Porn site age checking rules 'could put people at risk of scammers'
Websites that host adult content, including social media sites, will have to implement age verification systems in the coming months, but experts have warned that they could put the public at risk of scams and data breaches.
Sites will have to use systems such as bank or credit card checks, digital identity services or facial age estimation apps to verify the age of users, according to the new laws outlined in the Online Safety Act.
Ofcom said earlier this month that sites which host pornographic content "must begin taking steps immediately" to implement their age verification systems with a final deadline set for July.
However, some experts have told Yahoo News that they are concerned the new rules could put people’s data at risk and leave some more susceptible scammers - especially when it concerns an individual's porn habits.
Companies that fail to comply face fines of £18 million or 10% of worldwide revenue, whichever is greater, and potential criminal penalties for managers who fail to ensure companies follow the new rules.
What is adult content?
Adult content refers to pornographic content on websites and social media.
Under the Online Safety Act, any service which allows access to pornographic content is required to introduce age checks, which cannot simply take the form of asking users if they are over 18.
The idea, according to Iona Silverman, an intellectual property lawyer at Freeths, is to put a range of new duties on social media companies and search services, making them "more responsible for their users’ safety on their platforms".
On 16 January Ofcom announced that all platforms that publish pornographic content must take steps immediately to introduce “robust” age checks.
Separately, under the act, online services including social media firms, search engines, messaging, gaming apps, dating apps, pornography websites and file-sharing sites will have to adopt 40 measures to protect users from illegal content online.
Ofcom says Illegal content includes “terror, hate, fraud, child sexual abuse and assisting or encouraging suicide”.
What sites will it affect?
The affected sites include not only sites which produce pornography but also sites which allow users to upload it (such as Pornhub), as well as search engines and social media sites which offer access to pornographic content.
Under Ofcom’s new rules, sites which allow AI generation of pornographic images are also required to use age checks.
Sites such as social media services will have to ascertain whether they are being accessed by children by April, and then carry out a risk assessment before introducing measures to protect children.
Ofcom says: “They will need to implement measures to protect children on their services, in line with our Protection of Children Codes to address the risks of harm identified.
"These measures may include introducing age checks to determine which of their users are under 18 and protect them from harmful content.”
Ofcom chief executive Dame Melanie Dawes said on Thursday: "For too long, many online services which allow porn and other harmful material have ignored the fact that children are accessing their services.
"Either they don't ask or, when they do, the checks are minimal and easy to avoid. As age checks start to roll out in the coming months, adults will start to notice a difference in how they access certain online services. Those companies that fail to meet these new requirements can expect to face enforcement action from Ofcom."
How could it work?
Ofcom has said that methods of assessing age such as self-certifying that someone is 18 or requiring a debit card payment are not enough.
The methods it suggests include:
Open banking (ie checking via someone’s online bank account).
Photo ID matching, facial age estimation (ie using apps which guess someone’s age).
Age checks via phone networks, credit card checks, email-based age estimation and digital identity services.
Why might it put some people at risk?
Requiring users to input personal data such as banking or credit card details could put the public at risk of scams and data breaches, experts have warned.
Privacy campaigners Open Rights Group (ORG) have suggested that the measures could put site users at risk of scammers.
ORG told Yahoo News: "We’re concerned about any method that could put people’s data at risk - methods such as providing official documents to match to photos, giving people access to your inbox for email-based age estimation, or even the sheer volume of credit card verification.
"Other than existing data protection law, there is no regulation of how that data is processed and stored. And this data is incredibly sensitive if it can be linked to porn habits."
They added that some of the verification methods that Ofcom has defined as highly effective "could put people at risk of new cybercrimes".
“The roll-out of age verification is likely to create new cybersecurity risks," they said. "This could take the form of more scam porn sites that will trick users into handing over personal data to ‘verify their age’.
“There needs to be a specific and enforceable guarantee that AV systems will be private, safe and secure. The new plans miss this vital step, so place people at risk of data leaks, and having their sexual interests exposed to blackmailers and scammers.
“Ofcom’s announcement comes at a time when the government’s Data Use and Access Bill will weaken our data protection rights. This is a concern as the Information Commissioner’s Office (ICO) already has a poor record when it comes to enforcing data protection laws.”
Other experts have suggested the new rules do not go far enough.
Silverman described the move as a "welcome step in the right direction" but raised concerns as to how the new rules will be policed.
"We know from the Advertising Standards Authority’s 100 children report, that children lie about their age online in order to access social media. Consequently, they are exposed to adverts for age-restricted products or services such as alcohol or gambling.
"Sophisticated technology will be required to ensure children are protected, and we will need to see rigorous enforcement by Ofcom. My view is that this does not go far enough.”
Yahoo News has approached Ofcom and the ICO for comment.
