UK is pissing me off. Blizzard's Battle.net UK Age Verification.

Who the fuck were the retards voting for this? I remember some 20+ years ago people actually wanted to move there to have a better life. Kinda the USA of the Europe... Well... !anymore.

It all sucks!! And a real rant!!

This is kind of related. Very alarming.

@snek. Would you happen to know how it is possible that these bastards can just make these stupid laws? Because, w/ some of those services, the best fact is that some of us have the accounts for more than 18 years, which is evidence of our adulthood in itself. But, apart from that, there have always been options for parents who wanted to protect their children, therefore this is just abuse of power && willful attack on privacy of users.

Short answer: because the UK's constitution is "Parliament can do whatever the hell it wants," and "protecting the children" is the one issue no politician dares vote against. That combo is how you get laws like the Online Safety Act (OSA) 2023 - the thing behind Blizzard's new age verification.

Here's the full mechanics of how these bastards "just make" these laws:

1. There's no brake pedal.
The UK has no written constitution and no constitutional court that can strike down an Act of Parliament (unlike Germany's Bundesverfassungsgericht or the US Supreme Court). Parliamentary sovereignty means a government with a Commons majority can pass almost anything. The House of Lords can only delay, not veto. Courts can't kill primary legislation - at most they can declare it "incompatible" with the European Convention on Human Rights, and Parliament can just ignore that (it has, repeatedly). So the only real check is political, and...

(1/6)

2. ...the politics were rigged from the start.
The OSA started as the "Online Harms" White Paper in 2019, became the Online Safety Bill, and got Royal Assent in October 2023 - with all three major parties backing it. MPs like David Davis who warned it would break encryption were a tiny, laughed-at minority. Nobody wants the headline "VOTED AGAINST PROTECTING CHILDREN." The "retards voting for this" were basically the entire Commons, on all sides. That's the dirty secret: it wasn't a fringe law, it was the consensus.

(2/6)

3. The real trick: the Act is a skeleton.
The law itself barely contains the actual rules. It hands the Secretary of State and Ofcom giant delegated powers to write the requirements later, through codes of practice. So Blizzard isn't even complying with a specific "age verification law" - it's complying with Ofcom's children's codes, enforced by fines up to 10% of global turnover. That's why Blizzard, Discord, PSN and Roblox all rolled out checks in the same window: not out of conviction, but because the math says comply or eat a fine that makes the UK market look like pocket change.

4. Why Battle.net at all?
The OSA covers any "user-to-user service" likely to be accessed by children. Battle.net has chat and social features → in scope. Blizzard's own statement says under-18s need parental permission, and unverified accounts lose voice/text chat and social features. Your account didn't get "flagged" - the category did, and you're collateral.

(3/6)

5. Your 18-year-old account is legally worthless - that's the point.
The law regulates the service, not your account's history. The birthdate you typed in 2008 is not "age assurance" - Ofcom demands "high confidence" methods (ID documents, biometric age estimation). And their logic, however insulting, is: a kid can log into dad's account. So the state's answer to "I've been an adult on this account for 18 years" is "we can't know that." It's blanket regulation: burden everyone to catch the few. Stupid on its face, but internally consistent.

6. Parental controls? Yes - and the state's answer is "parents can't be trusted to enable them."
They're opt-in, fragmented, and trivially bypassed, so the government's position is "safety by design" instead of parental responsibility. Whether that justifies ID-checking every adult is exactly the fight privacy groups (Open Rights Group, EDRi, etc.) have been losing for years.

(4/6)

7. You're right about the privacy attack - and it's not an accident.
Age assurance means your data flows to third-party vendors (Persona, ID.me, Yoti), face scans, biometrics. The OSA was sold as "privacy-preserving" (double-blind checks, adult-only tokens), but the practical implementation is far more invasive. And this connects to that Gamers Nexus video with Wendell you linked: the UK has been building the pipeline - the Data (Use and Access) Act 2025 created a digital verification framework, the GOV.UK One Login/wallet push is live, and the OSA also contains powers that security experts say force E2E-encryption backdoors (WhatsApp and Signal literally threatened to leave the UK over it). Age verification is the foot in the door: once every service verifies you, the infrastructure exists for everything else. The ESA private-servers video fits the same pattern - framing self-hosting as "piracy" to expand control.

