All these ID check laws are out of hand. Parents are expecting the government, and random websites, to raise their kids. Why would anyone trust some random blog with their ID? If these laws move forward (and I don’t think they should), there needs to be a way to authenticate as over 18 without sending picture of your ID off to random 3rd parties, or giving actual personal details. I don’t want to give this data, and…
Thinking about client vs server, wouldn't it be even less wide-ranging, less costly to enforce, and more appropriately targeted if such mandates are one-time and on the client side - only on device manufacturers and OEM-shipped OS? Suppose new mass market devices are defaulted to parental controls on, until unlocked by an adult at point-of-sale or afterwards through a form of validation? The KYC of who unlocked it could be anonymized or the PII-proving side of the log if it needs keeping could be on-device only (high bar for criminal investigations). There should be a clear exemption threshold for low volume indie products, build your own PC, and open source self-install like Linux - since the purpose is to protect ignorant/apathetic consumers.