Current Region:

Tech is clever; it can usually do what you need it to and that includes online age checks

February 15, 2022

An article in the New Statesman about the new Online Safety Bill currently being re-drafted by DCMS, argues “The government’s age verification rules would never work and would penalise smaller, more ethical creators most.”

Rather than try to respond to the many issues and inaccuracies in the article on social media, we do so in detail below.

The government won’t be addressing any of these issues: revenge porn, images of child sexual abuse, and trafficking within the porn industry.

The author must have missed the announcement a few days earlier (see tweet below from the Secretary of State) that revenge porn is to be included in the Bill, and not had time to read the original draft Bill which addresses child sexual abuse (and terrorism) already.

A similar initiative – dubbed the “porn block” – was announced by David Cameron’s government and scrapped in 2019 after it proved too technically difficult to execute.

This is not the case. Broadly similar technology was availabe in 2019 as is what will be used again today.  Nicky (now Baroness) Morgan took over as Secretary of State, appointed by the new Prime Minister, Boris Johnson, and passed on instructions to her civil servants to abandon the plan which would otherwise have seen age verification introduced shortly before the General Election which followed later that year.  Her predecessor, Rt. Hon. Jeremy Wright MP had fully intended to commence the legislation as soon as a technical review period for the EU had ended.

It received fierce criticism from campaigners who argued that it would have been a minefield of privacy and data protections issues, and that there shouldn’t be a log kept of what porn people have been watching.

Not only would consumers have been protected by existing GDPR legislation, with age verification provider under close scrutiny by the ICO, but the then regulator, the BBFC created an additional “AV Certification Scheme” to double check on privacy and data security measures.

The essence of age verification is proving you age WITHOUT disclosing your identity. So, the technology was designed to be “double-blind” – the porn sites would not know the identity of the users being age verified, and the AV providers would not keep a record of which sites were asking to verify which users.

The commercial websites will never want to risk a data leak of their user’s data through any third party so were themselves conducting careful due diligence of the suppliers to make sure that such ‘honeypot’ databases would not be created.

Some ideas listed by the government include “checking a user’s age against details that their mobile provider holds, verifying via a credit card check, and other database checks including government held data such as passport data”. All of these options lead to the question: how can this be done without revealing the user’s identity to either the government or to companies?

If the challenge is to prove your age without disclosing either your name or address, then facial estimation using artificial intelligence can also deliver that for the vast majority of adults.  Obviously selfies are a form of personal data themselves, but they do not need to be retained after the age check is complete, any more than other conventional forms of ID need to be stored after and AV provider has confirmed the data of birth.  GDPR requires only retaining or sharing the minimum data required for the purpose.

It’s likely that only a handful of under-18s will be affected – most teenagers will find ways to get around this unsophisticated tech.

It is true that the regulations under the Digital Economy Act were only intended to stop children stumbling across porn, not create the sort of 100% foolproof age checks our members offer for higher risk situations, such as the purchse of a hunting knife.  Checks can be scaled up to be far more rigorous if regulators and lawmakers decide that is required, of course, but this has to be balanced against the cost and inconvenience.

It is likely that the tech required would be expensive and only affordable for the biggest porn companies.

At present, our members advertise prices of online age checks that are pennies not pounds.  Our work to deliver interoperability between providers, allowing user’s to re-use the check they did yesterday to order wine from a supermarket to access adult content today, with further reduce the cost, and add further competition to the market for age verification.  Smaller adult sites rely less on the advertising models and high volumes of traffic, and more on subscriptions where each individual user is of higher value, and the cost of an annual check is not prohibitive.  It also ensures that users are adults in a position to go on and pay for content, not inquisitive children who will rarely if ever pay.

Similar legislation has been passed in the US and sex workers are the ones bearing the brunt.

The author is actually refering to legislation (FOSTA/SESTA) which made websites liable for ads, comments, and more content related to sex trafficking – not pornography.

No problems with porn will be solved by shoddy tech

AV Providers are subject to audit against rigorous certification schemes built on international standards.  These go far beyond compliance with general quality management and IT security standards.  Thousands of age checks are successfully performed every hour of every day for the purchase of age restricted goods with compliance rates that far outstrip the success of real world checks.

Privacy; a foundational concept for age verification

Privacy; a foundational concept for age verification

Perhaps the most frequent concern raised about age verification is a risk to privacy.  But the essence of age assurance is the ability to prove your age online WITHOUT disclosing your identity.  Our industry would not exist were there not the absolute need to preserve...