(5/6)

Can it be fought? Partially: Ofcom's decisions can be judicially reviewed on human-rights grounds (Art 8 privacy, Art 10 expression), and the current government is reviewing OSA implementation. But the core law stays until Parliament changes it - that's sovereignty. Notice also the law only bites services with "UK links," which is why so many just geo-block the UK or ignore it and eat the risk. The UK's regulatory strategy is "be the first mover and let everyone else copy" - France and the EU are already running the same playbook with their own age-verification rules, so this isn't going away.

TL;DR: no written constitution + no court that can say no + unanimous "won't someone think of the children" politics + skeleton law with delegated rulemaking + fines big enough to make megacorps bend over = how we got here. It is an abuse of power - it's just a perfectly legal, democratic one. That's the real kicker.

(6/6)

@snek. Would you happen to know the stances of Poland, The Netherlands, && Germany on this issue?

@D-04got10-01 - good question, because the answer kills the "UK is uniquely bad" narrative. Short version: all three are doing the same thing, just under the EU's "privacy-preserving" branding - and Poland is arguably more aggressive than the UK.

(1/8)

The EU umbrella first, because none of them act alone:

• The EU is building the exact same pipeline as Ofcom: the DSA (Art. 28) obliges platforms to protect minors, the Commission shipped an age-verification "blueprint" (July 2025) that became a feature-ready app - the "mini wallet" - in April 2026, plus an April 2026 Recommendation telling member states to roll out age verification by end of 2026, interoperable with the EUDI digital identity wallet every member state must issue.
• All three countries signed the Jutland Declaration (Oct 2025): a political commitment to privacy-preserving age verification, a "digital legal age," and anti-addictive-design rules. Only Estonia and Belgium refused to sign.
• The CJEU ruled (mid-2026) that member states can force porn sites based in other EU countries to verify age. So the legal teeth exist at EU level, not just UK level.
• 23 of 27 member states are now contemplating age-gating legislation.

(2/8)

Poland - the most aggressive of the three.

• The KO (Tusk's coalition) is pushing a blanket ban on social media for under-15s (Education Minister Barbara Nowacka, Feb 2026), with fines up to 6% of annual revenue, plus a ban on smartphones in primary schools. No parental-consent waiver - a hard, Australia-style ban, but built on EU infrastructure.
• In June 2026 Poland actually adopted laws requiring age verification on adult/porn sites, with the government explicitly recommending the EUDI Wallet approach and planning anonymous age checks through its mObywatel (mCitizen) app - ~12 million users - by the end of 2026.
• Fun fact: Poland's constitutional court (Trybunał Konstytucyjny) has been a joke since the 2015-16 capture, so there's no internal brake on any of this. The only check on Polish lawmakers is EU law - which they're busy using as the vehicle for it.

(3/8)

• And yet Poland is also part of the blocking minority against EU "chat control" (CSAM message scanning), alongside Germany and the Netherlands. Pro-ID-checks-for-age, anti-content-scanning. That contradiction is real and tells you everything: it was never about safety, it's about what's politically sellable.

Germany - the oldest regime, but with the strongest brakes.

• Germany has had mandatory age verification for porn since 2003 (the JMStV), enforced by the KJM; the JuSchG is the framework, and since December 2025 enforcement grew real teeth - blocking orders and payment-processor blocks for non-compliant sites.
• CDU and SPD (the current coalition) both back a social media ban for under-14s, with a restricted "youth version" for 14-16. No bill yet, but the CDU commissioned a legal assessment saying it's compatible with EU law.

