Proof of personhood without challenge tests
A human-verification step that issues a privacy-preserving, rate-limited token via device attestation, with an in-person fallback that mints an equivalent time-limited token.
As agents defeat the challenge tests that once both blocked bots and rationed access by friction, government has to confirm a real, distinct human at the door without falling back on a method that shuts people out.
The old test fails on both sides: AI has defeated most CAPTCHA types, and the test itself excludes people with disabilities. The W3C's "Inaccessibility of CAPTCHA" working note records that "the very nature of the interactive task inherently excludes many people with disabilities, resulting in a denial of service to these users."
The condition to design for is proportionate proof of personhood: confirming a real human without an identity dragnet and without an accessibility barrier.
Government needs to confirm that a request comes from a real, distinct human without running an identity dragnet or collecting biometric data, so that bot abuse is curbed while the person keeps their pseudonymity.
Device-bound attestation excludes people without compatible devices. Government implementations must provide a non-device-dependent pathway (e.g. in-person identity verification that generates a time-limited token), and never rely on a CAPTCHA modality that denies service to people with disabilities.
A silent device-attestation check confirms human presence and issues a privacy-preserving, rate-limited token, with an explicit 'verify in person instead' route, in place of the visual CAPTCHA that denies service to people with disabilities.
No surface has been built yet; the approach above is the brief for one.
- Established Headline
For biometric approaches, though these remain contested.
- Emerging
For the cryptographic, privacy-preserving response this pattern proposes — workable today but not yet a settled government practice.
The transferable principle for government digital services is to verify human presence with a privacy-preserving, rate-limited token rather than a challenge test or a biometric registry. The rate-limited token model (Privacy Pass and related schemes) carries that principle:
- It does not require biometric data collection.
- It builds on existing device attestation infrastructure.
- It can be layered onto existing government identity systems (myGovID, GOV.UK One Login) to provide rate-limited but privacy-preserving access.
- The IETF (Internet Engineering Task Force) standardization provides an interoperable foundation.
Biometric proof-of-personhood is unlikely to be appropriate for government services in democratic jurisdictions, given regulatory hostility and the surveillance implications.
This is an access-gating pattern; the failure to avoid is an automated personhood check silently excluding people who cannot pass it. A mandatory non-device fallback is the safeguard against that exclusion.