By John Gruber
WorkOS Radar:
Protect your app against AI bots, free-tier abuse, and brute-force attacks.
Dan Moren, writing at Six Colors:
In a whitepaper posted to Apple’s developer site entitled “Helping Protect Kids Online”, the company details several improvements it’s rolling out in upcoming software updates, including making it easier to set up child accounts, providing age ranges to developers, and filtering content on the App Store. [...]
It’s also worth noting that these announcements are happening against the backdrop of more stringent age-verification laws enacted in U.S. states like Texas and Oklahoma. Critics of those laws contend that they unfairly target LGBTQ+ communities. Apple, for its part, says that it holds to a standard of data minimization, not sharing any more information than is necessary. So, for example, offering developers access to the age range of a user — with the consent of a parent — rather than providing a birthdate.
From Apple’s whitepaper (PDF):
At Apple, we believe in data minimization — collecting and using only the minimum amount of data required to deliver what you need. This is especially important for the issue of “age assurance,” which covers a variety of methods that establish a user’s age with some level of confidence. Some apps may find it appropriate or even legally required to use age verification, which confirms user age with a high level of certainty — often through collecting a user’s sensitive personal information (like a government- issued ID) — to keep kids away from inappropriate content. But most apps don’t. That’s why the right place to address the dangers of age- restricted content online is the limited set of websites and apps that host that kind of content. After all, we ask merchants who sell alcohol in a mall to verify a buyer’s age by checking IDs — we don’t ask everyone to turn their date of birth over to the mall if they just want to go to the food court.
Meta has been vocally backing the various state initiatives that Moren referenced, that would require app stores to verify the exact age of children. To use Apple’s apt metaphor, Meta wants the mall owner to require checking ID for everyone who enters the mall, not just those who purchase alcohol. Meta also, of course, wants itself to then have access to those exact ages verified by the app store — it wants to know the exact age of every child using its platforms, and wants the App Store and Play Store to do the dirty work of verifying those ages and providing them via APIs to developers.
There are a lot of parents who supervise their kids’ online activities and simply don’t permit them to use platforms — like, oh, say, Meta’s — where age restrictions are necessary for some content. So why should those parents be required to provide privacy-intrusive verification of their kids’ birthdates just to let the kids play and use innocent G-rated games and apps?
Meta is clearly in the wrong here, and they’re using culture-war fear-mongering to try to get what they want through misdirection.
★ Monday, 3 March 2025