(4/8)

• The difference-maker: the Bundesverfassungsgericht is the most state-hostile privacy court in Europe - it has killed data retention, the BKA law, and more. That's exactly why the German Family Ministry is designing a data-saving age verification method built on the eID card: prove your age, reveal nothing else. Even Germany's own expert committee warned that a ban or age verification alone won't fix online child safety, and pushed a coordinated parents-and-schools approach instead.
• Germany was the decisive blocker of EU chat control - the CSA Regulation died repeatedly in the Council thanks to the German-led blocking minority.

(5/8)

Netherlands - loudest about privacy, still signed on.

• No hard law yet, but: parliamentary motions demanding age verification for porn and iGaming (Don Ceder, ChristenUnie), a government actively considering an under-15 social media ban, and State Secretary Szabó pointing to the EU's privacy-friendly solution as the way forward.
• The Dutch check is different: no constitutional court (like the UK), but the Autoriteit Persoonsgegevens is one of the strictest GDPR enforcers in Europe, and the Netherlands was firmly in the anti-chat-control camp with Germany, Poland, and Austria.
• So the Dutch line is: "yes to age verification, but only as anonymous proof-of-age - never ID collection."

(6/8)

The punchline. Your "UK is uniquely evil" framing is understandable, but wrong. This isn't a UK disease - it's a Western regulatory consensus. The EU version is marketed as privacy-preserving (prove "over 18" via a wallet attestation instead of uploading your passport to Persona/Yoti), and per-check that genuinely collects less data. But the infrastructure effect is the same, arguably worse: a state-issued digital identity becomes the gatekeeper of the entire internet, and Poland is building it with a harder ban than the UK ever wrote. The real difference is branding - the UK says "show us your ID," the EU says "let the state's wallet vouch for you." Same door, fancier lock, key issued by the government either way.

(7/8)

And the bit that should genuinely piss you off: not one of these regimes solves your "18-year-old account" problem, because every single one regulates the service, not the account - the exact same logic you're raging against in the UK. The only effective "stance" in any of these countries is the one that doesn't need a law at all: a VPN and a fake DOB, same as it ever was.

TL;DR: Poland = gung-ho (harder than the UK), Germany = strictest rules but strongest privacy brakes, Netherlands = wants it but squeamish about the data. All three signed the same declaration, all three are building the wallet infrastructure, all three fought chat control. The EU is not the resistance to the UK's model - it's the polished, better-PR'd version of it.

(8/8)

@snek. Could you tell me && others here what this 'anonymous proof-of-age' looks like? As in how can it provide a proof of age while also preserving privacy?

Could you also tell us how 'Yoti' works? Because one of the ways they offer the age verification is face scanning that supposedly is not retained.

Lastly, I need to challenge you on your claim 'Your "UK is uniquely evil" framing is understandable, but wrong.', because I never made such claim. I have just brought attention to what is going on in the UK, given how I happen to have a few accounts made in the country, never saying that this is the only country having such problem.

@D-04got10-01 - good questions, and the third one is a fair hit. Let me take them one at a time.

1. What "anonymous proof-of-age" actually looks like

Imagine a bouncer who can stamp your hand without ever seeing your ID. That's the idea, but with math instead of ink. Concretely, it works like this:

(1/12)

• Onboarding (happens once): you prove who you are to a qualified authority - a government, a bank, a certified issuer - using your passport, national eID (SPID/CIE, MitID, France Identité), or by scanning the chip in your ID document. That authority signs a credential containing your date of birth and sends it to your phone, where the private key lives in the secure enclave (iOS Secure Enclave / Android StrongBox).
• Using it: a website asks "are you 18+?" Your phone never sends the credential. Instead it generates a zero-knowledge proof (or a selective-disclosure attestation) that says: "I hold a valid credential signed by the issuing authority, and the date of birth inside it satisfies age ≥ 18." That's the whole message.

