#fediverse

Take "age verification," the latest social contagion sweeping through authoritarian governments around the world. In the name of keeping kids from seeing stuff that's not kid-friendly online (a perfectly reasonable goal), governments are demanding that tech companies somehow deduce the ages of their users and block them from seeing adult materials. Some age verification proponents claim that it's possible to verify a user's age without creating as massive privacy catastrophe that reveals the browsing habits of every internet user, of every age. These people are wrong:

https://pluralistic.net/2025/08/14/bellovin/#wont-someone-think-of-the-cryptographers

The only way to verify that a user is a child is to verify the user, which means performing extraordinarily invasive checks on every internet user, and storing the results of those checks, and, inevitable, leaking the result of those checks.

The Big Tech companies are delighted by this. Google and Meta have both offered to do a kind of digital phrenology on their users to determine their ages. After all, they spy on us so much that they can probably make a good guess about our ages. And if they guess wrong, well, no biggie, they'll just block all the edge cases and force users to provide them with even more sensitive data.

But the future-proof, federated, decentralized services can't do age verification. Oh, sure, some of the servers in these federations can verify their users' age, and they might have to, because you can always find that single throat to choke for the people running the main Mastodon and Bluesky servers. But you can use Mastodon and Bluesky without using those servers – and they can't stop you.

This is something that the Turkish dictator Recep Tayyip Erdoğan discovered last spring, whe he ordered Bluesky to block information about his political rivals. All Bluesky can do in these cases is flag some messages as "banned in Turkiye" and then turn on the "block banned in Turkiye posts" filter for Turkish accounts. Those users can just turn that filter off, or avail themselves of a third-party client that doesn't auto-subscribe them to "block banned content" filters:

https://gizmodo.com/bluesky-just-bowed-to-censorship-demands-in-turkey-but-theres-a-loophole-2000593628

That's what it means for a service to be a protocol, not a platform. It means you can't demand to speak to the manager of the protocol if you don't like how someone is using it. It means there isn't a single throat to choke:

https://knightcolumbia.org/content/protocols-not-platforms-a-technological-approach-to-free-speech

Today, the new, future-proof federated services are trying to figure out how to comply with age verification orders. Bluesky has announced that it will age verify UK users:

https://www.theverge.com/news/704468/bluesky-age-verification-uk-online-safety-act

But you don't have to interact with the Bluesky servers to use Bluesky. While Bluesky was (very) slow off the mark to enable the tooling that would allow anyone to talk to anyone else using Atproto (the underlying protocol) without Bluesky's permission, that day has arrived now. There are now Bluesky (the service) implementations that are entirely separated from the authority of Bluesky (the company), most notably Blacksky, created by and for Black social media users who lived through Musk's enshittification of Black Twitter and won't get fooled again:

https://www.techdirt.com/2025/08/27/techdirt-podcast-episode-428-blacksky-demonstrates-the-promise-of-open-social-media-protocols/

Meanwhile, Mastodon (the organization) has said that it doesn't have "the means" to comply with age verification rules in Mississippi:

https://techcrunch.com/2025/08/29/mastodon-says-it-doesnt-have-the-means-to-comply-with-age-verification-laws/

The Mastodon server operated by the Mastodon organization has a policy barring under-16s from getting an account there. But there are many, many Mastodon servers (including, you'll recall, Truth Social) and they are all technically capable of talking with one another. Even if Mastodon (the organization) implemented some kind of invasive age verification on its server, other organizations – so distant from Mississippi as to be beyond legal retribution – could sign up users of any age, at its discretion.

One wrinkle here is whether there is an "enforcement nexus" between one of these independent Mastodon or Bluesky servers and a government seeking to impose age verification or other censorship policies. If you're running one of these servers, you wanna be sure your throat is out of choking range of these governments:

https://pluralistic.net/2023/03/05/theyre-still-trying-to-ban-cryptography/

The easiest way to do this is to not have any personnel or assets in territories controlled by governments seeking to impose censorship requirements. Large corporations whose investors made a bet on global domination find this tradeoff difficult to make. They want to open sales offices in every country.

