Online age verification

This page is about the age verification (AV) controls for online pornography as found in the Digital Economy Act 2017.

The Digital Economy Act 2017 requires operators of commercial pornography sites to verify the age of visitors before allowing access.

Legal Overview

Introduction to AV

• Age verification has its basis within Digital Economy Act 2017/Part 3.
• The Act requires that anyone who makes "pornographic material" available "on a commercial basis" makes sure that the material is not accessible by those under the age of 18.
• The implication of the above is that such site must make use of tools to verify that people accessing their sites are over the age of 18.
• The Act does not define how age verification systems are supposed to work, but outlines some specifics for the creation of an age verification regulator. The regulator is intended to oversee the implementation of AV systems.
  • The position of regulator has been proposed to be filled by the BBFC, and this was accepted quietly by Parliament on the 1st Feb 2018.
• The Act imposs penalties on providers who refuse or fail to implement AV. In particular, these penalties can include fines, but the Act also grants the AV regulator the power to issue an order to any internet service provider to block non-compliant sites.
• It's unclear whether this will apply to sites such as Reddit, Twitter, Tumblr etc. - but there are suggestions that Murray Perkins (Head, BBFC) noted that they would also be required to comply at a meeting of the Free Speech Coalition in January 2018.
  • David Cooke, director of digital and new media at MindGeek also stated at an eForum in January 2017 that MindGeek personally feel that Twitter should not be exempt from AV and should be subject to the same requirements that a dedicated pornography site would.

Definitions

• "Pornographic material" is defined in the Act as being:
  • Any material for which the BBFC have issued an R18 certificate, or it would be "reasonable to assume" that they would issue one for;
  • or (more importantly) any material for which it is "reasonable to assume from its nature that it "was produced solely or principally for the purposes of sexual arousal" and that any classification certificate (if one was issued) would be an "18" rating.
• Any sites which host pornographic material designated as "extreme" are likely to be blocked outright under the Act.
• "Extreme" pornography is defined in Section 22 of the Act, and the definition encompasses more material than one might expect.
• The "extreme pornography" provision in this act that allows AV regulators to order sites carrying such content to be blocked should not be confused with the legislation that makes it an offence to possess extreme pornography, which has existed since 2008.
  • The extreme pornography possession offence carries a penalty of up to 3 years for possession of such images and media, and can be found within the Criminal Justice and Immigration Act 2008.
  • The definition of extreme is the same in both acts.

Technical Implementation Overview

Examples of AV Tools

Some of these sites contain a bit more detail about how they intend their tools to operate, which might be useful. As we understand it, these tools are currently the most developed and are likely to become the dominant players in the AV market:

• AgeID - MindGeek's tool
• AVSecure
• AgeChecked
• Yoti

Technical Overview

• As the act does not define how AV providers should work, it is expected that the market will drive the creation and implementation of these kinds of tools.
  • As it is difficult to reliably verify age without also verifying a corresponding identity, it is expected that the tool will require the user to input personal data and will use this as part of the verification process:
    • Name, Date of Birth, Credit Card Numbers, ID Numbers, etc(?)
    • Some idea of how the process might work can be found on (already established AV tool) Yoti's website.
• It is expected that sites will use geolocation technology that identifies users' country of origin by IP address. Using this, sites are likely to show the AV prompt only to users who appear to be visiting from the UK.
• It is unlikely (for cost reasons) that smaller sites, or even any sites outside of the major ones, will have the resources to develop their own AV tools, so will be looking to implement tools created and provided by third-parties.
• If large AV providers can offer their tools and infrastructure at a low price or free, they are likely to quickly dominate the market.
• For the purposes of a smooth user experience, it is likely that one major driving factor in a site's decision which AV systems to offer users will be the popularity of the tool itself.
  • Sites will want to offer their users the ability to verify using systems they already have user accounts for, rather than risk the deterrent of forcing the user through a new signup and verification process.
• It will be a huge appeal of an AV tool if they are able to offer a "single sign on" approach, whereby a user logs into an AV platform only once and their login remains valid across all of the porn sites they choose to visit.
  • This is contingent on each site the user visits implementing that same tool, and we believe the appeal of this approach will lead to a market in which there are one or two dominant providers controlling AV tools, and certainly not a market in which each site is verifying age individually.
  • There are concerns with 'single sign on' type AV services from ORG's perspective - if MindGeek are able to produce a no-nonsense "single sign on" platform that requires one account and login and means a user does not need to be prompted to re-verify every time they access a new site, then it is likely that this "universal" tool will win out and become a natural monopoly.
  • Similarly, if there are tools which promote privacy but pass the cost of verifying age onto the viewer rather than the site owner (as AVSecure claims to), then it is likely that a general user will opt for the option that does not cost them money.

