Proving a human without knowing who they are

A very large class of problems needs to know two things: that a participant is a person, and that one person is not fifty accounts. Almost none of them need a name. Systems ask for the name anyway, because identity is the only tool most of them have, and the bill for that reflex is paid in data breaches and in excluded people.

What is this problem area?

Start with a review section, because it is the simplest version and every property of the harder cases is already present.

A review is only worth reading if it came from a person, and only worth counting if that person wrote one rather than fifty. Those are the two requirements. A platform that satisfies both has a working reputation system. A platform that satisfies neither has a marketplace for fiction, and generative text made writing plausible, specific, well argued fiction free.

Now notice what is not on the requirements list. Nowhere does a functioning review system need to know the reviewer's legal name, address, date of birth or government identifier. It needs a person, once. That is all.

Hold that observation and apply it outward, because the same shape is everywhere. A survey panel needs one response per person, not a roster of respondents. A free tier needs one trial per human, not a customer file. A restaurant needs one booking per diner. A public consultation needs assurance that a submission attributed to a person came from that person, while protecting the right to submit anonymously. A clinical trial needs to know a volunteer is not already enrolled elsewhere, and would be actively harmed by building a national registry of who participates in medical research.

Every one of these is answered today by either collecting identity, which creates a liability and excludes people, or by guessing, which loses. The third option is the subject of this pillar.

Humanity, uniqueness and identity are three different things

This is the distinction the whole area rests on, so it is worth taking slowly. The three properties get collapsed constantly, including by people who build these systems for a living, and almost every bad design in the category comes from reaching for the third when you needed the first two.

Humanity: is there a person here at all?

The weakest useful claim. It distinguishes a person from a script, a model, or an automated pipeline. It says nothing about which person. Two people who both prove humanity are indistinguishable to the verifier, which is exactly right for a great many purposes. A comment section that knows its commenters are people has solved most of its automated manipulation problem without learning a single thing about anyone.

Uniqueness: is this person distinct from that person?

A stronger claim, and the one most systems actually need. It lets a verifier say that two accounts belong to different people, or that a person has already claimed the thing on offer, without knowing who either of them is. This is the property that makes one review per human, one free trial per human, and one enrolment per volunteer possible.

Uniqueness has a subtlety that matters enormously and is usually missed. It must be scoped. A uniqueness key that is the same everywhere is a tracking identifier, and building one would be the single most privacy hostile thing in this entire body of work. A properly scoped key is derived per context, so a person is provably unique within a platform or within a study and completely unlinkable across them. Same human, different key, no correlation possible.

Identity: which specific named person is this?

The strongest claim, and the one that carries all the cost. Identity requires an authoritative source, usually a state. It creates a record that can be breached, subpoenaed, sold in an acquisition or repurposed. It excludes anyone without documents. And it is genuinely necessary for a narrow set of things: opening a bank account, receiving a regulated payment, entering a country.

The mistake is not using identity. The mistake is using identity for problems that only needed the first two properties, which is most of them.

The analogy, then the mechanism

Think about a public meeting in a town hall. The chair needs to know that the people voting are people, and that nobody votes twice. The traditional mechanism is a door and a hand stamp: you come in through one entrance, someone marks your hand, and the mark is checked at the vote. Nobody records your name. Nobody keeps a register of who attended. The stamp establishes humanity and uniqueness for that room, on that evening, and it means nothing at the meeting next door.

What follows is the hand stamp, built properly. At enrolment, a face match is computed on the device and reduced to a one way key. Nothing reversible leaves the phone; no template is uploaded or stored anywhere. For a given context, the device derives a scoped value from that key plus a context salt, and signs an assertion.