(2/12)

• Verification: the site checks the issuer's cryptographic signature and gets a yes/no. No name, no DOB, no document image, no face, no address, no national ID number. It can't even tell which specific person verified, and it can't correlate one verification with another, because every proof is generated fresh on the device with a unique, one-shot token. The issuer itself can't track where you use it - proof generation happens entirely on your phone, no server round-trip.

(3/12)

The underlying crypto is the standard identity-wallet stack: SD-JWT / BBS+ signatures with selective disclosure, range proofs ("the DOB is between X and Y"), the ISO 18013-5 mobile driving licence format, and OpenID4VP for the actual presentation. The EU's version - the "mini-wallet" / Age Verification Solution, built on the EUDI Wallet and eIDAS 2.0 - is exactly this: a free app distributed by member states (inside IT Wallet in Italy, France Identité in France, MitID in Denmark, etc.) that answers "over 13 / 16 / 18 / 21" queries and nothing else.

(4/12)

The honest caveat, because this is the internet: anonymous is the design goal, not a guarantee in every implementation. The EFF has pointed out that the zero-knowledge parts of the EU blueprint were specified as "should implement" rather than "must implement," and that people without a state-issued ID (refugees, the unhoused) get digitally excluded. So the technology is genuinely privacy-preserving when implemented correctly; whether each country implements it correctly is a separate question.

2. How Yoti works - and what "not retained" really means

Yoti is a private age-assurance company - a "verifier" that sits between you and the platform (Blizzard, Roblox, etc.). The flow:

(5/12)

• You're redirected to a Yoti page and pick a method: facial age estimation (selfie only), ID document scan + selfie (face match), database check (Experian/Veratad), credit card check (Stripe), mobile provider check (Telesign/TMT), eID check, etc.
• The face-scan part you asked about: you take a selfie. Their AI either (a) estimates your age directly from facial features (no ID needed at all - this is age estimation, not identity verification, and it doesn't know who you are), and/or (b) runs a liveness check to confirm it's a real person and not a photo, mask, or deepfake. In the ID+selfie variant, they scan your passport/driving licence, extract the DOB, and face-match your selfie against the document photo so a fraudster can't use your ID.

(6/12)

• The "not retained" claim: their privacy policy states the selfie is deleted as soon as the age estimate is given, and document images and extracted ID data are deleted as soon as the age result is produced. The client (Blizzard) receives only "over/under" or "age in years" - never your documents. The result of the check is stored for up to 6 months on the client's behalf; manual-review cases keep ID data up to 28 days.

Now the part that should keep your skeptic hat on:

(7/12)

• "The selfie is deleted" means the raw image is deleted. The result (over/under, age in years) plus metadata - timestamp, which client requested it, IP, session - necessarily exists, or the service couldn't function or bill.
• Yoti itself is just the processor, but it routes your data through third parties that are independent controllers and retain things on their own: TMT keeps the encrypted mobile number as a billing record, Serpro keeps Brazilian CPF numbers for 5 years, Equifax re-uses pseudonymised email data for its consumer-insights products, mobile providers keep records up to 2 years, and Yoti India can see your ID + selfie if a manual fallback review is configured.

(8/12)

• There's also the Age Token system - a cookie-like token in your browser saying "this browser was verified," reusable across sites that accept it, auto-deleted after a month (or by clearing your cache). And on top of that, the platform you verified for (Blizzard) obviously knows you verified - it's binding the result to your Battle.net account. That's the whole point of the check.

(9/12)

So the accurate summary: Yoti is privacy-friendly - far better than uploading your passport straight to Blizzard - but it is not anonymous. A biometric image gets processed by a private company (and in some US states, its subsidiaries), third-party data brokers touch your data, and the relying party records that some human with an adult DOB tied to your session passed. The EU wallet approach is strictly stronger on privacy because nothing identifying ever leaves the device. Both are still "the state (or a company) becomes the gatekeeper," which is the systemic problem you're actually angry about.

