Listen to this story
--:--
--:--
Why Age Verification for Online Porn Failed
The policy aimed to protect children, but critics say the flawed project presented serious privacy risks
When today’s politicians were at school, they may well have discovered pornography through a ragged magazine passed around the back of the class, or an illicit VHS tape at their friend’s house. Today, the scale, diversity, and immediacy of the porn available online makes those kind of formative encounters seem quaint. It’s a $97 billion global industry that accounts for about a third of all data transferred online; the website Pornhub served 5.5 billion hours of video during 2018.
Given the ubiquity of both the internet and porn, it is perhaps not surprising that our children are more exposed to it than ever. A comprehensive 2016–17 report by the influential U.K. charity the National Society for the Prevention of Cruelty to Children, along with the Children’s Commissioner for England, found that 53% of 11- to 16-year-olds had been exposed to online porn. Twenty-eight percent encountered it accidentally, while 19% where shown it by someone else.
“I’m mostly concerned for the younger ones. They either don’t know about sex, are not sexually active, or do not necessarily understand sex. It can be very shocking for them.”
Most young children feel disturbed and confused the first time they encouter online pornography, according to Elena Martellozzo, an associate professor of criminology at Middlesex University in London who specializes in online grooming behavior, distribution of indecent images, and police practice. “Children are affected by pornography, particularly those children that are exposed to it and weren’t looking for it,” Martellozzo tells OneZero. “I’m mostly concerned for the younger ones. They either don’t know about sex, are not sexually active, or do not necessarily understand sex. It can be very shocking for them.”
Martellozzo co-led research for a 2017 study on the impact of porn on young people, which concluded that it can have negative emotional effects on children, that teenagers can view porn as realistic and try to emulate it, and that it can set poor examples of consent and safe sex. Separate studies suggest that watching porn can have longer-term effects such as sexual health problems and reduced relationship satisfaction.
Shortly after the research was released, the U.K. government announced a new age verification policy for online pornography, which would require commercial porn sites to verify that visitors with a U.K. IP address are over 18. The government selected the British Board of Film Classification (BBFC) to oversee the age verification system. It was an unusual choice — the BBFC is a regulatory body which primarily classifies movies and video games and has limited expertise and experience in online regulation. Although larger, popular sites will add an age-checking feature when the law comes into force, hundreds of thousands of smaller pornographic sites may not be able to afford the new technology. Sites that don’t comply can be fined up to the equivalent of more than $300,000 and have their internet service provider and online payment services blocked.
A new market of age verification tools has sprung up as a result, including AgePass, 1 Account, ProveMyAge, and AgeID. Each company has a different way of checking a user’s age — some use credit card, passport, and driver’s license information, and others adopt facial scanning. For users who don’t want to register their personal details online, there will be an off-line option available from retail stores with proof of age.
The policy has been watched closely by other European governments — including Ireland, Sweden, and Poland — which are all keen to develop legal and technical ways to tackle the complex problem of protecting children online. But the policy has been beset by delays and heavily criticized by privacy campaigners for its technical flaws.
Sites which offer free porn are exempt, as are sites that the BBFC determines have less than 30% pornographic content, including Twitter and Reddit. Because the law only applies to users in the U.K., anyone using a virtual private network (VPN) can easily disguise their location and bypass the age verification system. One report claimed Google searches for VPNs tripled in the hours following the government’s age verification announcement earlier this year, while another claimed some checks could be circumvented using fake details.
Although in favor of technical solutions, Martellozzo does question how effective age verification might be. “It could be a good deterrent — but to what extent does it really block young people?” she says. “My concern would be that if children can’t get access to porn [online] they would find it elsewhere.”
Opponents to the age verification system have suggested that restricting access to well-known porn sites may drive children toward even more harmful content. “It’s an incentive to young people to explore the darker and unregulated corners of the web,” says Timandra Harkness, privacy commentator and author of Big Data: Does Size Matter?
