> I think the implementors of this law either knew about these issues or are hopelessly naive.

Or they decided that, on balance, there is still a net benefit to this starting point.

Doing nothing is not an option - the unregulated Internet is a cesspool. We've allowed children unregulated access to this for a couple of decades now. The argument that we cannot regulate this to protect kids, so we should just accept the damage it is doing is not acceptable any more.

Yes, effective regulation takes time to formulate. But you have to start somewhere and improve the situation.

Your comment has two separate messages that, despite not technically contradicting one another, don't really relate to each other in any way.

1. The current status quo has been the default that's been in place for 20-30 years now

2. Despite this, the situation is so dire right now (did something new happen recently? Worldwide?) that we must do something about it now now now - even if that oversteps and takes away rights, even if it sells off your most private data to random third parties, even if it establishes a framework for broader censorship, doing something NOW is so important that it must trample all other concerns

My whole generation grew up on unrestricted internet, and while I agree that it's not the ideal situation, the experience I and everyone else I know had over these decades suggests that it's not the apocalyptic catastrophe that everyone pretends it to be. Something should be done, but it must be done carefully and in moderation as to avoid censoring and limiting adults in an attempt to make the entire internet child-first.

Instead, what we're seeing is half of the first world suddenly remembering about this after 20 years and steamrolling ahead in complete lockstep. Does this not worry you in any way? And look at what each one is proposing. Why are there no middle-ground privacy-first proposals anywhere? For some reason, those are confined to research papers and HN posts, not policy. Even without thinking of complicated cryptography and tokens and whatnot, think of this: what if ISPs were legally mandated to ship their routers in "child-censored mode" to everyone but businesses and households with no children? They would filter out all the websites that Ofcom or whatever other agency decides are inappropriate for children, but the router owner/operator could go in the settings and authorize individual devices for full internet access.

But that would place the burden of filtering appropriate content on the government, rather than every website in the world - and it wouldn't allow them to extract money via lawsuits and fines. More importantly, it also doesn't allow them to do favors and subcontract benevolent third-party businesses to store and process every user's identity in association with what they visit. I'm betting it's because of those reasons that any privacy-friendly approaches are a complete non-starter.