‘Highly effective age assurance’ poorly defined in Ofcom consult, says AVPA

The Age Verification Provider’s Association (AVPA) has issued an extensive response to the UK regulator’s consultation on “Protecting children from harms online,” the second of the key Codes of Practice which will inform the framework for how children will be protected from illegal activity under the Online Safety Act 2023.

In a statement published on its website, AVPA says Ofcom’s language on so-called “highly effective age assurance” is too vague, and that the regulator has failed to answer calls from Parliament to implement age assurance checks for opening social media accounts.

AVPA is not merely pointing out what the Ofcom document lacks. Its statement offers a concrete, numbers-based definition for what constitutes highly effective age assurance (HEAA): “Highly effective age assurance systems must demonstrate that their certified expected outcomes are such that more than 95 percent of children under 18 are prevented from accessing primary priority content, and more than 99 percent of children under 16 are prevented.”

“In the absence of a clear definition by Ofcom, we will need to define highly effective age assurance ourselves, through industry standards and certification schemes,” AVPA says. “In the absence of numerically specific guidance as to what meets the requirement for HEAA, it is impossible for platforms to know at which level of assurance to set their solutions. This lack of clarity is in fact a deterrent for others to act.”

Without numbers, says AVPA, “there will be a race to the bottom; less scrupulous platforms will document that preventing 70 percent of users who are under age from being exposed to primary priority harms is highly effective in their opinion.” Court challenges from Ofcom could run up against the regulator’s own inability to set a sufficient standard.

As to age assurance for social media, AVPA dismisses Ofcom’s omission of age checks to ensure detection of kids under 13 as a dereliction of duty. “The proposed regulations abandon any attempt to enforce the minimum age required by a platform’s terms of service, or, in cooperation with the ICO, the age of digital consent,” it says. “These are clear statutory requirements which Parliament expects, not least because the Minister promised it, Ofcom and the ICO to enforce.”

Besides which, AVPA notes the “clear requirement under UK GDPR Article 8 for parental consent before processing the personal data of children under 13.”

The borderline irritated tone from AVPA may stem from what it considers to be ignorance of what existing age assurance methods can actually do. Ofcom’s argument against HEAA for youth is based on “limited independent evidence that age assurance technology can correctly distinguish between children in different age groups to a highly effective standard.”

Nonsense, says AVPA, calling it a “strawman argument.”

“It is widely recognised that strict age verification for children, given the more limited data sources, would be impractical as a general requirement at 13,” it says. “This is why we, and others, have long argued for a lower standard of age assurance, perhaps termed ‘Broadly Effective Age Assurance’ could be introduced to at least begin to reduce the age at which children are regularly opening social media accounts below the minimum age required by terms of service and UK GDPR.”

AVPA’s suggestion to implement effective age assurance that does not result in an unacceptable number of false negatives is a type of tiered system that requires second checks for those who fall outside an established “buffer zone” in a first round of age assurance.

Overall, AVPA’s message to Ofcom is a familiar one to followers of the biometric age verification sector: effective age assurance is possible. The tools exist. But government policy must be at least as fair and accurate as the regulators are asking age assurance systems to be.

Rights coalition says Ofcom codes need safety by design

Digital rights groups have also issued a response to the Ofcom consultation – and they, too, say Ofcom is dithering. In a statement, the Children’s Coalition, an alliance of organizations that includes the National Society for the Prevention of Cruelty to Children (NSPCC), the 5 Rights Foundation, the Internet Watch Foundation and many more, says “we are concerned that the regulator’s current approach will not bring about the changes that children need and deserve, or that parents, parliamentarians and civil society expect.”

The coalition points to three areas in which Ofcom needs to do more to respond to the “scale and complexity of harm children face in the online world.” Code of Practice measures must be “outcomes-based and address all identified risk of harm to children.” They must prioritize preventive safety by design. And they must protect the youngest children through “a change in Ofcom’s approach so that services are explicitly required through the regulation to enforce their minimum age limits.”

“Ofcom must go further and use its full powers to demand bold and meaningful change from tech companies,” says the group. “If this does not happen, the new Government must ask searching questions of Ofcom to ensure they are working to make the Codes of Practice as strong as possible, and should also consider whether there are measures, legislative or otherwise, to strengthen this regulation in order to fully protect children and young people when they are online.”

Article Topics

age verification  |  AVPA  |  children  |  face biometrics  |  Ofcom  |  Online Safety Act  |  regulation  |  social media  |  UK GDPR