On ID Verification, and Why Tavrn Is Going to Avoid It for As Long As Possible
Age and identity verification is having a moment in the United States right now. The Supreme Court’s ruling in Free Speech Coalition v. Paxton last year upheld a Texas law requiring ID checks for adult content sites, and while the Court was careful to say that decision didn’t automatically extend to social media, states haven’t waited around to find out. A dozen-plus states now have laws on the books targeting how platforms handle minors, and some of those laws are already in effect while the bigger fights play out in the circuit courts. The direction of travel is not subtle.
So let me say plainly where Tavrn stands: I am not adding ID verification unless the law leaves me no other option, and even then, I plan to push it off for as long as I possibly can.
This isn’t a legal prediction, it’s a values statement. I don’t think a private company should be in the business of collecting government identification to confirm something as basic as someone’s age. Not because I don’t care about the goals behind these laws.. keeping minors away from content they shouldn’t see and cutting down on fraud and money laundering are legitimate problems. I just don’t think handing your driver’s license to a third-party verification vendor is a good solution to either one, and I definitely don’t think I’m equipped to be the one holding that data.
Here’s the honest version of my objection, in two parts.
The practical one: I have no way to store identity documents the way they’d actually need to be stored. Not “no way” in some vague sense, I mean I run this on systems that are not rated for Sensitive Personal Information storage, and the idea of becoming a custodian of scanned IDs or biometric face scans for a platform this size is a liability I have zero interest in taking on.
For those who might bring this up, outsourcing it doesn’t get me out of the chain. I’d still be the one integrating the result, still be the one who has to produce records if a regulator asks, and still be liable if the vendor gets breached. It just means a stranger’s ID now passes through one more company before it gets anywhere near me, not zero. A breach of message content is bad. A breach of people’s actual government ID is a different category of bad, and I’d rather not get involved with the thing that makes that breach possible in the first place.
The principled one: I think there’s a meaningful line between the government asking you to verify who you are, and a random company doing it on the government’s behalf. Laws like the PATRIOT Act or the EU’s AMLR exist because financial institutions are handling money movement at a scale where identity verification is the actual point of the law. That’s a different animal from a chat platform being told to collect ID scans so a teenager can be blocked from a server. I don’t think everyone should have to hand personal identification to whatever company happens to be running the platform they want to use that day, just to prove they’re old enough or human enough to be there.
What frustrates me most is that better approaches genuinely exist, on-device age estimation, privacy-preserving attestations, parental controls that don’t require doxxing a fifteen year old to a database somewhere. Some of them are actively being researched. Almost none of them are what’s actually being mandated. Most of the laws on the books right now default to the easiest, crudest version: upload your ID, let a vendor confirm it, hope that vendor doesn’t get breached or sell the data anyway. Nobody in a position to write these laws seems to be taking the harder, more careful path seriously, and I don’t think that’s an accident so much as it’s just easier to write.
So here’s the actual plan. I’m watching this closely. If Tavrn ever gets big enough or falls under jurisdiction specific enough that this stops being optional, I’ll say so clearly, explain exactly what’s changing and why, and be upfront about what data that means I’m now holding. Until that day, I’m not doing it voluntarily, and I’m not doing it early. Not because I think I can dodge the law forever, but because I’d rather be the last platform standing on this than the first one to fold.
~ vctrl