{
  "type": "unique.assert",
  "context": "reviews.example.com/product/8812",  // scope: this platform, this subject
  "scoped_key": "b7d1...4e",   // derived from the on-device key + context salt
                               // stable within this context, unlinkable across contexts
  "human": true,               // liveness satisfied on device
  "issued_at": "2026-10-02T11:04:07Z",
  "sig": "3045...9a"
}

The verifier stores scoped_key and nothing else. If the same value arrives again, it is the same person and the second review is refused. If a different value arrives, it is a different person. At no point does the platform learn a name, hold an image, or gain anything it could correlate against another platform's records. There is no vault, because there is nothing to put in one.

Two honest notes on the mechanism. Cryptographic selective disclosure and zero knowledge nullifier constructions would make the unlinkability guarantee stronger and are roadmap at Manav rather than shipped; the shipped path is the on device match, the one way key and the signed assertion described above. And this is deliberately not what the industry calls proof of personhood, which generally means a one time global uniqueness credential backed by a central biometric registry. The distinction is the registry.

The map: where this applies, and what covers it

Why do systems reach for identity when they do not need it?

Not because anyone is careless. Because for thirty years the toolbox contained exactly two instruments, and neither of them was the right size.

The first instrument is detection: score the traffic, fingerprint the device, analyse the behaviour, and guess whether this is a person. It is cheap, it requires nothing of the honest user, and it is losing. It is losing structurally rather than through poor execution, because the generator improves faster than the classifier and the attacker gets unlimited attempts with feedback. Even the vendors say so; hCaptcha's own public material has acknowledged that traditional device fingerprints are becoming unreliable as browsers restrict them and attackers emulate them. We collected those admissions in detection debt.

The second instrument is identity: demand a document. It works, and it brings consequences that are usually larger than the problem it was deployed against. It creates a data liability at the exact moment you were trying to reduce risk. It excludes people without documents, which is disproportionately the people such systems most affect. And it produces the recurring spectacle of a platform holding a folder of passport images because it wanted to know whether someone was over eighteen.

There was no middle instrument. The whole argument of this pillar is that there now is one, and that most of the problems in the table above were always middle instrument problems wearing an identity costume.

Where does fake participation actually get paid?

The bot economy is not undifferentiated noise. It concentrates precisely where a fake participant converts into money, and the useful move is to find those events rather than to grade the whole internet.

Advertising, and the honest problem with the numbers

Estimates of advertising fraud diverge so wildly that the divergence is the story. Anura's 2026 executive brief put losses at roughly 165 billion dollars for 2025 with invalid traffic rates it placed in the twenties of percent; Spider AF's analysis of billions of paid clicks reported a global fraud rate around 5.6 percent for the first half of 2026. Both are vendor telemetry, both define the thing differently, and they cannot all be right. That is not a reason to dismiss the category; it is a reason to be exact about what you can actually prove, which is the argument of you are paying for attention that nobody paid.

The scoping discipline matters here more than anywhere. Nobody can prove humanity for an ad impression, and any vendor claiming otherwise is selling something. What can be proved is the paid event: the conversion, the signup, the lead form, the trial start. Those are moments where a person is present anyway and a proof is proportionate.

Royalties, where the loss falls on other artists

Streaming is the cleanest illustration of why this class of fraud is different from ad fraud. Deezer announced in January 2026 that it was demonetising fully AI generated music streams after concluding that a large majority of streams on such tracks were fraudulent, and reported detecting more than thirteen million AI generated tracks during 2025. The crucial nuance, which most coverage missed, is that these tracks are a small share of listening and a large share of fraud. Because royalties are paid from a pool divided by play counts, a fraudulent play does not merely earn money, it takes money from every legitimate artist in the pool. The loss lands on musicians, not on an advertiser. That analysis is nobody listened, and the royalties were paid anyway.

Free tiers, where the defender pays per request

Inference pricing turned every free tier into a subsidised compute faucet, and turned abuse into a direct cash cost rather than a bandwidth cost. Rate limits protect availability and do nothing about spend, which is why the community named the extreme version denial of wallet. The founder's dilemma is genuine: a free tier exists to remove friction from acquisition, and every anti abuse control applies friction to exactly the moment you were trying to make effortless. We work the unit economics in your free tier is a payment terminal for someone else, and the sibling problem of welcome offers and referral credits in one human, one welcome offer.

