Each individual proof is zero knowledge, but downloading a _bunch_ of them is an indicator, yes. There's no real way to work around this with the current ZKP scheme. I'd argue ZKP is, in theory, the least worse option of all current age verification scheme.
My personal opinion is that age verification itself is a bad idea, but if we're going to go ahead with it, I'd much rather we use ZKP for it than the current mess of "upload your passport and picture of yourself to dodgy 3rd parties that likely now have your browsing traffic associated with your real name"...
Not necessarily, but it would be difficult to justify why you need to access 1000 porn sites every day, I guess?
The point is that if you build a service that sells age verification tokens, you are doing something illegal. And if you start doing something illegal by gathering said tokens with your own identity, maybe it's not the most clever way to do something illegal?
So the government would limit me to accessing only 999 porn sites a day?
Is it going to be like structuring law, where it's illegal to access 1000 or more but it's also illegal to avoid accessing 1000 or more by accessing a lower number?
The government won't limit you - they can't really know what you use those proofs for anyways, that's the zero knowledge part, and supposedly they'll be necessary for social media at some point, so a ZK proof won't necessarily mean porn use. The only thing the govt knows is how many proofs are being downloaded. And you can bet politicians wouldn't do anything to prevent voting-age you from accessing social media - how else are they supposed to get you to vote for them (or hate their opponents).
Now, a scenario I can see happening is, the ZKP-issuing agency may find a single client downloading several orders of magnitude more proofs than the average citizen, find that suspicious, refer them to the police, who'd get a warrant to investigate said person. Then, the police may manage to connect said person with a proof distribution service. Something along those lines.
Again, I'm personally not a huge fan of the whole age gating, but if we're going to go about it, this is the least worse option. Which is really saying something.
Of course they are. The whole point of ZKP is that whoever gives you the token cannot link it to your identity. So you can get a token with your own identity and sell it to someone else, and nobody will know...
... unless you get thousands of tokens every day and sell them on a website, where suddenly you start leaking information about yourself everywhere. ZKP still did its job: it's not the tokens that link to your identity, it's your behaviour.
My personal opinion is that age verification itself is a bad idea, but if we're going to go ahead with it, I'd much rather we use ZKP for it than the current mess of "upload your passport and picture of yourself to dodgy 3rd parties that likely now have your browsing traffic associated with your real name"...