Government confirms second trial at UK internet age verification system
The government today confirmed that the new Online Safety Bill, among many other changes, will again attempt to introduce a controversial internet age verification scheme, which will target “all websites” that contain pornographic content. Sites that do not comply will be blocked by broadband ISPs and mobile operators.
The change would impose a legal obligation on those sites to implement “robust checks” to ensure that users are 18 years of age or older. If the sites fail to act, the independent regulator Ofcom will be able to fine them up to 10% of their annual worldwide turnover or may prevent them from being accessible in the UK. The bosses of these websites could also be “held criminally responsible” if they do not cooperate with Ofcom.
REMARK: The new obligation will not capture user-to-user content or search results presented on a search service (eg Google), as OSB’s draft already regulates these. Providers of regulated user-to-user services that also distribute published (i.e., non-user-generated) pornographic content would be subject to both the existing OSB provisions and the proposed new obligation.
Regular readers will know that this idea was first proposed via the Digital Economy Act 2017 (summary), but at the time it only focused on commercial websites and apps that primarily contained pornographic content and allowed user-generated content. According to this approach, the British Film Classification Board (BBFC) was reportedly in charge of regulating it, apparently without any judicial oversight to prevent bad censorship decisions.
By comparison, the new stand-alone provision the ministers are adding to the proposed legislation will require providers who post or place pornographic content on their services to prevent children from accessing that content. This will encompass commercial porn providers, as well as sites that allow user-generated content (i.e. not just PornHub, but also social media sites like Twitter, etc.).
All companies that operate such a porn site accessible to people in the UK will be subject to the same enforcement measures as the other affected services.
Digital Minister Chris Philp said:
“It is too easy for children to access pornography online. Parents deserve peace of mind because their children are protected online from things no child should see.
We are now strengthening the Online Safety Bill to apply to all porn sites to ensure we achieve our goal of making the internet a safer place for children.
Again, this time it will be up to the companies themselves to decide how to comply with their new legal obligation. Ofcom can recommend the use of a growing range of age verification technologies available to businesses that minimize the processing of user data, we are told.
The bill does not mandate the use of specific solutions, but “any companies that use or develop this technology will be required to comply with strict UK data protection regulations or face enforcement action from the Information Commissioner’s Office“, the government said. But often enforcement actions tend to come after these systems have failed, and by then the damage could be significant (more on that later).
According to today’s announcement, these age verification technologies “do not require full identity checks.” Users may need to verify their age using identity documents, but the measures companies put in place”must not process or store data unrelated to age verification.” Solutions currently available include verifying a user’s age against details held by their mobile operator, verification via credit card verification and other database checks, including data held by the government, such as passport data.
REMARK: MindGeek, which runs major sites like PornHub, YouPorn, and RedTube, previously offered to use an ID combination based on credit card, mobile text, passport, or driver’s license through their own Age ID system to handle the process – this will also be licensed to other sites (i.e. one-click verification on many sites). But some worry that it gives these companies too much power over rivals and smaller sites.
However, the government has spent years trying and failing to introduce such an AV system due to various complex issues, and it is not yet clear whether it has actually resolved all of these issues. For example, we are not yet convinced that the new system will be able to work without forcing people to share their private personal data with unreliable porn peddlers. The infamous “Ashley Madison” hack highlighted how dangerous this information could be in the wrong hands (multiple cases of blackmail and suicide, etc.).
The Executive Director of the Open Rights Group, Jim Killock, said:
“There is no indication that this proposal will protect people from tracking and profiling for viewing pornography. We have to assume that the same basic privacy and security mistakes are about to happen again.
The proposal could require people to verify their age before using Google Search or reading Reddit. This seems like a huge boon to age-verification companies, for little practical benefit to child safety and a lot of harm to people’s privacy.
This all comes before we even get into the complicated question of which ISPs would be required to impose blocks on non-compliant websites (only the bigger players, or the smaller ones too?), so that what kind of systems they would be required to adopt in order to filter these websites (a basic DNS filter is one thing, but more complex and expensive filtering would not be so easy).
Never mind the fact that any type of ISP-level blockage is just a placebo, the equivalent of leaving a door wide open with the words “Do not enter” blocked outside (i.e. very easy to circumvent) – there’s not much you can do without deleting the content at the source (this is more of a challenge for international law and regulation).
Meanwhile, many have wondered if such a system is even necessary since all major ISPs already offer optional network level filtering systems, which are usually enabled by default. Let’s also not forget that there could be impacts in other areas as well, such as on sex workers (i.e. pushing them offline and back onto the streets). Likewise, there is the matter of freedom of expression (i.e. what is pornography and what is not, such as general nudity and medical content). Ofcom will have to tread carefully.