The only implementation I would support is one where the asking website doesn’t know your ID, and the verifying website doesn’t know what you’re trying to visit. Essentially just asking for a one-time use token that verified your age, and providing that token to the website you’re trying to visit.
Edit for a bit more detail: User authenticates to ID website, which provides them a token with age verification (true/false) and a short (10 minute?) TTL. This token is encrypted by the ID website. User then provides this token to the asking website (eg: pornhub). Pornhub then sends the token back to the ID website to decrypt it. All pornhub knows about you is whether or not you’re of age, and the verifying website never knows what the token is for.
There would be too much value in tracking that token for such a scheme to stay secure. Governments or shady corporations or illegal black markets or all of the above would be all over keeping tabs on what sites are visited by which tokens and matching them to identities.
The only implementation I would support is one where the asking website doesn’t know your ID, and the verifying website doesn’t know what you’re trying to visit. Essentially just asking for a one-time use token that verified your age, and providing that token to the website you’re trying to visit.
Edit for a bit more detail: User authenticates to ID website, which provides them a token with age verification (true/false) and a short (10 minute?) TTL. This token is encrypted by the ID website. User then provides this token to the asking website (eg: pornhub). Pornhub then sends the token back to the ID website to decrypt it. All pornhub knows about you is whether or not you’re of age, and the verifying website never knows what the token is for.
There would be too much value in tracking that token for such a scheme to stay secure. Governments or shady corporations or illegal black markets or all of the above would be all over keeping tabs on what sites are visited by which tokens and matching them to identities.
ISPs already have, and do sell that data.