> Banking KYC isn't about making sure people are authorized to bank, its about making sure the government is able to track them down if they are (determined by the government to be) associated with bad things.

That's simply not true. E.g a huge part of KYC is ensuring people aren't sanctioned for banking purposes (i.e. OFAC checks are mandatory).

Yes, a record of a user's identity is important, but it's still bad design that every little company, many of which have dubious security practices where they squeaked through figuring out all the right boxes to check to "pass" a SOC 2 audit, have to store this information indefinitely. Some sort of federated system where a business could delegate KYC responsibilities to a respected provider (which is exactly analogous to how Stripe-like credit card processing works) would make a lot more sense.

For porn production you need KYC. For porn consumption you need a bouncer. That the regulators miss this is either incompetence or malice and maybe both but that doesn’t make this a good idea. Real harms will come from this when the databases are breached. The kids will still be able to find porn and alcohol. To make matters worse when they grow up they will live in a surveillance state.

> Banking KYC isn't about making sure people are authorized to bank, its about making sure the government is able to track them down if they are (determined by the government to be) associated with bad things.

The problem with this is that it doesn't really work. Serious criminals use shell corporations, fake or stolen identities, hire patsies, use precious metals or physical cash, foreign banking systems, cryptocurrencies, Hawala, etc. The effectiveness of KYC rules is abysmal, to the point that we could abolish them and hardly notice any effect on crime. And yet we continue to pay all of the costs, which fall on innocent people.

> Banking KYC isn't about making sure people are authorized to bank, its about making sure the government is able to track them down if they are (determined by the government to be) associated with bad things.

Have you implemented an AML compliance program? That’s not really how it works…

That’s also a bad design. I still normally get my ID checked by a bartender or bouncer’s eyes.

If they use a scanner absolutely. That’s the only safe assumption. But at least that’s engineering incompetence instead of government overreach. Most of the times my ID gets checked the only tool used is the human eyeball.