We strongly oppose this bill due to the serious privacy and free speech issues it creates.

• It does not protect kids: it is trivial to work around the requirement by using a free VPN or just visiting a website located overseas.
• Data breaches will happen, and have already happened in other localities & platforms who have tried age verification.
• We believe unauthorized data sales are likely. Many verification services are products of data broker companies and will likely find a loophole to bolster their core data sales businesses. Some other major verification services are located overseas, making any attempted privacy protections impossible to enforce.
• US-based adult sites will suffer as data shows 90-99% of adult visitors are unwilling to undergo verification, which will make it impractical to operate adult website businesses in Washington state and push the industry to less regulated international hosting.
• It is impractical for adult sites to include warnings in their advertisements, which are frequently small-sized banner images. Additionally, such warnings unnecessarily and unscientifically stigmatize adult fans of adult content.

Parental controls remains the best solution as it is widely available on devices today, is effective on sites regardless of their jurisdiction, and does not compromise privacy or free speech.

We oppose this bill and believe it will lead to further data breaches.

Even if the less-invasive (but still invasive) face scanning is permitted as a verification method, this still results in services being able to tie real-world identities back to online user accounts, which is a substantial violation of privacy. This is not a hypothetical concern, either, as at least one major service was caught doing this and building a data pipeline back to the feds. (1, 2)

We oppose this bill.

Though the bill references age estimation as a method as opposed to requiring face/ID scans, age estimation is often faulty and comes with many related issues such as AI incorrectly flagging accounts and the privacy infringement of having every message scrutinized by AI systems.

We also believe that most site operators will just use ID/face scanning due to the legal risk this bill creates for platform operators.

We are for this bill. This bill is a good start to protecting the privacy of Washington drivers. That said, we also agree with the calls for further reform on ALPRs and the dangers they pose. We hope for additional legislation to further restrict ALPR usage in future.

We are for this bill. These protections represent a minimum level of consumer protection that all Washingtonians should have received years ago. Washington is far behind many other states in not having such a bill already passed.

We are for this bill.

This is a set of common sense provisions that should not impact reasonable employers. For instance, employees should indeed have a right to not be fired by an AI system. Employers should not have the ability to install surveillance software on the personal devices of their employees. There are reasonable carve-outs in the bill for allowing employers to monitor employee productivity, so this bill should not interfere with legitimate employer operations.

We oppose these bills.

We do see the benefit of having standardized methods for applications and websites to be able to query if a user is 18+ or not. However, any such requirement must:

• Be purely attestational (user submitted, not using personal data such as ID/face picture).
• Not apply to open source / community-developed / niche operating systems so as to avoid regulatory compliance from becoming an undue burden to hobbyist developers.
• For 18+ end users, the attestation should be limited to a simple 'I am over 18' as opposed to entering a full birthdate. (This is important since an exact birthdate can be mis-used via fingerprinting attack to reverse engineer the precise identity of the end user, particularly when combined with their rough geographic location or IP address). Particularly for PC platforms, if the full date is collected, then any application can access that data (even if the bill states otherwise) due to the limited security sandboxing on PC platforms.
• The bill must be carefully crafted so as to not imply liability that would encourage companies to do more invasive checks such as with ID/face scans.
• The bill must be written in such a way that it does not require the use of accounts, as not all operating systems have a notion of accounts.
• In order to be useful, the 18+ check must be available to all developers of a platform, not just licensed/approved developers. (Example: Google's age API is not even allowed to be used by adult application developers due to the terms of Google's developer agreement.)

That said, even a perfect implementation of an OS level age attestation bill could lead to OS makers demanding user accounts or personal information -- such as was seen with an early revision of Google's Android age API which required ID scans for consumers to use. Meanwhile, parental controls requires no user data at all.