Paper: Age-based Eligibility meets User Agency: Client-side proof, send nothing, achieve compliance
slides-agews-age-based-eligibility-meets-user-agency-client-side-proof-send-nothing-achieve-compliance-00

Thibault Meunier, Marwan Fayed

Enforcing age-based restrictions at the server creates a tension between enabling compliance and preserving clients’ privacy. We argue that both are achievable by expanding the problem statement to include unsolicited content alongside restricted material. Doing so means we can prevent accidental exposure to ineligible material for those who should not have it; we can also include adults who do not want to be exposed to certain materials that may appear without warning or consent. Both are achievable even in the presence of VPNs.

In this document, we argue that a client-side proof that sends nothing to the server is sufficient for compliance, and has stronger privacy properties, with minimal server changes which facilitate wider adoption. In addition this model of delivery can cater to an important demographic: Eligible users who do not wish to be accidentally exposed to unsolicited content, and should not have to express that preference to servers.

Given reasonable operating system and software supports, eligible and ineligible content preferences can be expressed and provably enforced by the client --- without returning data to the server or involving third parties while browning the web and accessing the Internet.