But co-ops, individual tinkerers and small businesses typically don't have assets or personnel in a lot of countries or states, and avoiding the censorious ones doesn't pose much of a challenge.

The other enforcement nexus to worry about isn't enforcement against a server's operators, but rather, enforcement against its data. Territories with national firewalls (or heavily concentrated ISPs who represent a tractable number of chokeable throats) can block noncompliant servers from their users (who might or might not avail themselves of VPNs to evade thse blocks).

There aren't many national firewalls, and enumerating all the noncompliant servers in the Fediverse is a big chore for their operators (less so for all the noncompliant Atmostphere servers, because there's just not that many of those – yet). On the other hand, the mobile device duopoly of Google and Apple represent a pair of trivially chokeable throats that can be used to extinguish any app that displease a country's censors (all the more reason to make everything web-first and treat apps as unreliable adjuncts to core web functionality).

But there's one more potential chokepoint: to the extent that the Bluesky (the service) or Mastodon (the service) maintain some nexus of control over users, even users on independent servers, they could come under pressure to terminate users that displease governments. Now, Mastodon has no such control over users, and if it tried to exert that control (for example, by pressuring an independent server to terminate their users' access), they could be sued for tortious interference with contract.

Unfortunately, Bluesky has chosen to insulate itself from that hedge against being the chokeable throat that is used as a means to exerting pressure on independent servers in the Atmosphere. Bluesky's Terms of Service trap all of its users in a "binding arbitration" waiver that forces them to surrender their right to sue. That means that if Bluesky were to threaten Blacksky in a bid to force it to do age verification or engage in some other form of censorship, anyone involved with Blacksky who ever created a Bluesky account would be unable to use to courts to defend themselves:

https://pluralistic.net/2025/08/15/dogs-breakfast/#by-clicking-this-you-agree-on-behalf-of-your-employer-to-release-me-from-all-obligations-and-waivers-arising-from-any-and-all-NON-NEGOTIATED-agreements

(However, if you set up a Bluesky server without ever joining Bluesky (the service) and clicking through its ToS, you're golden.)

Of course, none of this matters to Maga – but it should. Decentralized systems with no readily chokeable throats are good for people with disfavored views, and that includes a lot of the Maga movement. Remember, Trump's agenda is incredibly unpopular:

https://navigatorresearch.org/wp-content/uploads/2025/04/Navigator-Topline-F04.07.25.pdf

Someday, Maga is going to find that their enemies have found the right throat to choke to silence them. But Maga's useful idiots just keep on stepping on this rake – these are the same self-owning fools who opposed municipal fiber and thus ensured that if just a handful of giant ISPs decided to deplatform you, you'd disappear from the internet:

https://pluralistic.net/2022/12/15/useful-idiotsuseful-idiots/#unrequited-love

Bluesky users were furious when JD Vance joined the service. Maga culture warriors were furious when Bluesky users called for his account to be terminated. Both groups are nuts. If Bluesky lives up to its promise – if it becomes an unchokeable, future-proof, decentralized social media protocol, and not merely a platform, then there's no way to kick JD Vance off Bluesky (the service). All you can do is demand that Bluesky (the server) cut off his account, whereupon he will immediately decamp to another server where he is more welcome, and still able to communicate with any Bluesky user who wants to hear from him.

Progressives should want this, because it's far more likely that Bluesky will be pressured to terminate users for failing to be insufficiently demonstrative in their anguish over the Charlie Kirk shooting than it is that Bluesky will be pressured to terminate the Vice President of the USA. But Conservatives should want this too – because if they're really worried about "deplatforming" and "Big Tech censorship," then they should be trying to create a new internet where deplatforming and Big Tech censorship are impossible – not an internet where they decide who gets deplatformed and censored.

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog: