UK web users to undergo age verification to access porn

The UK has made bold updates to its draft Online Safety Bill which bring in new offences with matching strict punishments for tech firms, and bring back the age verification requirement to prevent those aged under 18 from accessing all commercial adult sites. The update also states that age verification will be implemented to prevent minors seeing adult content on other sites such as social media.

The updates will be mandatory rather than part of a voluntary code. Privacy must be ensured and the regulator Ofcom (Office of Communications) will be the enforcer. Supposed technical issues for age verification are rapidly evaporating and the draft bill is expected to go to parliament in the “next few weeks”.

New crimes and punishments

Extra priority illegal offences are to be written on the face of the bill (meaning they will not need to wait for secondary legislation). According to the DCMS, these include revenge porn, hate crime, fraud, the sale of illegal drugs or weapons, the promotion or facilitation of suicide, people smuggling and sexual exploitation. The priority illegal offences of terrorism and child sexual abuse are already included.

The updated draft Online Safety Bill also includes three additional criminal sanctions accepted from the Law Commission.

“A ‘genuinely threatening’ communications offence, where communications are sent or posted to convey a threat of serious harm” which would apply to threats of rape, death or stalking.

“A harm-based communications offence to capture communications sent to cause harm without a reasonable excuse” would cover different kinds of threats which may not appear immediately threatening to outsiders and may rely on context to pose a threat, such as sending a photo of someone’s property to show it is being watched.

“An offence for when a person sends a communication they know to be false with the intention to cause non-trivial emotional, psychological or physical harm.”

More work is under way with the Ministry of Justice on issues such as cyber flashing, according to Nadine Dories, secretary of state for DCMS, speaking on the BBC.

Sites such as social media would have the legal duty to put in measures to attempt to prevent these offences, rather than dealing with them after the matter.

Ofcom will be able to enforce fines of up to 10 percent of global turnover to non-compliant sites that fail to remove harmful content, and block access to them from the UK. Named individuals at firms running social media platforms would be found liable.

When asked on BBC radio about how the regulator Ofcom would deal with a death threat to get to a company’s named individual, Dories said, “They won’t find a single death threat. What they will be looking for is how the algorithms work in those online platforms to allow that to happen, and will be looking at the content that those platforms allow to be published online”.

Dories added that considerable funding is being provided for Ofcom to be ready for Royal Assent.

Age verification: traditional or biometric

The latest update brings the age verification requirement to all commercial porn sites, not just those carrying user-generated adult content such as OnlyFans.

“The new standalone provision ministers are adding to the proposed legislation will require providers who publish or place pornographic content on their services to prevent children from accessing that content. This will capture commercial providers of pornography as well as the sites that allow user-generated content,” states the Digital, Culture, Media and Sport (DCMS) announcement on the addition.

Age verification can be done via mobile phone records, credit card checks, credit references or checking government databases such as the passport service and driving licenses. Age verification technologies can also be used and Ofcom may advise on these.

Julie Dawson, Director of Policy and Regulatory at Yoti, a London-based biometric identity verification firm, told Biometric Update ,“Our secure, privacy-preserving age verification solutions work for a range of businesses including online platforms and content providers. This helps to protect children while complying with regulations from online safety regulators, such as the Online Safety Bill.

“Yoti can be used to stop underage access and sales, provide age-appropriate content moderation, deter grooming and prevent account swapping with automated checks ensuring the real account holder is active.”

The government has been going back on forth on whether to enforce age verification since 2015, its most recent abandonment in 2019. While the UK is leading the world with tech-related legislation such as the Age-Appropriate Design Code (or ‘Children’s Code’) from the Information Commissioner’s Office (ICO), the reappearance of age verification could be due to the ongoing domestic political turmoil as Prime Minister Boris Johnson fights for his political life.

The technology has not changed significantly in three days, while outside pressure has.

Saturday 5 February: age verification ‘not achievable’

Nadine Dories, secretary of state for DCMS, appeared on the BBC’s flagship radio news program, Today, on Saturday 5 February to discuss the new offences. After a package about a girl who took her own life after viewing websites on self-harm, suicide and pornography, including on school equipment, Dories was asked about whether age verification should be added to the bill.

“There is a downside to that too, that means that any children accessing the internet need to verify their age – or younger people. And young people go on to the internet to go shopping, on clothes, do we need to ensure that they verify their age when they’re doing that? It’s not, I don’t think, achievable.”

Tuesday 8 February: ‘confident there are ways to achieve this’

A couple of days later, Chris Philp, Minister for Technology and the Digital Economy and Dories’ deputy also appears on Today to explain how age verification is being added to the Online Safety Bill after all.

“There are some technical challenges. We’re confident they can be overcome, but we should also be clear that just because there are some technical challenges, doesn’t mean you should do nothing. But we’re confident there are ways to achieve this.”

The age verification sector itself sees no challenges with implementing age verification technology to adult sites. In fact, the sector is so prepared that the Age Verification Providers Association (AVPA) even wrote to Nadine Dories on 7 February, urging her to include age verification on the draft bill to avoid the wait if it was put through later as secondary legislation.

Privacy, preparation and VPNs

The DCMS statement points out the aims for the draft bill for privacy in age verification:

“Age verification technologies do not require a full identity check. Users may need to verify their age using identity documents but the measures companies put in place should not process or store data that is irrelevant to the purpose of checking age.”

Iain Corby, executive director of the AVPA, told Biometric Update that “the architecture of AV is ‘double-blind’ – the adult sites are given only a ‘yes’ or ‘no’ answer to the question ‘is the user old enough’ and the AV [age verification] providers do not retain any record of which sites a user visits. Even where AV providers are also ID providers, to be certified against the AV industry standards, they have to demonstrate compliance with this critical safeguard, such that they only release an age attribute even if that is sourced from a fuller identity”.

Corby confirmed the preparedness of the adult sector for complying and the age verification sector for supplying the solutions: “The adult sector has been preparing for this since before 2017 when the Digital Economy Act was first passed, before that was abandoned. [Porn site operator] MindGeek implemented age verification in France within a 15 day deadline set by the regulator, the CSA.

“The AV sector itself was built for scale, just as betting sites need to be ready to cope with the hour before the off for the Grand National. AV checks are not new – thousands are completed every hour of the day for purchases of age-restricted goods, and, indeed, for gambling.”

Concern has been raised that people will be able to circumnavigate age verification by using VPN software to trick systems into thinking they are not in the UK when attempting to access adult content.

“Adult sites must either apply age checks to all their users globally, which is arguably the right thing to do anyway, or at least apply them for users known to be located in the UK or who access via a VPN so might be based there,” says Corby.

“BBC iPlayer, Netflix and many other services already block VPNs successfully with the IP addresses of the most commonly used widely known and easily detected based on volume of traffic. More expensive VPN services do offer less traceable IP addresses, but these tend to be costly, so that acts as a barrier to children stumbling across pornography in its own right.”

It remains to be seen what happens when the draft bill goes before parliament in a few weeks, according to Dories and Philp. It also remains to be seen how Ofcom will regulate websites’ age verification procedures and how the ICO will regulate the age verifiers.

As Nadine Dories said herself, “the rest of the world is looking”.

Article Topics

access management  |  Age Appropriate Design Code (AADC)  |  age verification  |  biometrics  |  law enforcement  |  legislation  |  privacy  |  social media  |  UK  |  Yoti