The provisions in the UK's Online Safety Act for age-checking access to porn sites have been looming for quite some time – but are still likely to cause chaos when they start to bite.
Last week, British regulator Ofcom published draft guidance for website providers, which is expected to be finalized and brought into force early next year.
The guidance for sites and apps that display or publish pornographic content requires them to make sure that children are not normally able to encounter pornography on their service. They can do this using a range of techniques, including photo ID matching, facial age estimation, and credit card checks.
"We’re clear that weaker methods – such as allowing users to self-declare their age – won’t meet this standard," says Ofcom chief executive Melanie Dawes.
The guidance has clear implications for privacy. Campaign group Open Rights Group, for example, has pointed out that it risks sensitive personal data being breached, collected, shared, or sold, potentially resulting in blackmail, fraud, relationship damage, and the outing of people’s sexual preferences.
And this is far from scare-mongering: the risks of a data breach were highlighted when 'married dating agency' Ashley Madison was hacked in 2015. After the identities of over 30 million users were leaked, at least two people were reported to have committed suicide.
However, the problems with the new guidance go far deeper than that.
Many small websites fall in scope
For a start, the guidance is being pitched as applying only to porn sites - but this is very far from the case. Many operators of perfectly safe-for-work websites will be startled to discover that it applies to them too: in fact, it's required for any site, platform, or app that hosts user-generated content that young people could access.
The sites will have to evaluate the likelihood of minors using their site, conduct the required age checks, and block a range of content that goes way beyond pornography.
This includes violence against people or animals – including fictional animals – which presumably puts many popular children’s books beyond the pale.
It also covers bullying or abusive content, content that promotes dangerous stunts, and content that encourages people to consume a physically harmful substance or any substance in quantities that would be harmful.
There's also a great deal of record-keeping required, from monitoring content to carrying out regular risk assessments. Many providers are likely to try to cut the Gordian knot by wiping enormous quantities of content or simply removing their services from the UK altogether.
There's also the question of how accurate these age verification methods can be. While Ofcom describes them as 'highly effective,' they in fact consist of a hotch-potch of methods, some of which are easily bypassed: many children, for example, may have their parents' credit card details, while others will be perfectly capable of using a VPN.
How will the industry respond?
And it's unclear how those adult websites based outside the UK – which is most of them – will respond to the new rules.
States, including Utah, Louisiana, Virginia, Arkansas, and Mississippi, have introduced similar measures in the US. Pornhub responded by introducing age verification in Louisiana – but, it says, users simply moved to pirate, illegal, or other non-compliant sites that don’t ask visitors to verify their age.
"These laws have not only failed at protecting children but have introduced further harm by displacing traffic to sites with few or zero trust and safety measures," says the firm.
In other states, such as Virginia and Mississippi, the company has simply blocked its services altogether – something it might well choose to do in the comparatively small market of the UK.
The UK government has been here before – and taken a rather different approach, scrapping previous plans for age verification on porn sites back in 2018. The reasons then were given as the obvious risks to privacy, along with concerns that the plan gave too much power to the companies that were then to supply the age verification system. Not much has changed since.
Giacomo Lev Mannheimer, author of a report from the European Policy Information Center and the Institute of Economic Affairs, sums it up rather well, citing "politicians’ tendency to promise the impossible without fully understanding the dynamics of what they are trying to regulate and without giving sufficient consideration to the side-effects of the proposed solutions."
The saving grace for the government is that, given its low chance of winning the next election, it's unlikely to have to deal with the fallout.
More from Cybernews:
Subscribe to our newsletter