Age verification is coming

Age verification is coming

Image:
Age verification is coming

'If you are online you are going to need to demonstrate your age'

Age verification is in the news again due to the tragic case of Molly Russell, who took her own life aged 14. Concluding an inquest into the case, coroner Andrew Walker said last week that Molly died while suffering depression and that the thousands of images of self-harm and suicide she viewed "shouldn't have been available for a child to see".

Platforms like Instagram have been extremely resistant to gate content according to age, fearing it would hurt their business model as well as making them more like a publisher for legislative purposes, but the pressure is now on them, and other online services like search engines, to start doing so.

In the offline world we are required to prove our age when we, for example, buy alcohol, learn to drive, register to vote, open a bank account, apply for a bus pass and on many other occasions, but applying this to the online world is fraught with difficulties. In 2019 the UK government dropped plans to introduce a nationwide age verification system for porn sites because of technical issues and concerns over surveillance and the potential for blackmail.

But make no mistake, age verification is coming. A raft of new laws are on the way in the US, Europe, UK, Australia and elsewhere.

If you are online you are going to need to demonstrate your age, Ian Corby, AVPA

"There's just a whole host of legislation either in place now or about to come into force, which is essentially saying that if you are online you are going to need to demonstrate your age," said Ian Corby, executive director of trade body the Age Verification Providers Association (AVPA), speaking at an Open Identity Exchange Identity Trust 2022 event in London last week.

Currently, when required to prove our age online, we tend to send a scan of a document such as a passport, but this is obviously far from ideal. First, it's a terrible UX; second, it gives away additional sensitive information about who we are; third, we have to repeat the rigmarole for each different site. An ideal solution would be privacy-preserving, interoperable and tamper-proof, and would not lock out people who don't possess technology such as a smartphone.

There are many projects developing technologies to fit this bill. Some access date of birth from open banking APIs, others use hard verification techniques based on passports or credit cards, and there are some that deploy heuristics such as AI-driven face and voice analysis. This range of approaches makes standardisation - essential for interoperability - difficult. Nevertheless, the AVPA is contributing to an IEEE standard on best practice age assurance, and Corby said he expected that work to bear fruit soon.

Where will age verification be used?

Whereas age verification was initially all about restricting access to porn sites, the current debate is much broader. The current draft of the Online Safety Bill covers all services "likely to be accessed by children".

However, rather than seeing age verification as restrictive, it can facilitate appropriate access to education, gaming, streaming, social media and banking, said Dr Rachel O'Connell, founder and CEO of TrustElevate, a provider of child age verification and parental consent software designed to help platforms verify the age bands of their users.

"It's applicable across business verticals," she said. "It's not only the customer onboarding, but it's also the data processing, any sales and marketing related activities on a platform, protection from online harms, age-gating people from age-related content, entering into contracts and payments, for example, enabling digital onboarding of child and teen bank accounts, and also for serving-age related products and services."

O'Connell uses the analogy of a height gauge in a theme park. "If you're under three foot, you're not going on the adults ride, you're going on the kids one. So in that amusement park, you have adults, teens and children interacting, but there are certain restrictions for users. It's trying to bring that into the online world."

The main UK regulator for the online space is Ofcom. Speaking in a personal capacity, Asad Ali, digital identity technology research at the watchdog, expressed a hope that the delayed Online Safety Bill will be passed soon, so his team can get to work on solutions for age verification regulation. Current Prime minister Liz Truss has said she wants to 'tweak' the Bill before sending it to the Lords, and new Culture Secretary Michelle Donelan said this week she is working hard to deliver it. If it passes, and Ali believes it will, it will be one of the world's most far-reaching attempts to police content on the web.

The Bill, in its current form, has been widely criticised because of its broad scope (all services likely to be accessed by children), vague definitions, the powers it gives to Ofcom and the Secretary of DCMS to define harmful content, the inclusion of restrictions on end-to-end encryption, and its potential for increased online surveillance. Indeed, some lawyers have urged a complete rewrite. Nevertheless, Ali said the child protection measures the Bill contains are positive. Regulating how social media algorithms can channel inappropriate content to children would be a big win, he said, adding that similar measures should extend to search engines.

"Not everyone uses TikTok but I think everybody uses Google or an equivalent search engine, and there is a lot of harmful content that can very easily access."

What is the legislation driving age verification?

The following laws and standards, current and incoming, require platforms to assess the age of people using them.

The UK Online Safety Bill is currently in the last stages of Parliament, after which it will go to the House of Lords. It required mandatory age verification and senior executives of online platforms (even small ones) could be imprisoned if they do not act on illegal content published on their sites.

EU GDPR Article 8 requires that companies that process children's data obtain consent of their parents or guardians first if they are offering online services directly to a child and where legitimate interest does not apply. This has not been enforced so far. The UK is working on a "business- and consumer-friendly" replacement for GDPR.

The UK Information Commissioner's Office (ICO) released a set of standards in 2021 around handling children's data known as the Children's Code.

The EU Audiovisual Media Services Directive (AVMSD) contains specific rules to protect minors from inappropriate on-demand media audiovisual services.

The California Age-Appropriate Design Code Act. Recently signed into state law, this requires online platforms to proactively consider the interests of children in their design of their services, including algorithmic feeds and targeted ads, and to default to the strongest privacy settings.

The California Consumer Privacy Act requires opt-in consent in order to sell the personal information of a consumer under the age of 16 years old.

The US federal Children's Online Privacy Protection Act (COPPA) of 2010 may be updated to include age verification.

The draft Australian Online Privacy Code says that social media services will need to take reasonable steps to verify the age of individuals who use the social media service.

Who will be affected?