Illinois just passed a law that puts Linux on the hook for age verification

You and me both.

Long history of ruffling feathers for big companies and politicians if you looked hard enough. Still not in prison because free speech actually is still somewhat a thing in this country, and as long as that is true, I will keep using it.

But we already accept their right to ask. Certain websites have had age restrictions on them for years. There's nothing new to the idea that certain media is not permitted to certain age ranges. (This is leaving aside the idea that people generally agree that age restrictions and age verification are perfectly fine in public spaces in the physical world, and that the internet is very much an anomaly in this regard.)

Moreover, nothing really seems to have changed in the enforcement of that (as far as I understand, specifically focusing on laws like Illinois') — it's still ultimately the responsibility of parents to ensure their own child doesn't access restricted websites. This legislation would essentially provide a mechanism that makes it easier for parents to do that.

So no, I don't think that that is the right take.

I also find your edit somewhat amusing, as the key reason that age verification is such a topic is because of a different missing real-life social feature, which is the ability to look at someone and identify whether they're an adult or a child, alongside the ability to look at someone's ID without recording all their personal details forever. As they used to say, on the internet, no-one knows if you're a dog, which is both a strength and a weakness. Identifying mechanisms like this (ensuring parents have more control over their own computers, but not requiring full verification anywhere) seems like a reasonable approach to fixing some of the weaknesses of internet anonymity, while still preserving the basic strength that identifying yourself is always opt-in.

I think the issue is with something like algorithmic feeds — that's not content that can be allowed or blocked at the client-level, that's a setting that needs to be fed back to the service. It would be very difficult (impossible?) to design an API that allows services to identify whether a user should be served an algorithmic feed without also having that service know that the setting change was triggered by local age restrictions.

Like, I can imagine a browser exposing an API that says "wantsAlgorithmicFeeds: boolean", and websites would be required to respect that setting. In theory, anyone can toggle that setting, so the website doesn't know if the user is under 18 or not. But if in practice the vast majority of people with "wantsAlgorithmicFeeds: false" are children, then websites can use that API as a good enough proxy for identifying information in the vast majority of cases. Moreover, the more of these specific APIs you add, the harder it gets to keep things anonymous — especially if different states have different requirements on age-restricted content, you'd end up being able to triangulate not just age brackets, but also potentially location as well.

I agree that age bucket still has the potential for exposing identifying information (e.g. if you can monitor a user as they move from one bucket to another, you can identify their date of birth), but it's harder, and it reduces the amount of side-information that can potentially get leaked.

That said, exposing the information in the other direction as well would be a good step because it would allow websites or apps to enable OS-level age restrictions without requiring that they also read the "age bucket" bit. It would be nice if "read a person's age bracket" were a permission that an app or website would need to request, rather than one that was given by default, and that could be coupled with the fully-privacy-preserving approach you describe, so that different applications with different requirements could mix-and-match.

All that said, I suspect it would be a lot easier to coordinate on good technical solutions like the one you're describing if the default reaction to anything that even smells like age restriction wasn't the sort of abject horror and moral panic that is so clear in this thread. Like, sure, age verification at any level has all sorts of issues. But that isn't the only possible solution to the problem here, and if technical people react to these proposals by pretending the problem doesn't even exist in the first place, then we're never going to find those better solutions.