Proof of personhood at submission

Tools that can generate and lodge submissions at unlimited volume are now widely available, so as automated submission grows, a process that weighs what it receives must be able to separate input a real person was involved in from input produced entirely by automated systems. This is distinct from identity verification (knowing who someone is): proof of personhood asks only whether a human was involved, without necessarily identifying them. What that leaves open is how a confirmation of involvement should travel with the submission to the analyst weighing it.

World ID. The system issues a proof of uniqueness from an iris scan taken on custom biometric hardware, letting a person prove membership of a verified-humans set without revealing which member they are. Uniqueness at that strength requires a centralized registry of biometric data, and enrollment on hardware most submitters will never encounter.

CAPTCHA and Privacy Pass (RFC 9578). The W3C's working note on CAPTCHA records that 'the very nature of the interactive task inherently excludes many people with disabilities, resulting in a denial of service to these users'. Privacy Pass, standardized at the IETF by Cloudflare, Apple, Google, and Fastly, issues a token attesting humanness without revealing identity. It proves humanness without an interactive task, which is the step the W3C note identifies as excluding.

US Comment Integrity and Management Act of 2024 (H.R. 7528). The bill passed the House by voice vote, then lapsed with the 118th Congress without a Senate vote, so it never became law. It would have required 'human verification to ensure that the comments are coming from a real person' on Regulations.gov and set out how mass form-letter comments must be published, rather than blocking AI-generated comments outright. One chamber of a legislature voted for human verification on its own comment channel, and for publishing form letters instead of blocking them.

NSW ePetitions and Australian House committee submissions. Signing a NSW Legislative Assembly ePetition requires identifying as a NSW resident and giving a valid email address, the House of Representatives e-petition flow enforces the House's petition rules at creation with Petitions Committee vetting before publication, and lodging a committee submission needs only a My Parliament account. The three channels require different degrees of identification, and the lightest applies to the channel that decides the least.

Medium transferability with serious access trade-offs. Proof of personhood addresses the "unlimited volume" half of the problem directly, and the Comment Integrity and Management Act provides a direct legislative analogue for Australian consultations. But the spectrum of mechanisms involves difficult trade-offs:

A tiered approach lets agencies set requirements proportionate to the stakes and vulnerability of the process. Low-stakes consultations might accept email verification; high-stakes regulatory proceedings might require verified identity. What stays undesigned is which Australian processes should sit at which tier: no legislation or platform standard yet maps a stakes level to a specific assurance floor.