UK telecoms regulator Ofcom has laid out how porn sites could verify users\u2019 ages under the newly passed Online Safety Act<\/a>. Although the law gives sites the choice of how they keep out underage users, the regulator is publishing a list of measures they\u2019ll be able to use to comply. These include having a bank or mobile network confirm that a user is at least 18 years old (with that user\u2019s consent) or asking a user to supply valid details for a credit card that\u2019s only available to people who are 18 and older. The regulator is consulting on these guidelines starting today and hopes to finalize its official guidance in roughly a year\u2019s time.<\/p>\n<\/div>\n The measures have the potential to be contentious and come a little over four years after the UK government scrapped its last attempt<\/a> to mandate age verification for pornography. Critics raised numerous privacy and technical concerns<\/a> with the previous approach, and the plans were eventually shelved with the hope that the Online Safety Act (then emerging as the Online Harms White Paper) would offer a better way forward. Now we\u2019re going to see if that\u2019s true, or if the British government was just kicking the can down the road.<\/p>\n<\/div>\n \u201cOur research shows that pornography is all too readily accessible to children online today, and that children as young as eight and nine are accessing porn sites,\u201d Ofcom\u2019s online safety lead Gill Whitehead tells me in an interview. \u201cThe majority of those are coming across it accidentally and stumbling across it on the web.\u201d Ofcom\u2019s press release cites research that suggests nearly eight in 10 children have seen \u201cviolent pornography depicting coercive, degrading or pain-inducing sex acts\u201d before turning 18.<\/p>\n<\/div>\n Ofcom lists six age verification methods in today\u2019s draft guidelines. As well as turning to banks, mobile networks, and credit cards, other suggested measures include asking users to upload photo ID like a driver\u2019s license or passport, or for sites to use \u201cfacial age estimation\u201d technology to analyze a person\u2019s face to determine that they\u2019ve turned 18. Simply asking a site visitor to declare that they\u2019re an adult won\u2019t be considered strict enough.<\/p>\n<\/div>\n Once the duties come into force, pornography sites will be able to choose from Ofcom\u2019s approaches or implement their own age verification measures so long as they\u2019re deemed to hit the \u201chighly effective\u201d bar demanded by the Online Safety Act. The regulator will work with larger sites directly and keep tabs on smaller sites by listening to complaints, monitoring media coverage, and working with frontline services. Noncompliance with the Online Safety Act can be punished with fines of up to \u00a318 million (around $22.7 million) or 10 percent of global revenue (whichever is higher).\u00a0<\/p>\n<\/div>\n \u201cAge verification technologies for pornography risk sensitive personal data being breached, collected, shared, or sold\u201d<\/p>\n<\/div>\n<\/div>\n The guidelines being announced today will eventually apply to pornography sites both big and small so long as the content has been \u201cpublished or displayed on an online service by the provider of the service.\u201d In other words, they\u2019re designed for professionally made pornography, rather than the kinds of user-generated content found on sites like OnlyFans. That\u2019s a tricky distinction when the two kinds often sit together side by side on the largest tube sites. But Ofcom will be opening a consultation on rules for user-generated content, search engines, and social media sites in the new year, and Whitehead suggests that the both sets of rules will come into effect at around the same time. <\/p>\n<\/div>\n In practice, a tube site may choose to treat them the same. \u201cIf they have a mix of professional porn and user-generated porn, then they may wish from a practical perspective to apply this approach for everything,\u201d she says. Pornographic content that consists only of text is not covered by today\u2019s guidelines. <\/p>\n<\/div>\n A key complaint with the UK\u2019s last attempt to mandate age verification for pornography were the privacy concerns. But despite Whitehead\u2019s assurance that Ofcom worked with the UK\u2019s data protection regulator, the Information Commissioner\u2019s Office, to develop its guidelines, digital rights campaigners with the Open Rights Group (ORG) aren\u2019t convinced.<\/p>\n<\/div>\n \u201cIt is very concerning that Ofcom is solely relying upon data protection laws and the ICO to ensure that privacy will be protected,\u201d ORG program manager Abigail Burke said in a statement. \u201cThe Data Protection and Digital Information Bill<\/a>, which is progressing through parliament, will seriously weaken our current data protection laws, which are in any case insufficient for a scheme this intrusive.\u201d<\/p>\n<\/div>\n \u201cAge verification technologies for pornography risk sensitive personal data being breached, collected, shared, or sold. The potential consequences of data being leaked are catastrophic and could include blackmail, fraud, relationship damage, and the outing of people\u2019s sexual preferences in very vulnerable circumstances,\u201d Burke said, and called for Ofcom to set out clearer standards for protecting user data.\u00a0<\/p>\n<\/div>\n There\u2019s also the risk that any age verification implemented will end up being bypassed by anyone with access to a VPN. When I ask, Whitehead admits that there\u2019s no \u201csilver bullet\u201d when it comes to online safety. However, she says the measures are still worthwhile if they can help stop children from accidentally encountering adult content. \u201cI think the law and the duty of care on tech firms to keep users safe is part of a wider set of measures that includes education and includes parental conversations with children and all of these things can work together to really help keep children safe online,\u201d she says.\u00a0<\/p>\n<\/div>\n What remains to be seen is to what extent pornography providers will engage with the UK\u2019s age verification measures. Although Pornhub\u2019s owner Aylo (then known as MindGeek) complied with a Louisiana law requiring users to verify their ages with government ID<\/a> in January, it later blocked users from accessing its services entirely in other states that introduced similar rules like Mississippi, Virginia<\/a>, Utah<\/a>, and Arkansas<\/a>. Aylo did not respond to The Verge<\/em>\u2019s request for comment on the UK\u2019s Online Safety Act.<\/p>\n<\/div>\n<\/div>\n