Meta Platforms: Lobbying, dark money, and the App Store Accountability Act

Original Article ↗ Hacker News Discussion ↗

Tech companies, led by Meta, are pouring millions into U.S. lobbying campaigns and “child safety” nonprofits to push state laws that move age-verification duties into operating systems rather than apps or platforms. Critics argue these bills would create OS-level age signals that any app can query, building powerful new surveillance and censorship infrastructure under the guise of protecting minors while shifting legal liability away from social media giants and raising barriers for open-source and small developers. Comparisons with the EU’s more privacy-preserving, zero-knowledge-based approach highlight how regulatory design can either entrench corporate power or constrain it.

Meta, lobbying, and age-verification bills

  • Discussion centers on a GitHub-based investigation claiming Meta and allies funneled tens of millions into PACs and nonprofits to push state and federal “age verification” / “App Store Accountability” laws.
  • Claimed incentives for Meta and other large platforms:
    • Shift legal liability and implementation cost to OS vendors (Apple/Google).
    • Raise barriers to entry for smaller competitors who can’t afford compliance.
    • Obtain verified age/identity signals useful for ad targeting and bot control.
  • AI companies are also said to back bills like KOSA, aiming to sell content-rating and ID-verification services.

Age verification vs surveillance

  • Many argue “protect the children” is a pretext for:
    • Building infrastructure for pervasive identity checks, tracking, and censorship.
    • Weakening anonymity and making all online speech traceable.
  • Others support some age verification as analogous to alcohol / strip-club rules, arguing businesses should share responsibility with parents.

Zero-knowledge proofs and EU vs US

  • Some praise the EU’s eIDAS 2.0 / Digital Identity Wallet approach: open-source, ZKPs, limited to very large platforms, with FOSS exemptions.
  • Others counter that the EU wallet design in practice:
    • Uses hardware attestation, bans rooting/jailbreaking, issues short-lived trackable tokens.
    • Still creates centralized, government-influenced control over devices and access.
  • Several note that “pure” ZKPs cannot stop credential sharing at scale, so real systems add logging and rate limits, eroding privacy.

Parental responsibility vs state role

  • Strong faction: parents (not government/OS vendors) should control children’s access via device-level parental controls, whitelists, kid devices, SIM/router filtering.
  • Counter-arguments:
    • Many parents are outmatched by platforms’ engagement tactics and kids’ technical skills.
    • Historically, third parties share duties (e.g., not selling alcohol to minors).

Technical proposals and critiques

  • Suggested alternatives:
    • OS child accounts with a simple age bracket dropdown, “adult by default,” no ID upload.
    • Standardized HTTP headers (e.g., “this site is 18+” or “X-User-Age”) so browsers/OS can enforce parental policies locally.
    • Site/app “age tags” plus parental controls, instead of user identity checks.
  • Critics worry any OS-level age API becomes a generalized identity channel usable for mission creep (citizenship, real-name linking, etc.).

Social, political, and evidence debates

  • Concerns about:
    • Infrastructure excluding people without IDs (poor, undocumented, tourists).
    • Future expansion from porn/social media to general speech, politics, LGBT content, war coverage.
  • Others cite research suggesting social media time is a relatively small factor in teen mental health, framing the panic as cyclical (like past fears about TV, games).
  • Some see this as part of a broader trend toward oligarchic control, weak enforcement of existing privacy law, and cheap but powerful lobbying.

Skepticism about the investigation and response

  • A few commenters question the GitHub report’s rigor:
    • Heavy reliance on an LLM (Claude) with blocked sources and “potential role” speculation.
    • Some links (e.g., small individual donations) seen as weak evidence of coordination.
  • Others view repeated Reddit mass-report removals of the post as circumstantial evidence something sensitive is being exposed.
  • Proposed responses range from contacting representatives and public advocacy to unrealistic ideas like kernels refusing to boot in affected states; many express fatigue and pessimism but others insist political engagement is still essential.