Hypocrisy of MindGeek's Approach

• MindGeek are a media outlet headquartered in Luxembourg and the owner of a number of major popular porn websites worldwide (both streaming and paid).
• MindGeek have been working on developing their own age verification tool (AgeID).
• MG have been publicly advertising for sales representatives for some time, to sell this age verification product to other sites who may want to use it.
• MG's market dominance means that any tool they choose to implement across their portfolio of sites has a major competitive advantage when considered in relation to the above issues.
• One might initially expect a company such as MindGeek to be against such legislation, but they have supported it from the beginning. FOI requests by the Open Rights Group have revealed emails from MindGeek to the DCMS which make this clear:
  • See in particular r 170301 1503.pdf from this FOI request. Particular note may be taken of the smiley face used as a signoff by MG's representative. ☺
• In addition, MG's position on the Government-stated goal of implementing AV checks seems to differ today from their position in 2014, when they suggested to the BBC that:
  • "The best solution [to preventing children encountering porn] lies in a multi-layered approach in which the parent assumes the central role."
• Since the early days of discussion around an AV law, MindGeek have been directly lobbying for the introduction of it through the Digital Policy Alliance. They joined the DPA's Age Verification Working Group in May 2015.

General Issues with AV

Privacy

• Age verification represents an obvious issue for user privacy. In practice, it is very difficult to reliably verify a user's age online, without also verifying that user's identity.
• With this, it is worth considering the problems represented by a dataset which contains users' real-world identities connected to their pornography viewing preferences.
• There are two main threats here that are worth considering:
  • The privacy impact of the data being used by the AV operator itself; and
  • The privacy impact of the data leaking as a result of a data breach.

Data Used by AV Tool Owner

• In all scenarios, the use of the data provided by users to an AV provider is of concern, but particularly so when talking about MindGeek as a potential owner of the platform in question.
• MindGeek, as the owners of a lot of large adult sites, have a commercial interest in the collection of as much user data as possible from their tool - with respect to demographics, viewing preferences, and other detailed analytics.
• To MindGeek's benefit, becoming the dominant AV provider offered across platforms which they do not own means they are able to collect analytics data (demographics and content popularity) from a far wider range of sites than those MG own themselves.
• MindGeek will be able to collect the viewing preferences of users across a multitude of different, niche, or sensitive sites and not only will they be able to link this to the user's demographic data (and ID), but it there will be a direct business incentive for them to do so.
• From an adult industry perspective, this can lead to some commercial exploitation concerns - whereby MindGeek may abuse its market position and the data from their AV tool in order to move into markets for niche content which they do not currently produce, but that they notice a rising interest in.
  • This may also allow MG to aggressively buy-up providers of niche, kink, or LGBT content which they have identified as profitable - thereby continuing to increase their market dominance.

Data Breaches

• One obvious potential fallout of such large databases being produced which connect a user's identity to their porn viewing preferences is the risk of data breaches.
• Regardless of the intent of an AV provider with regard to what they do with the content of their collected databases, data breaches can and will happen. No ill-will or malice on the part of the AV provider is necessarily needed.
• Irrespective of the associated ethics of the platform in question, it is worth considering the fact that in the wake of the Ashley Madison data breach, multiple exposed members of the site committed suicide. The leaking of data about private sexual preferences and practices can be very damaging and have a drastic impact on a person's life.
• MindGeek do not have a great reputation for protecting sensitive user data. Several of their subsidiaries and properties have been subject to recent data breaches. A list of MindGeek data breaches can be found on this wiki.

Timeline of age verification issues

• 2005: Gambling Act 2005 makes it an offence for UK gambling sites to allow under-18s to gamble, extended to licenced overseas sites by Gambling (Licensing and Advertising) Act 2014.
• 2009: "The Audiovisual Media Services Regulations 2009"

(2) If an on-demand programme service contains material which might seriously impair the physical, mental or moral development of persons under the age of eighteen, the material must be made available in a manner which secures that such persons will not normally see or hear it.

• 2010: ATVOD formed; on-demand programme services regulations applied to some UK-based websites.
• 2014: Digital Policy Alliance online age verification group formed
• 2015: GOV.UK Verify introduced for identity verification on connecting to some government services
• 2015: Conservative party manifesto calls for age verification for access to "all sites containing pornographic material". Sajid Javid MP indicates that "websites that do not put them in place will be blocked".
• 2015: "To ask ... if he will introduce an independent regulator for website age-restriction controls in 2015." Chris Bryant MP
• 2015: David Cameron MP "I want to see age restrictions put into place or these websites will face being shut down."