As we begin the second century in which society has imposed age restrictions to protect children from harm – it was in 1923 that the UK Parliament passed the “Intoxicating Liquor (Sale to Persons under Eighteen) Act” – the AVPA predicts 2024 will be the year we, finally, substantively extend those protections from the real world to the virtual world. Indeed, we will look back on recent years with horror when we realise just how much risk we put our children at when they went online in the first quarter of the 21st century.
So how do we, as the global trade body for suppliers of age verification and age estimation solutions, expect to see this play out over the coming year?
Creating international Standards
We ended 2023 by securing a positive vote to approve a new international standard for Age Assurance. IEEE P2089.1 describes a best practice process for implementing age assurance which can be used by both online services and age verification providers. Digital services will increasingly need to be able to mount a defence in court that they carried out effective age checks, and, given most of the new laws requiring those checks rightly prohibit the retention of personal data after a check is complete, platforms can only do so by producing evidence that the system they use for age assurance is robust.
In April, the first Global Age Assurance Standards Summit in Manchester, England, will host ISO’s Working Group 27, Standing Committee 5, which is working on a new suite of standards for age assurance. The framework document and Part 2 which will set standard benchmarks for the effectiveness of age assurance systems, will hopefully reach Committee Draft stage during this event. Part 3, on interoperability to allow for the re-use of age checks across platforms and websites, will also be developed as a Working Draft.
These innovative standards will simplify the work of lawmakers, regulators, online services and suppliers by giving clarity around the level of accuracy and reliability required when an age check is completed.
Driving global Legislation
If 2023 was characterised by law-making, 2024 will see major steps towards enforcement. In the UK, the new Internet regulator, Ofcom, is already consulting on detailed rules and guidance for the Online Safety Act. Ofcom’s implementation roadmap has resisted any sense of urgency, and the organization is still catching up with enforcing rules for Video Sharing Platforms that came into force over three years ago.
So it may be that the EU sets the pace. Just before Christmas, the Commission corrected an obvious omission by adding three large adult sites – Pornhub, Stripjoint and xVideos – to the list of Very Large Online Platforms. This is significant, not because of any additional requirements placed on those sites to verify the age of their users, as they would have faced these from February with all other services in any case, but rather that they will now be directly regulated by the Commission itself. They can no longer hide behind the protection of the Cyprus Radio and Television Authority’s masterful inactivity in implementing the Audio-Visual Media Services Directive. As “X” has already found out, Brussels is going to be setting a strong example of speedy enforcement action.
In the USA, initial attempts to legislate for age assurance ran into some difficulty in federal courts. Where we gave evidence, judges never criticised the efficacy or privacy protections in our members’ technology. But broadly drawn legislation was stayed on First Amendment grounds in some states – although not in others. Notably in Texas, at the 5th Circuit Court of Appeal, age verification was sustained, and only a Supreme Court intervention can change that now.
We know there are more, better written, state Bills being prepared for legislative sessions early in this new year. But the widespread, bipartisan support for these laws has not gone unnoticed in Washington, and several Senators and Representatives are actively promoting federal legislation, learning the constitutional lessons from judgements handed down on state laws which provide a neat how-to guide to re-drafting them within the limits of the Constitution. The existing COPPA law is also being beefed up by the Federal Trade Commission, with many more sites potentially in scope as “directed at children.”
Senator Julie Miville-Dechêne saw a victory in the Canadian House of Commons, against government opposition, for her Bill which already has the support of her own upper House. That now heads into Committee and could easily become law in 2024.
In Australia, the government rejected the advice of its own eSafety Commissioner to begin a trial of age assurance modelled on euCONSENT, only to be shocked when the opposition Coalition outflanked them with a commitment to a $6.7m AUD pilot project if they win a close-run election due this year or in the first half of next.
And in India, the Digital Personal Data Act will soon come into force, requiring consent to share personal data that can only be obtained from adults – so that is 1.4 billion more users who will need to prove their age online regularly.
Enabling Interoperability on and offline
While age checks have become much easier – particularly when facial age estimation is sufficient – we have long recognised the need for a user-friendly solution that does not require you to prove your age separately to every site you visit. The EU also saw that opportunity as far back as 2020 when the European Parliament initiated a project to develop interoperable age assurance and parental consent mechanisms.
The euCONSENT project delivered a successful largescale trial across five countries, and last year it became a permanent entity as a non-profit NGO in Belgium. 2024 will see that trial move into live operation, thanks to new funding from the United Nations Safe Online initiative.
But what about the competition?
There is no doubt that the independent age assurance sector faces some stiff competition. Governments are developing digital identities in the form of the eIDAS2 digital wallet, mobile Driving Licenses (mDL) in the USA and Trust Frameworks in the UK, Canada, New Zealand and beyond. But do citizens want to use their government ID as the key they need to access the Internet? And also, there are no apparent plans to make use of such digital IDs a practical way to make the Internet age-aware persistently – which is the mission of our sector. We still expect there will be a need and a demand for a layer in the technological stack that might initially confirm your age from a government-issued ID, but then facilitates ongoing age-restricted access separately.
Large global platforms are also indicating an interest in the age assurance market, although questions around liability and competition will doubtless arise. Do competition authorities want a gambling company to be dependent on one or two large platforms to enable it to advertise only to adults? Do users want to be restricted to navigating the Internet only under the watchful eye of one of these large, data-hungry corporations?
We could even see manufacturers of devices or the owners of app stores volunteer to take on the responsibility for age assurance from the digital services, but so far, they have been very reluctant to allow that duty to be passed to them. In the end, only the owner of any site or service can access its content and functionality and assess its suitability for a given age-group, and surely the buck should stop with those who are making a buck out of that platform, not be offloaded onto app stores or device manufacturers.
So, what are the prospects for the AV industry in 2024.
There is some competition on several flanks, but an independent sector that works collaboratively to drive up standards, to improve user-experience through interoperability, and to deliver cost effective, privacy-preserving age checks is still going strong. If it maintains the momentum its built in defining a high quality, privacy-preserving solution to a pressing societal need to protect kids online, then we believe our members have every chance of playing the lead role in making the Internet age aware, and a far safer place for children as a result.