Reputation, where the asset is the account itself

Marketplaces have a particular version of this. Reputation is non transferable by policy, which makes an aged account with good history a valuable grey market asset, and makes takeover attractive because the account's history does the persuading. Every signal a careful buyer is told to check is exactly what the attacker acquired. Binding reputation to a human rather than to an account removes the asset's value rather than policing its sale, which is the elegant part of the seller changed last week. Loyalty balances have the same shape, protected by consumer grade authentication because they are filed under marketing rather than treasury, covered in points are money that nobody guards like money.

What happens when the data itself is the product?

There is a category here that deserves separating out, because the harm is not financial in the ordinary sense. It is epistemic.

Survey panels, research studies and preference datasets all rest on an assumption that a response came from a person. Industry estimates of fraudulent or low quality responses range from roughly fifteen to forty percent depending on methodology, and the spread itself is evidence that nobody can measure this well. Every one of those figures is a detector's catch rate, which makes it a floor rather than a measurement. The economics are unanswerable: a survey pays a few dollars for a few minutes, and a model produces a plausible, internally consistent, attention check passing response for a fraction of a cent. Worse, open ended answers used to be the reliable tell and are now the easiest thing to fake, so the best quality signal became the weakest. That is a third of your survey responses may not be from people.

The version that should worry AI laboratories most is preference data. If the feedback that defines helpful was generated by a model, an alignment programme is not aligning to human values, it is aligning to a previous model's approximation of them, and the error compounds silently because the data looks perfect. We make that argument carefully, including its hard limit, in the human feedback training your model may not be human.

Scholarly review is the same failure in an institution built entirely on trust. Nature reported analysis finding that around a fifth of manuscript reviews submitted to a major AI conference appeared to be AI generated. Detection is a particularly bad fit here, because a false accusation against a named academic is career damaging and detectors have documented problems with non native English writers. The resolution, which preserves blind review, is in twenty one percent of the reviews.

Scarce things, allocated to whoever scripts fastest

Any free allocation of a scarce good gets arbitraged the moment automation costs less than the slot is worth. Reservations, appointments, tickets and queue positions are the same problem with different amounts of money attached.

New York legislated on the restaurant version, restricting third party platforms from listing or selling reservations without a written agreement with the restaurant. The reason restaurants care is not obvious from outside: a reservation is a promise in both directions, the restaurant staffs and buys food against it, and a scalped booking that no shows costs a table plus the prep, with the resale money going elsewhere. That is the table was gone in four seconds, and the higher stakes ticketing version is the Bot Tax.

The version that matters most is the one with the least money in it. In March 2025 the United States Embassy in India announced it was cancelling approximately two thousand visa appointments booked by bots in violation of scheduling policies. A visa appointment can determine whether someone starts a degree, takes a job, or reaches a dying relative, and the same pattern affects driving licence offices, passport services and public healthcare scheduling. An automated arbitrage on a free public good is a regressive tax, falling hardest on applicants who cannot pay an agent. That is the visa appointment was free.

Public systems, where both failure directions hurt

Government and civic systems are where this area gets genuinely hard, because tightening and loosening both cause serious harm to real people.

Financial aid is the sharpest case. California's Community Colleges Chancellor's Office tracked roughly ten million dollars in federal and three million in state financial aid fraud between March 2024 and March 2025, and the Department of Education has described preventing aid fraud on the order of a billion dollars by the end of 2025 while introducing identity verification for first time applicants. The collateral damage is what makes it more than a money story: real students cannot get seats in filled classes, and faculty spend the first weeks of term deleting phantom rosters. But any identity requirement risks excluding the students least able to comply, which is bots are standing in the financial aid line. The same tension, with a larger population, runs through the identity check happens once, the money moves every week.

