A quick one because it’s Sunday and I’d rather be thinking about Scotland winning the World Cup. This morning someone alerted me to completely predictable news about Yoti, the age verification provider which has quietly driven the shape of so much internet regulation in its commercial interests, whilst embedding itself so deeply into national, regional, and local government that you need to verify your identity through them just to request a replacement recycling bin from the council (as I’ve had to do).
It turns out that Yoti are now reporting GrapheneOS users who have PlayStation accounts to “authorities” merely for having the OS. I do not know where (as in what country) this incident happened, but it most definitely happened.
‼️🚨 BREAKING: Sony PlayStation’s age-verification partner Yoti is reporting GrapheneOS users to authorities for using GrapheneOS, due to “past security concerns.”
— International Cyber Digest (@intcyberdigest.bsky.social) 6 June 2026 at 22:35
I mean, what have I been warning you would happen for the past seven years?
As for why Yoti believes that full device scanning is a necessary and proportionate part of age verification checks, what “authorities” Yoti is reporting users to, what grounds of criminality Yoti is referring users to those authorities for, what legal authority Yoti believes it possesses in the first place to make potentially life-changing judgements based on a user’s OS, or who allowed Yoti to essentially become a state entity as per this issue and also my recycling bin, are any of those questions even the point?
No, they are not; the point is that age verification providers now hold themselves to be delegated law enforcement and extensions of the judiciary, using the guise of age verification for child safety but for reasons which have nothing to do with it.
The details of those referrals, the risks associated with false and malicious accusations, or the capacity of $authorities to process bulk referrals with no indicator of criminality, are I suppose someone else’s problem to figure out.
In the ensuing discussion about this on the decidedly-less-toxic socials, I suggested a term for this variety of safety tech application: grassware.
The definition clearly needs work. One BlueSky user suggested “an ontology of types of Grassware that includes SnitchTech and StasAI”. This is the right direction. SnitchTech would refer to tools of mass reportage to $authorities on objective grounds, with just cause and some form of due process, as instruments (however dubious) of the rule of law. StasAI would refer to tools of mass reportage to $authorities, on subjective grounds without just cause or due process, as instruments of jawboning and the rule of fear.
The problem is that in 2026, the line between the two is paper thin.
To be clear, grassware has existed in openly authoritarian societies for many years; think of the automated filtering and censorship systems in tightly controlled national splinternets. These are systems where it is not hyperbole to say that using the wrong technology can get you killed.
(Which is why the privilege of having dissidents’ backs in Parliament remains the best day I’ve had so far this year.)
The differences with grassware, however, are twofold: one, grassware is being bolted onto existing services and user accounts, as a retrospective control on user behavior, in societies which still claim this is about child and public safety even as we slip further into a mass surveillance dystopia by the week; and two, grassware is being developed by the private sector for profit (often with enthusiastic government support) and then bolted onto to other private services, as opposed to being developed in-house by authoritarian governments for their own splinternets.
After all, who needs authoritarianism when neoliberalism gets you to the same destination?
The last thing to say here, and I’m just stating facts and not making any sort of threat but there really is no nice way to say this: I’m writing this from a part of the world where grasses get shot. Seriously. Grassing is tolerated in some countries, cultures, and contexts. In other places, it will get you emergency leg surgery or a permanent leisure cruise in a very cold body of water. Governments and service providers who think that grassware – and automated systems of grassing – will be welcomed, much less tolerated, as a form of cultural, technical, and political control from the centre of power may quickly find that their centre is all they have left.
On the topic of your last paragraph I would love to see people fight back negativity to this to the point of change (if that’s not what you were implying then I apologise for inferring) but I don’t see this becoming a bigger thing and people will just move on. Very happy to be wrong and I often am.