We strongly oppose this bill due to the serious privacy and free speech issues it creates.

• It does not protect kids: it is trivial to work around the requirement by just visiting a website located overseas.
• It will encourage general purpose platforms to censor all adult content so they can avoid triggering the bill.
• Data breaches will happen, and have already happened on platforms who have tried age verification.
• We believe unauthorized data sales are likely. Many verification services are products of data broker companies and will likely find a loophole to bolster their core data sales businesses. Some other major verification services are located overseas, making any attempted privacy protections impossible to enforce.
• US-based adult sites will suffer as data shows 90-99% of adult visitors are unwilling to undergo verification, which will make it impractical to operate adult website businesses in the US and push the industry to less regulated international hosting.

Parental controls remains the best solution as it is widely available on devices today, is effective on sites regardless of their jurisdiction, and does not compromise privacy or free speech.

We oppose this bill.

While we are in favor of privacy protections for minors, we strongly oppose any requirements for adults to provide personally identifiable information (such as an ID scan or face picture) to social media companies.

We oppose this bill as it is a combination of KOSA & SCREEN -- both of which would lead to age verification measures which are incredibly privacy-invasive.

Our position is other.

In some regards, this bill may provide a step forward for Washingtonians' privacy. However, it may also preempt other privacy bills like Washington's My Health My Data or Drivers Privacy Act. It is also significantly weaker than previous congressional attempts at a national privacy bill.

We would like to see a bill with stronger privacy protections, a private right of action, and no state law preemption.

We oppose this bill.

We do see the benefit of having standardized methods for applications and websites to be able to query if a user is 18+ or not. However, any such requirement must:

• Be purely attestational (user submitted, not using personal data such as ID/face picture).
• Not apply to open source / community-developed / niche operating systems so as to avoid regulatory compliance from becoming an undue burden to hobbyist developers.
• For 18+ end users, the attestation should be limited to a simple 'I am over 18' as opposed to entering a full birthdate. (This is important since an exact birthdate can be mis-used via fingerprinting attack to reverse engineer the precise identity of the end user, particularly when combined with their rough geographic location or IP address). Particularly for PC platforms, if the full date is collected, then any application can access that data (even if the bill states otherwise) due to the limited security sandboxing on PC platforms.
• The bill must be carefully crafted so as to not imply liability that would encourage companies to do more invasive checks such as with ID/face scans.
• The bill must be written in such a way that it does not require the use of accounts, as not all operating systems have a notion of accounts.
• In order to be useful, the 18+ check must be available to all developers of a platform, not just licensed/approved developers. (Example: Google's age API is not even allowed to be used by adult application developers due to the terms of Google's developer agreement.)

That said, even a perfect implementation of an OS level age attestation bill could lead to OS makers demanding user accounts or personal information -- such as was seen with an early revision of Google's Android age API which required ID scans for consumers to use. Meanwhile, parental controls requires no user data at all.