Many might’ve seen the Australian ban of social media for <16 y.o with no idea of how to implement it. There have been mentions of “double blind age verification”, but I can’t find any information on it.
Out of curiosity, how would you implement this with privacy in mind if you really had to?
The system would have to be built so that the government can’t connect the user to the website, as you don’t want the government to build profiles on website usage by person. Though the bigger challenge here is trust - even a technically perfect system could be circumvented by the operators.
A good example for this were the COVID tracking apps. The approach was built so that as little information was leaked as possible.
Could have a system where a government site cryptographically signs a birth year plus random token provided by the site you want to use.
Step 1: access site
Step 2: site sends random token
Step 3: user’s browser sends token plus user authentication information
Step 4: gov site replies with a string containing birth year, token, and signature
Step 5: send that string to the other site where it uses the government’s public key to verify the signature, showing the birth year is attested by the government
No need to have any direct connection with the user’s identity and the site or been the gov and site.
Unless the government buys the generated tokens from those websites. That’s like the entire problem