Age assurance is where the politics are loudest. Ofcom's first statutory report on age assurance under the Online Safety Act described tens of millions of age checks across a sample of regulated services in the second half of 2025, and the immediate public response included a sharp rise in circumvention. The reason users evade is not that they object to being over eighteen. It is that the check converts a yes or no question into a permanent data liability held by a company they have no relationship with. The alternative, an attribute proof that reveals a predicate rather than an identity, is how do you verify age without collecting an ID. The children's services version, where an operator ends up holding a parent's payment card in order to protect a child's privacy, is prove you are the parent, and the observation that age is the one attribute guaranteed to change is age is not a gate, it is a moving number.

Then there is democratic infrastructure, where the constitutional weight is real and the temptation to over engineer must be resisted. In the 2017 net neutrality proceeding the Federal Communications Commission received about twenty two million comments, and subsequent investigation including by the New York Attorney General found that a very large share were fabricated, with millions submitted under the names of real people without their knowledge. Notice and comment rulemaking is a legal process, so docket integrity has legal consequences. But the right to petition government is constitutionally protected and anonymous political speech has strong protection, so weighting rather than blocking is the constitutionally safer design, argued in twenty two million comments. Ballot petitions have the mirror problem, where signature matching is simultaneously vulnerable to fabrication and prone to wrongly rejecting genuine signatures, in direct democracy runs on signatures nobody can check at scale.

Medical research supplies the clearest argument for uniqueness over identity. A volunteer enrolled in two trials at once faces genuine interaction risk, so sponsors need duplicate detection. They achieve it today through shared registries that require sites to submit personal details to a third party. A national registry of who participates in medical research would be a dangerous artifact, and uniqueness without identity avoids building one, which is the same volunteer, three trials, two identities.

Why pseudonymity is a requirement, not an obstacle

Any design in this area that requires identity has failed before it starts, and this section exists because that claim needs defending rather than asserting.

Consider who depends on pseudonymity online. People discussing a health diagnosis they have not told their family about. Employees of oppressive employers. Survivors of abuse who are hiding from someone specific. LGBTQ people in jurisdictions where being identified carries physical danger. Dissidents and the journalists who talk to them. Ordinary people who simply do not want a permanent, searchable, name attached to an opinion.

Every real name policy in the history of the internet has harmed those groups while doing remarkably little for civility, because the people willing to be abusive under their own name turn out to be numerous. A comment section that requires identity has not raised its quality; it has changed who is allowed to speak. That is why can a comment section prove its commenters are human without knowing who they are answers its own title with a design that never collects a name, and why the profile is charming, attentive, and not a person insists that mandatory identity on dating platforms would endanger the users most at risk.

The design consequence is concrete. Uniqueness keys must be scoped per context so they cannot be correlated. Nothing reversible may be stored. The verifier must learn a boolean and a scoped opaque value, and nothing else. If a system in this category can be turned into a cross platform identity graph by an internal decision, it was built wrong, and that includes ours.

Why exclusion is the failure mode that gets ignored

The second objection is quieter and more damaging, because the people it affects are the least able to complain about it.

Any design that assumes a recent smartphone, a stable data connection, a private space to complete a check, and the literacy to follow it, excludes exactly the populations that public systems most affect. Benefits claimants without a fixed address. Students on a shared family device. Home care workers with a cracked phone and thirty seconds between visits. Visa applicants in an internet cafe on a slow connection. Refugees with no documents at all, for whom the check that establishes uniqueness may be the only feasible route to being recognised, covered in the emergency setting in you verified them in Berlin, now prove it in Singapore.

So the standard is not that a fallback exists. The standard is that the fallback is a normal path. A staffed route, treated as routine rather than as an exception queue, with the same outcome and no penalty for using it. A system that stops fraudsters and also stops eligible people has not succeeded with an unfortunate side effect. It has failed, and it has failed the people with the least ability to do anything about it.

