On the face of it, the publication of preliminary findings by the Age Assurance Technology Trial, commissioned by the Australian Government, was good news for the Age Verification industry. The headline conclusion, that “age assurance can be done” in the Australian context, “privately, efficiently and effectively” was a big step forward from the previous position of the Australian authorities in 2023 that the market for our technology was “immature” (but note this original comment referred to the market not the technology itself).(Note 1)
But there was a mixed response. The day before the findings were revealed, ABC ran stories across its channels with a figure they’d picked up while observing some testing in schools some weeks earlier, that “age-checking technology behind the teen social media ban could only guess people’s ages within an 18-month range in 85 per cent of cases”.
Anyone who knows anything about how facial age estimation works would not have been at all surprised by this figure – even if the Trial itself has not officially confirmed if it accurately reflects their full results. If anyone tries to claim they have devised an algorithm that can accurately assess your age within a day, a week or even a month of your real age based solely on a few selfies, they are not being truthful. Perhaps as computing power continues to improve, and, crucially, with the addition of a lot more data on which to train the models, the best in class might start hitting averages within 3-6 months, but for the foreseeable future, when estimation is used as part of a regulatory regime, it has to be adopted pragmatically, taking into account its limitations.
The age verification sector began mostly concerned with 18+ checks, and that offered a wide range of authoritative data sources against which to do hard verifications – electoral rolls, bank data, credit records, driving licences etc. As the industry was asked to assess the ages of minors, estimation emerged as an alternative, not reliant on third-party data or the possession of physical ID. But with its inevitable margin for error, it may not be well suited, at least for children near a minimum age, for hard legal restrictions. It is extremely useful for adults a few years above the minimum, above a “test age” set to create a buffer. This means it can be demonstrated that only an insignificant number of children under the required age would be miscategorised as over the test age – termed a “false positive”. For example, at a legal age of 16, it would be extremely rare for a 15-year-old to be estimated to look over, say, a test age set at 19. So, for the vast majority of adults, they can pass an age check with a quick estimation technique.
But if you want to avoid riots in playgrounds across Australia, using estimation to determine if you can or cannot open a social media account on your 16th birthday is not going to be ideal, because some would be “lucky” enough to pass the test early, and others may not pass for several months after they turn 16. Of course, some of us remember when how old you looked determined whether you would get served in a bar, and accepted that if we looked young for our age, we’d need to carry ID. But perhaps the risk of allowing underage users access to social media is too great to accept a blurred enforcement age, and few bars adopt such a risky policy these days.
So, for children just above the legal age, alternative methods of age assurance are probably going to be needed in Australia. Age assurance is a term that includes both estimation and verification, so the trial’s conclusion that it can be done is not flawed because estimation alone does not deliver a comprehensive answer.
What then are the verification options? Well, some children will have passports or a learner driver licence they can scan and, after comparison to a live selfie, prove their age exactly. Others may have bank accounts and can give their bank consent to confirm their age electronically. That will not cover every child, so more alternatives need to be part of the mix. One participant listed as part of the trial (not affiliated with the AVPA) according to its Practice Statement, published alongside the findings of the trial last week, “verifies whether an individual is 13+, 16+, or 18+ based on data obtained from school Student Management Systems (SMS)” – that sounds promising (Note 2). And for those who are perhaps home-educated, and lack all the aforementioned options, then a system of professional vouching, as operates in the UK under the authority of the Proof of Age Standards Scheme, can provide a comprehensive backstop – someone authoritative in their community just confirms their age in a digital or even paper-based reference (Note 3).
One related point – the legislation in Australia on social media places the responsibility for checking age on the platform, not parents, so while the trial is broad enough to consider parental consent and controls as well as age assurance, these cannot form part of the ‘reasonable steps’ to implement this new law. There may be other use-cases where parental discretion is accepted by policy, which is why we presume these are included in the trial, but the 16+ law is not one of them.
Australia is likely to be the first jurisdiction in the world to attempt to enforce age restrictions below 18. How this is done is not going to rely on a single “silver-bullet” answer – as the Trial also concluded last week when it said, “there is no one-size-fits-all solution for all contexts.” The eSafety Commissioner will be drafting the guidelines on how to achieve Parliament’s goal of keeping children under 16 off social media, with the insights the trial offers into the capabilities and constraints of some 53 possible approaches. We would expect regulations to be technically neutral – and instead focus on the required outcome of any combination of age assurance methods. They may indicate, as Ofcom did in the UK, examples of methods they believe capable of achieving the policy objectives, but should then leave it to the platforms themselves to demonstrate, ideally through independent audit and certification of their overall system, that they are delivering to the required standard, while maintaining inclusivity and accessibility.
We look forward to the full results of the trial. There will be a range of results, not just on accuracy, but on the other dimensions of the evaluation the trial is considering. But if the average accuracy achieved across one category of age assurance does turn out to be 18 months, that’s not a reason to abandon trying to make the Internet a safer place for children – it just means we need a slightly less simplistic view about how it will be achieved.
(1) “The independent assessment found the age assurance market is immature but developing” https://www.esafety.gov.au/sites/default/files/2023-08/Roadmap-for-age-verification_2.pdf
(3) See for example https://www.citizencard.com/requirements-for-a-first-uk-id-card (route 2)