ZKPs and Age Verification on Aztec

Transcript

[Music] I think the reason why age verification is so contentious today is because it's sitting at the intersection of a couple of competing issues. On the one side, you have protecting minors. On the other side, you have preserving adults freedoms. And on the other hand, you also want to preserve privacy. And I think today, the way we're thinking about these issues are kind of they have to be a trade-off. And I just don't think that's the case. And I think that's where we're getting wrong here.

And we are getting caught in a policy tugof-war kind of situation when in reality, we kind of have to think about these issues kind of out of the box and be more innovative in the way we want to regulate them. I think the main thing that lawmakers are getting wrong when thinking about regulating age verification is that they by default want to make privacy secondary and they're kind of thinking model they don't think about privacy. They only want to care about compliance and want privacy to come second. But in reality that doesn't really work out. Privacy needs to be by default in order to be properly preserved. Uh and therefore um when thinking about these issues, they

need to prioritize privacy more and we're seeing in the majority of the regulations that have been put out there both in the UK, in Australia, upcoming regulations in the US as well, is that privacy is simply not prioritized. And they're just forcing companies to collect a very large amount of data in order to verify people's age. And that just doesn't work because what you end up with is a very costly and a very risky method of age verification. And and it's impossible to just preserve privacy that way. You're just creating all these these very large data pools.

They're extremely sensitive and honeypotss of information that companies have to preserve some way and that's practically impossible. They just become they're increasing their liability and increasing their risks. Uh so I think that's the the thing that is fundamentally flawed in the current policy thinking model when it comes to regulating age verification. Policy makers are getting it wrong because they're banning social media access. For example, in Australia they ban social media access for teens. So they're they're using the political tagline, we're going to ban this. We're going to protect teens without providing solutions.

and that ban will come into effect in 6 months in Australia and there's no solution on the table. So this is a typical example of politicians providing a you know a policy position without a a policy solution and then when you present them with novel technological solutions such as zero knowledge proofs which enable total privacy when accessing a website. They're a bit fearful of that. So they don't really wanna they don't understand it primarily and secondarily they don't really know what that will do long term.

So they're I think the the ignorance they're getting it wrong because they're providing positions and not solutions and they're getting it wrong because the solutions they don't really understand them and they don't really want to engage with the with the technology sector to implement them. What's really interesting with the potential behind zero knowledge proofs or ZKPS is that you have a way to mathematically verify that someone is um a minor or it is allowed to access uh content that would only be for an adult without revealing any additional uh information or data that would be sensitive otherwise to reveal. And the way that operates is that you're able to

create a cryptographic proof that someone is of a specific age again without revealing that underlying data. And that's a huge potential that needs to be unlocked. And currently what we're seeing is that policy makers have a really hard time thinking of out of the box and they're really focusing on traditional age verification methods that are flawed and are not working. Um, so we're very hopeful that the full potential behind zero knowledge proof is finally unlocked. >> I completely agree with what Amal said. I think the only thing I would add is zero knowledge proofs are the only solution where you not only do not have to give your passport identity data over

to a third party that will eventually leak it. But it's also the only solution where you don't require to provide any biometric data. There's some other solutions where you know you may want to scan your eyeballs. Nobody likes their eyeball scanned or the f fingerprints taken. So this is the only balanced solution mathematically guaranteed where you have complex moon math um accessible to uh everyday people to meet you know policy goals.

We are seeing a huge momentum around zero knowledge proof worldwide. Uh both uh on in on the big tech side of things but also a little more in the policy side of things and some regulators are starting to to be curious about these these type of issues and the potential behind it. I'm thinking more specifically about Google who re recently rolled out zero knowledge proof for the Google wallet. Uh so that's really interesting also drove a lot of momentum. I'm also thinking about a pilot program that the French data protection authority rolled out last year as well where they are testing zero knowledge proof for age verification

which also is very exciting. We're seeing a lot of noise and a lot of positive signals to implement zero knowledge proofs in the real world, not only in web 3, but also in web 2. And as Amal said, Google is introducing certain solutions using zero knowledge proofs into their wallet. They're bad for some reasons, which I'll get into. and and I think they're better approaches which I'll get into in a second as well.

They're bad because Google currently is implementing these very sensitive cryptography tools which are not open source which means we do not know if they actually have access to that data or not until and unless it's open sourced. Also, Google Wallet is proprietary. So, you're locking yourself into Google system to be able to do anything with your data. We can do much better. We need to rely on truly open- source systems where anybody can verify the code and be sure that it's not going to leak your data. And we need to be using systems that are not proprietary

and that can be also inter interoperable between web 2 and web 3. And I think the solution lies in in systems which which like Google implement is your knowledge proofs into into them but they need to be accessible and usable by everybody including by governments. And what I what I would love to see happen more is for not only Google but governments use these kind of open-source truly open- source non-proprietary nonprofit systems to to truly ensure that people's data remains in their hands and gives them total freedom what to do with that data.