CHAT CONTROL IV. – From Burning Books to Blocking Readers - WE ARE HERE

Geoblocking already allows governments and companies to decide what people may access according to where they live - or what country their phone number/credit card is linked to, but location is only the first layer of control.

A VPN can bypass this, which is why location-based restrictions alone have never provided governments with reliable control over individual users.

Identity and device-level verification change that.

From Blocking Books to Identifying Readers

Traditional censorship focused mainly on controlling the information itself.

A government could prohibit a book, close a newspaper, seize a printing press or block a website. Digital identity systems allow a more precise form of control because the material does not need to be removed for everyone.

The publication may remain online while access is restricted.

This approach is also less visible than traditional censorship because people may not know that other users are seeing something different.

We Are Already Here

This is not merely a possible future development.

X already associates every account with a country, states that this classification may affect which content the user can see, and uses IP addresses, GPS data, wireless networks and nearby cell towers to determine location.

It can withhold individual posts or entire accounts in one country while leaving them visible elsewhere, which means two users opening the same platform already receive different versions of political and public discussion.

X also applies age assurance using information it already holds, including previously supplied dates of birth, email addresses and telephone numbers. When those signals are considered insufficient, the user may be required to provide a live facial image or government-issued identification, and access to sensitive material may remain blocked until the platform is satisfied.

The same principle appears across social media, video platforms, games and application stores.

Even where the most aggressive client-side scanning proposals in the CSA Regulation have met resistance, the supporting infrastructure for age and identity signaling continues to advance through other channels.

The Digital Services Act already obliges platforms to take measures protecting minors, and the European Commission is actively promoting an EU-wide age verification framework built on the emerging European Digital Identity Wallet, with member states encouraged to have solutions available by the end of 2026.

Several countries have introduced or are introducing requirements for robust (non-self-declared) age checks on specific categories of content. The debate over message scanning can stall or be watered down; the creation of standardized, machine-readable identity and age signals does not.

The Identity Layer Already Exists

Governments do not need to build this infrastructure from nothing because the major technology companies have already normalised the use of persistent accounts throughout computing.

Apple connects its Apple Account to the App Store, iCloud and other services, and creating the account involves providing information such as an email address, date of birth, country or region and, a telephone number.

Google requires a Google Account to download and purchase items through the Google Play Store, while account recovery may connect that identity to additional email addresses or telephone numbers.

Huawei uses a Huawei ID to access services including AppGallery and Huawei Cloud, although its devices generally remain more open to installing applications from other sources than Apple’s tightly controlled mobile ecosystem.

Microsoft has spent years pushing users toward Microsoft accounts that connect Windows with Outlook, Office, OneDrive, Skype and Xbox. Local Windows accounts still exist, but their functions are heavily restricted.

Adobe requires users to sign in to an Adobe account to activate current applications, meaning that even software installed locally on a privately owned computer may depend on continuing approval from a remote account and licensing service.

These accounts are not automatically the same as government-issued identification, but they establish a persistent identity inside the technology ecosystem, and that identity can gradually be connected to a real ID (and already is, through payment data).

The Operating System Becomes the Checkpoint

The most important development is the attempt to move age and identity verification into the operating system itself.

California’s Digital Age Assurance Act, which is due to take effect in 2027, requires operating-system providers to request a birth date or age during account setup and to provide applications with a real-time signal indicating user's age bracket.

The law says that only the minimum necessary information should be supplied, but it still establishes the operating system as the main authority.

A person who refuses to supply the information may be placed into the youngest or most restricted category. A person whose device cannot produce the expected signal may lose features or access entirely.

Mobile operating systems already provide applications with identifiers. Android offers a unique, resettable advertising ID, while Apple provides identifiers for advertising and identifiers that distinguish a device to applications from the same vendor.

Websites can construct a browser fingerprint by combining the browser and operating-system version, language, timezone, installed fonts, available codecs, screen resolution, browser settings and other technical characteristics.

Mozilla notes that this combination can often identify a particular browser and track it across the web, even without a conventional login or tracking cookie.

A user is recognisable before providing a name.

Using Technology Requires Permission

Apple, Google, Microsoft, Huawei, Adobe and others have already trained users to accept that privately purchased technology may require a continuing relationship with the manufacturer or software provider.

This means ownership is increasingly being replaced by conditional permission.

A person may own the phone, computer or software licence while still being unable to use important functions.

The Problem for Linux

Linux exposes how artificial this entire model is because a Linux computer does not normally need a central provider identity.

This makes laws written for centralised platforms extremely difficult to apply.

System76, the company behind Pop!_OS, has warned that services may simply apply the most restrictive settings when a Linux system does not provide an approved age signal.

Linux does not have to be outlawed, websites and applications can simply refuse to trust it.

Privacy Can Already Cost Access

Systems designed to reduce identification are already treated as suspicious by parts of the internet.

Privacy-focused Linux systems route connections through Tor, where many users share the same exit addresses. Cloudflare itself acknowledges that VPN and Tor connections tend to have poorer IP reputations, while Mozilla warns that stronger anti-fingerprinting settings can cause websites to malfunction or become unusable.

This means that refusing to expose a normal device profile can itself become a reason for exclusion. The user is not blocked because she committed an offence, but because her system does not provide the ordinary identifying signals that the service expects.

Fazit

Once identity is built into the operating system, the internet then stops being a network that people can enter with a computer and a connection.

It becomes a collection of services that people may use only when their account, device and identity have been approved.