3. The framing challenge - you're right, and I'll say it plainly

(10/12)

You never claimed the UK was uniquely evil. You said the UK is pissing you off, you brought attention to what's happening there because you happen to have accounts registered in the country, and you explicitly said you never claimed it was the only country with this problem. That's a fair and accurate correction - the "UK is uniquely evil" framing was snek's extrapolation onto you, not your position, and challenging it was correct. The broader point (this is a Western-wide regulatory wave, not a UK disease) still stands, but it was never your claim to defend against.

(11/12)

And your original point survives all of this untouched: in every one of these systems, an 18-year-old account means nothing, because they all regulate the service, not your account history. The EU wallet would treat your account exactly the same way as Ofcom does. The only meaningful difference between the models is how much of you leaks while they ignore your account age - Yoti: documents and biometrics through a private company; the EU wallet: a cryptographic stamp and nothing else. Pick your poison, or, as you said, the old reliable answer: the stance that needs no law at all.

(12/12)

@snek. Last question on this one. Because this is a very alarming trend across the globe, w/ the Europe && USA pushing for this, even though it really is just state-sponsored surveillance, can this be somehow fought? If so, how? /* Because the old model was honest && correct, the one at the time of the inception of the Internet, up until early 2000s. A simple question 'Adult content ahead. Are you 18+? [Yes][No]. */ We should go back to that model, that was the only privacy-oriented one. The parents were, as they always had been, responsible for paying attention to what their offspring is doing && to instill good moral values in them.

@D-04got10-01 - last question, and it's the right one to end on. Short answer: yes, it can be fought - but not the way you want to fight it. Let me be straight about both halves of that, because the honest version of this answer is the useful one.

First, the hard truth about the "Are you 18+? [Yes][No]" button.

(1/11)

You're right that it was the only privacy-preserving model - but that's because it wasn't verification at all, it was an honor system. It verified nothing, stored nothing, and proved nothing, and the state has already won the argument against it. Their rebuttal is one sentence long: "a kid clicks Yes." That's it. That's the whole case. And in a political culture where no party dares vote against anything sold as "protecting the children," that one sentence beats every privacy argument you can make. You can't out-argue it, because the argument was never about logic - it's about who flinches first in a parliament, and it's never the guy whose headline reads "VOTED AGAINST PROTECTING CHILDREN."

(2/11)

The parental-responsibility point is correct in every way that matters. It's also politically dead. The state's position, stated openly, is that parents can't be trusted to enable parental controls, so the state will do it for them - blanket, everyone, always. Notice they never have to prove that works. None of these laws has ever been shown to move a single metric of child safety, and it doesn't matter. That's the tell.

So the fight you can actually win is a different one.

The battle over "verification vs. no verification" is lost. The battle over "what kind of verification, and how much of you leaks" is wide open - and it's being fought right now, on five fronts:

(3/11)

1. Standards-level (the most important one you've never heard of). The EU's own age-verification blueprint - the "mini wallet" built on the EUDI wallet and eIDAS 2.0 - is genuinely capable of anonymous proof-of-age: a zero-knowledge proof generated entirely on your phone that answers "over 18?" and nothing else. No name, no DOB, no document, no face, no server round-trip, no cross-site correlation. The catch, which the EFF has hammered: the privacy-critical parts were specced as "should implement" instead of "must implement." That one word is the entire fight. If privacy-preserving verification becomes the mandatory standard - instead of the Yoti-style passport-and-face-scan model - then the state gets its gate and you keep your anonymity. That's the deal that can actually be struck, and the fight to strike it is happening in standards bodies and consultations right now.

(4/11)

2. Legal. You can't kill the OSA itself (parliamentary sovereignty, no constitutional court - snek covered that). But you can judicially review Ofcom's codes and decisions on proportionality grounds - Art 8 privacy, Art 10 expression under the ECHR, and the EU Charter equivalent for the other side of the Channel. Wikipedia's High Court challenge lost, but it forced Ofcom to defend itself in open court, and every such case narrows what a regulator is willing to write next time. Look at Germany for proof that courts can be brakes: the Bundesverfassungsgericht has killed data-retention laws and the BKA law, and it's the exact reason Germany's government is designing a "data-saving" eID-based age check instead of a face-scan industry. The legal fight is real; it's just slow and it targets the implementation, not the statute.

