Online Safety Bill will legally require porn sites to verify users’ age

When Ioannis Dekas, a father of four boys, found that one of his sons had access to pornography, he and his wife became concerned.

“In two weeks leading up to this moment, we’d noticed a drastic change in his behavior,” Dekas said in a BBC interview, “Withdrawal, a sense of anger towards his siblings, we could sense frustration in his life.” And when the couple talked to their son, they found that his peers were pressuring him to be familiar with the language of porn.

Since then, he has been campaigning for the UK government to implement the “proof of age” access to pornography, covered by the Digital Economy Act (DEA) 2017. However, DEA 2017 suffered from a series of delays and amendments, before being abandoned entirely in October 2019. According to then Culture Secretary Nicky Morgan, the government wanted to focus on a new bill that would protect children in a broader scheme of regulations based on the government’s Online Harms White Paper.

“This course of action will give the regulator discretion on the most effective means for companies to meet their duty of care,” Morgan was quoted saying. She also stressed that the government was still open to using age verification tools in the future. “The government’s commitment to protecting children online is unwavering. Adult content is too easily accessed online, and more needs to be done to protect children from harm.”

Enter the Online Safety Bill

The Online Safety Bill, which is touted as one of the UK government’s landmark bills, is poised, essentially, to regulate online content in the UK—global implications notwithstanding. It contains legislation that revives the plan to age-lock access to pornography by legally requiring porn sites to carry out age checks. This means that online porn users in the UK—estimated to be around 20-25 million people—would have to prove they are of legal age to view pornographic material by sharing their credit card to porn sites, or by having a third-party service confirm their legal age.

Ofcom, the regulator chosen by the UK government, will be able to fine porn sites up to 10% of their global earnings or block them from being accessed by anyone in the UK. The Online Safety Bill could also hold pornography site owners criminally liable for failing to follow the legislation.

As of this writing, the bill is in draft but is expected to be turned over to parliament in the coming months.

Many children’s safety groups have been asking for regulation surrounding age verification on porn sites, fueled by fear that minors could easily access it. And they have reason to be afraid. According to research by the British Board of Film Classification in 2020, half of children (51 percent) aged 11 to 13 years have seen porn. The report also reveals that children as young as seven sometimes stumble upon porn by accident.

“It is easy for children to access pornography online,” says Digital Minister Chris Philip, “Parents deserve peace of mind that their children are protected online from seeing things no child should see.”

Andy Burrows, head of child safety online policy at the NSPCC (National Society for the Prevention of Cruelty to Children), is quoted saying: “It’s right the government has listened to calls to fix one of the gaps in the Online Safety Bill and protect children from pornography wherever it’s hosted.”

“Crucially, they have also acted on our concerns and closed the ‘OnlyFans loophole’ that would have let some of the riskiest sites off the hook despite allowing children access to extremely damaging material.”

“But the legislation still falls short of giving children comprehensive protection from preventable abuse and harmful content and needs significant strengthening to match the government’s rhetoric and focus minds at the very top of tech companies on child safety.”

As of this writing, the bill already has in scope most destinations where children might be exposed to pornography. These include search engines, popular adult sites, social media platforms, and video-sharing platforms. Previously, only commercial sites with provisions for user-generated content—those that allow users to upload their content—were in the scope of the bill.

Protecting children from harmful content online is a noble cause; however, not everyone is rallying behind the idea of age verification measures.

The harm to privacy

Many see the act of sharing sensitive information with pornography sites as a security and privacy risk. Age verification requires a database of who has asked for permission to view what porn (and possibly credit card details). The complexities invovled may also encourage pornographic websites to outsource age verification to third-parties, resulting in fewer, larger, more comprehensive databases, which are of great potential value to criminal hackers or unscrupulous operators.

Jim Killock, the Open Rights Group executive director, said that age verification companies would benefit from this bill, but that it offers “little practical benefit for child safety, and much harm to people’s privacy.”

“There is no indication that this proposal will protect people from tracking and profiling porn viewing,” Killock said in a BBC interview.

Alec Muffet, a widely known internet security evangelist, penned a response to the drafts of Guidance on Age-Verification Arrangements and Guidance on Ancillary Service Providers back in 2018. These drafts proposed a similar age-verification process. Muffet expressed deep concern over “the lack of regulatory oversight, and the lack of standards regarding the operational and functional aspects of data and information security,” further stating that these will inevitably cause irreparable damage to UK users’ privacy.

“This does not appear to offer proportionate protection for this character of data, especially at the scale of millions of Britons in a handful of weakly-regulated, ‘homebrew’-secured, databases; we are thereby setting the stage for another ‘Ashley Madison’-like data breach, which in that case led to the suicide of several people because of the nature and sensitivity of the information leaked,” Muffet further noted. You can read more about the other concerns he raised in his Medium post.

The Society for Computers and Law (SCL) highlighed another high risk that comes with introducing age verification in pornography sites before the Digital Economy Act 2017 was abandoned: “It’s not only public figures who stand to suffer in the event of a large-scale porn data breach. The most marginalised members of society also have a lot to fear. The kind of sex we like to have, and fantasise about having, can have extraordinarily high stakes for those experiencing homophobia and transphobia. LGBTQ people who are not out to their families stand to lose their homes and their relationships; in the case of young or vulnerable people, this poses a very real risk to their survival. Being outed is also dangerous for members of the BDSM community—there are no laws protecting the rights of people into BDSM from discrimination, and in this country your private sexual practices can get you fired.”

The post Online Safety Bill will legally require porn sites to verify users’ age appeared first on Malwarebytes Labs.