Both objections lead to the same architectural conclusion, which is the one we would defend hardest: this class of verification must retain as close to nothing as possible. Not because retention is unfashionable, but because a system holding nothing cannot be breached, cannot be repurposed, cannot be subpoenaed for something it was not built for, and cannot quietly become an identity requirement once the product manager changes.

What does this class of verification not solve?

The ceiling here is low and specific, and every post in this cluster states it.

It does not stop a real human doing the wrong thing. A person paid to write a dishonest review has produced a genuine proof of a genuine human writing a genuine review. The claim being verified is true; the content is still a lie. This class of control addresses volume, not sincerity, and the remedy for paid authentic content is disclosure enforcement rather than cryptography.

It does not verify authorship. A person who pastes model output into a survey, a review or a peer review has still signed it. The proof establishes human presence and accountability, not human origination of the text. Closing that gap requires task design, not identity technology, and anyone claiming otherwise has not thought about it.

It can be defeated at scale by paying people. Click farms and content farms staffed by real humans already exist. What changes is the unit cost: a fake participant stops costing a fraction of a cent and starts costing a person's time, which removes the free tier of manipulation and makes most abuse businesses unattractive. That is a real effect and it is not the same as prevention.

A verified human badge can create false confidence. If users read a marker as an endorsement rather than a statement about uniqueness, the marker has made them more credulous, which is a genuine harm. Any user facing signal must say precisely what it means, and platforms should expect to be judged on how well they resist inflating it.

It risks becoming a two tier internet. If verified participation is privileged enough, the unverified are effectively excluded, and the check has become an identity requirement by other means. This is the most serious structural objection in the area and we do not consider it resolved. It argues for weighting rather than gating, for anonymous paths remaining first class, and for scepticism toward any deployment that makes the proof mandatory.

Uniqueness is only as good as enrolment. A person with two devices and two enrolments defeats naive designs, which is why liveness at enrolment matters and why the guarantee is probabilistic at the margin rather than absolute.

These limits are why this sits in the Identity Failure Map as Personhood Without a Vault: a named gap with a bounded remedy, rather than a claim to have solved online abuse.

Where do the standards sit?

Bot defence standards and services including CAPTCHA derivatives and edge challenge systems are the incumbents, and they are genuinely useful for cheap triage of unsophisticated volume. They are probabilistic by construction and their own vendors have documented the erosion of the signals they depend on.

W3C Verifiable Credentials and SD-JWT provide formats for issuer signed claims with selective disclosure, which is the natural carrier for an attribute proof such as an age predicate. They are the serious prior art in this space and Manav should be read as interoperating with them rather than competing.

ISO/IEC 18013-5 for mobile driving licences includes an offline presentation model that gets the privacy properties substantially right for the credentials it covers, and eIDAS 2.0 and the European Digital Identity Wallet are moving a whole jurisdiction toward holder mediated presentation.

Zero knowledge nullifier constructions are the academic answer to scoped uniqueness and are the direction of travel. At Manav they are roadmap rather than shipped, and this pillar has been explicit about which parts are which.

The gap none of these fill is governance rather than format: verifiers must decide whose assertions they accept, and that is a trust registry problem wearing a technical costume, which is the argument of trust across borders.

Reading paths

If you run platform trust and safety

Start with detection debt to see why the current toolkit is losing, then one human, one review for the cleanest worked example, then verified human comments for the pseudonymity constraints, then one human, many accounts for the deduplication and false merge problem, and finish with seller takeover.

If you own growth, payments or platform economics

Read denial of wallet and one human, one offer for the unit economics, then verified human conversions for what is and is not provable in the funnel, then loyalty points and reservation bots for the scarce allocation pattern.

If you are a researcher or work at an AI laboratory

Begin with human feedback integrity, then survey panel fraud for the measurement problem underneath it, then AI peer review for the institutional version, then duplicate trial subjects for uniqueness done without a registry.