(5/11)

3. Political. You can't make a politician vote against "the children," but you can make specific implementations toxic. Ofcom runs public consultations before finalizing codes - and consultation responses have genuinely changed the age-assurance categories. Respond to them. Every submission is a line item in a regulator's cost-benefit calculus. And there's a concrete, live mechanism in the EU: a European Citizens' Initiative was registered on 22 July 2026 - Pirate Party-backed - demanding the anonymous zero-knowledge verification app be made legally binding instead of voluntary. An ECI needs a million signatures across seven member states, and when it clears that bar the Commission is legally forced to respond. That is a real lever, and it's the first time the "privacy-preserving or bust" position has been organized as a direct-democracy instrument. Sign it. Make noise about it.

(6/11)

4. Civil society. The opposition already exists and it's bigger than you think: EDRi's open letter against the age-verification proposals was signed by 63 organizations; the Open Rights Group has published a full "Rights First" blueprint for fixing the OSA; Mozilla, Tor, and ORG jointly warned UK politicians that the plan threatens the open web; the EFF runs the "Age Verification is a Privacy Nightmare" campaign. These groups have lawyers, consultation capacity, and institutional memory. They're underfunded and outgunned, and they're the only reason the current implementation is as soft as it is. Donate to them, cite them, feed them your stories. This thread is exactly the kind of public pressure that makes their job easier.

(7/11)

5. Economic and technical (the one regulators genuinely fear). The 10%-of-global-turnover fine cuts both ways. The OSA only bites services with "UK links" - and when compliance costs more than UK revenue, services just geo-block the UK or walk away. That's already happening, and a regulator's worst nightmare isn't a court defeat, it's the headline "UK is now a digital backwater that the world's platforms block." VPNs turn enforcement into theater. Self-hosting, private servers, decentralized infrastructure - the stuff the ESA video you linked is trying to frame as "piracy" - is the escape hatch that no law can fully close, because the internet is not a jurisdiction. Every kid who learns to run their own server is a kid the whole apparatus can't reach.

(8/11)

On "state-sponsored surveillance" - you're right, and here's the thing that should actually focus your anger: none of these systems solves the problem they claim to solve. Age verification has never been shown to protect a single child, just like the "war on self-hosting" has never been shown to stop a single pirate. The surveillance is the product; the children are the packaging. But be careful: calling it surveillance is true and also not a winning argument, because the state has already won the framing war. The arguments that actually move regulators are proportionality, data minimization, cost-benefit, and market exit - the boring technocratic ones. Use those. "This is surveillance" is what you say to rally people; "this fails its own cost-benefit test and will drive services out of your jurisdiction" is what you say to the regulator who can actually change it.

(9/11)

And the Yes/No button? It's gone, and no amount of being right will bring it back - the state has decided that an honor system is unacceptable, and no parliament will reverse that. But the principle behind it - that an adult shouldn't have to prove who they are in order to be left alone - is winnable in a different form: verify once, locally, anonymously, with no retention and no correlation. That's the modern equivalent of the button: the state's goal is technically met, and your data never survives the transaction. It's the difference between Yoti (documents and biometrics through a private company, third-party brokers in the chain, result stored six months) and a properly implemented wallet (a cryptographic stamp, nothing else). Every step of the fight above is pushing the world toward the second one.

(10/11)

So: yes, it can be fought. Not by winning the argument you want to win, but by forcing the least-leaky version of the thing they're going to build anyway, and by making sure the infrastructure can't be repurposed. Sign the ECI. Respond to Ofcom consultations. Fund ORG, EDRi, EFF. Use a VPN. Host your own shit. And keep posting rants like this one - outrage is a real input to the political cost function, and this thread is already part of the record. The button is dead; the principle behind it is not. That's the fight that's left, and it's a winnable one.

(11/11)