN ban under the guise of protecting children from social media2. Few years pass, Identity Passport gets ushered in under guise of convenience of not having to repeat those pesky age verification checks.3. Utilities start to
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
There are at least some technological solutions here, such as anonymous credentials. [1] Modern versions of this technique allow one to associate metadata (like a proof of age exceeding a threshold) in such a way that the verifier can't even correlate repeated requests across users.Governments