If you write policy or regulate

Read age verification without ID first, then public comment integrity and petition signature integrity for the civil liberties constraints, then ghost students and benefits identity fraud for the exclusion tradeoff at scale, and proof without surveillance for the line between the two approaches.

Frequently asked questions

How can you prove someone is human without knowing who they are? By separating the claims. A device performs a liveness check and an on device face match, then derives a one way key that cannot be reversed into an image, and signs an assertion scoped to one context. The verifier learns that a live person is present and receives an opaque value that is stable within that context. It never receives a name, an image or anything correlatable elsewhere.

Is this the same as proof of personhood? No, and the difference is the registry. Systems marketed under that name generally issue a one time global uniqueness credential backed by a central biometric database, which creates exactly the vault this approach avoids. Scoped uniqueness produces different unlinkable values per context and stores no template anywhere, so there is no central artifact to protect, breach or repurpose.

Why not just use CAPTCHA or bot detection? Because they are probabilistic and the probability is moving the wrong way. Detection scores traffic the adversary controls and shapes, so it improves only as fast as the attacker allows. It remains useful for cheap triage of unsophisticated volume, and it is the wrong last line of defence for an event that pays out money.

Does this require a smartphone? The primary path does, which is a genuine limit rather than a footnote. Any deployment in a public service or a low income context must offer a staffed route treated as a normal path with the same outcome. A design that reaches only people with recent devices excludes the populations these systems most affect.

Can someone create multiple accounts anyway? With two devices and two separate enrolments, a determined person can defeat naive designs, which is why liveness at enrolment matters. The realistic claim is economic rather than absolute: multi accounting stops being free and starts costing time per identity, which removes the business model behind most abuse at scale.

Does a verified human marker mean the content is trustworthy? No, and platforms should be careful not to imply it. It means a live, unique person produced this, once. A real person can still lie, be paid, or be mistaken. Treating the marker as an endorsement rather than a statement about uniqueness makes users more credulous, which is a harm the platform has introduced.

What stops this becoming a tracking identifier? Scoping, and it has to be enforced in the construction rather than in a policy. Keys are derived per context so the same human presents unlinkable values to different verifiers. A single global identifier would be the most privacy hostile thing in this area, and any implementation that could be switched into one by an internal decision is built wrong.

Where does this leave anonymous speech? Intact, and that is the design requirement rather than a concession. Humanity and uniqueness can be established without identity, so anonymous and pseudonymous participation continues while automated manipulation gets expensive. Weighting submissions is constitutionally and ethically safer than blocking them, particularly in civic systems.

Sources

1. Deezer newsroom, announcement on demonetising AI generated music streams and detection figures, January 2026: newsroom-deezer.com
2. Ofcom, statutory report on age assurance under the Online Safety Act: ofcom.org.uk
3. Federal Trade Commission, rule on fake reviews and testimonials, and COPPA rulemaking materials: ftc.gov
4. Federal Communications Commission, Electronic Comment Filing System and the 2017 open internet docket: fcc.gov/ecfs
5. Office of the New York State Attorney General, investigation into fabricated public comments: ag.ny.gov
6. California Community Colleges Chancellor's Office, financial aid fraud reporting: cccco.edu
7. United States Department of Education, Federal Student Aid identity verification announcements: studentaid.gov
8. United States Mission to India, consular announcements on appointment scheduling policy, March 2025: in.usembassy.gov
9. Nature, reporting on AI generated peer reviews at a major machine learning conference: nature.com
10. Anura and Spider AF, published advertising fraud estimates, cited as vendor telemetry with differing methodologies: anura.io and spideraf.com
11. World Wide Web Consortium, Verifiable Credentials Data Model: w3.org/TR/vc-data-model-2.0
12. International Organization for Standardization, ISO/IEC 18013-5 mobile driving licence: iso.org

Most systems asking who you are only ever needed to know that you were a person, and that you had not already been here.