Recent delays due to a governmental admin error have also not inspired confidence, although U.K. Culture Secretary Jeremy Wright has insisted it is still the government’s intention to bring in the age verification system. Critics are less impressed. “The latest delays seems to be administrative incompetence. This should tell you a lot about how [the government has] handled this policy throughout,” Jim Killock, executive director of the Open Rights Group, tells OneZero.
“Our core concern is that any product will link identity to a list of pages and items viewed, which will create a detailed view of someone’s sexual inclinations.”
The British public has historically resisted government-controlled data projects. In 2010, the campaign group NO2ID was instrumental in forcing the government to abandon plans for a national information register and identity card, citing concerns about privacy, civil liberties, and personal safety.
Campaigners have been equally concerned about the personal information available to the private companies providing age verification tools, particularly if browsing habits can be connected to identity. AgeID, one of the most common age verification systems, is owned by MindGeek, which also happens to run a large portfolio of porn sites, including Pornhub and Redtube. “Porn companies have a poor security record, including MindGeek, which has had a number of highly dangerous data breaches,” Killock says. “Our core concern is that any product will link identity to a list of pages and items viewed, which will create a detailed view of someone’s sexual inclinations.”
Michael Willis, communications manager at MindGeek, tells OneZero that the company’s sites suffered two data breaches in recent years, but notes that both were dealt with swiftly. One targeted Pornhub, one of the world’s largest pornography sites. “Cyber criminals KovCoreG sought to use advertising on the site to potentially expose viewers to malware,” Willis explains. “Pornhub acted swiftly to remove the infected content and eliminate the risk to users who may be tricked into installing malicious updates.”
Many believe the problem is not the U.K.’s age verification system itself, but the lack of rigor in how it has been executed. Every system has its vulnerabilities, notes London-based privacy lawyer Rory Lynch. “If an unsuspecting user uploads the photo page of their passport or driver’s license to an unsecured site or product, then this could be the route via which a hacker could steal their identity and defraud them,” he says. “We saw the fallout from the Ashley Madison leak, and that was just one website. The risks here are obviously much larger.”
It’s difficult to say exactly how every site will provide age verification checking services. But Willis argues that AgeID won’t be vulnerable to such attacks. “AgeID is a single sign-on portal which provides users access to an independent third-party age verification site and is fully in compliance with data protection laws,” says Willis. He explains that this means AgeID doesn’t know the identity or date of birth of its users, only whether or not they’re over 18. “Since such data is not collected by AgeID, it cannot be leaked, marketed to, or used in any way. This has been independently assessed and confirmed by cyber security firm, NCC Group.”
So is there really any safe and effective age verification system that can prevent children from accessing adult material online?
Although the U.K. government referred to its system as a “world first,” other countries have been looking into similar methods to restrict access to pornography with the aim to protect children. In 2013, the Icelandic government announced plans to ban all pornography — both online and in print — in order to protect children from violent sexual imagery. A number of technical solutions were suggested, including prohibiting Icelandic credit cards from paying for pornography, as well as a national filter or list of websites to be blocked. However, the plans also faced similar criticism from free speech campaigners and never came to fruition.
If the age verification system in the U.K. is rolled out, it could set a precedent for how other countries deal with online pornography. Irish Prime Minister Leo Varadkar has said he would consider rolling out a similar policy in Ireland. This comes off the back of a murder trial in Ireland in which two boys were found guilty of murder and, according to the Irish Post, one had extreme pornographic images on his phone.
“The only way we can truly prevent children from accessing pornography online is to set up a ‘Chinese-style system’ whereby everything is state-controlled,” Harkness explains. China — as well as Iran, Indonesia, Malaysia, and Saudia Arabia — already takes a much stricter approach to censoring and blocking online content, including pornography. “But if the government ends up in the position of deciding what the public can and can’t see without permission, it sets a very worrying precedent.”
Yet even the very best technology should never be relied on without a broader policy to support it, Martellozzo says. “Age verification is a good idea. But it needs to be supported by other solutions that aren’t technical,” she says. “If it’s not combined with relationship and sexual education, it could leave children and young people just as ill-prepared for the situations when they do see sexually explicit material.”
Update: This piece has been updated to include additional comments from MindGeek on AgeID.
