Online porn to have age-restricted access enforced from 15 July this year

News by SC Staff

Age-verification arrangements should only be concerned with verifying age, not identity say the UK government as it brings in mandatory restrictions on access to online pornography.

By Summer this year the UK will become the first country to enforce mandatory age-verification for online pornography, the Department for Digital, Culture, Media and Sport (DCMS) announced today.

From 15 July 2019 pornography sites must check the age of users or risk facing sanctions, as the DCMS seeks to put the same protections in place that exist offline. Commercial providers of online pornography will be required by law to carry out robust age-verification checks on users, to ensure that they are 18 or over.

Users won’t be able to just type in their date of birth or tick a box. Age-verification options range from the use of traditional ID documents online (eg credit cards or passports) to mobile phones where the adult filters have been removed. Users can also use digital IDs or buy a card over the counter in a shop where the verification is face to face.

According to a government statement issued today, the move is backed by 88 percent of UK parents with children aged seven to 17. It does not report the numbers who disagree with the proposals, but previous moves have been opposed by privacy advocates and others who voice concerns about the security of data obtained.

Websites that fail to implement age-verification technology may have payment services withdrawn or be blocked for UK users by the British Board of Film Classification (BBFC) which will begin enforcing compliance with the new laws on 15 July, following an implementation period to allow websites time to comply with the new standards.

In the press statement the Minister for Digital, Margot James, said: "Adult content is currently far too easy for children to access online. The introduction of mandatory age-verification is a world-first, and we’ve taken the time to balance privacy concerns with the need to protect children from inappropriate content. ...Government has listened carefully to privacy concerns and is clear that age-verification arrangements should only be concerned with verifying age, not identity."

Consumers can chose between age-verification providers, and to inform their choice, the BBFC has created a voluntary certification scheme, the Age-verification Certificate (AVC), which will assess the data security standards of AV providers; certified age-verification solutions passing an independent assessment will carry the BBFC’s new green ‘AV’ symbol. Details will also be published on the BBFC’s age-verification website, ageverificationregulator.com. The options are likely to come under very heavy scrutiny from privacy advocates, and it would not be surprising if they were a hacking target from those wishing to prove a point regarding entrusting others with our data.

BBFC chief executive David Austin said: "Age-verification will help prevent children from accessing pornographic content online and means the UK is leading the way in internet safety." The development follows last week’s publication of the Online Harms White Paper which set out responsibilities for tech companies to keep UK citizens safe online, how these responsibilities should be met and what would happen if they are not.

The BBFC was designated in February 2018, public consultation on the guidance was held from March - April 2018, Guidance was laid in parliament in October 2018, and debated and approved in December 2018. More details on on how age-verification for online pornography arrangements will work can be found here.

Childnet chief executive Will Gardner said: "We hope that the introduction of this age-verification will help in protecting children, making it harder for young people to accidentally come across online pornography, as well as bringing in the same protections that we use offline to protect children from age-restricted goods or services."

Gus Tomlinson, head of strategy at GBG emailed SC Media UK to comment: "Age verification is much bigger than just pornography. There is a pressing need to ensure we are protecting children from accessing all types of inappropriate online services or content, whether it’s purchasing knives or signing up to a dating app or social media site, without locking them out of the internet altogether."

"The challenge for the adult industry specifically is to strike the right balance between protecting underage Internet users, whilst not deterring regular visitors who might naturally be wary of sharing personal information in exchange for content access. The regulator faces an unenviable long-term challenge, but the new rules are a step in the right direction."

Andrew Glover, the chair of the Internet Services Providers’ Association added: ""ISPA supports the Government’s commitment to protecting child internet safety, and our members have long been at the forefront of online safety.

"The new age verification measures are targeted at online pornography providers and are intended to prevent children from stumbling onto sites that contain commercial pornographic material. ISPs have an enforcement role in this policy to block websites that do not comply with these regulations and it is important to clarify that ISP blocking will only be used as a last resort. Our members are expecting high levels of compliance from online pornography providers, and it is the role of the regulator, the BBFC, to ensure that these sites remain committed to age verification.

"Age verification represents a significant change to online content regulation. It is therefore important that this new policy is introduced sensibly and proportionately and that the public’s expectations are managed effectively. Our members will work collaboratively with the BBFC, providing constructive input to ensure that any challenges are swiftly addressed and the implementation of the regime is as effective as possible."

So how will it work in practice? As an example, on 3 April the UK saw what was described as the largest test of an age verification software at the end of the Channel 4 TV show - ‘Mums make porn’. Viewers were presented with AgeChecks verification system before being allowed access to the content and the test was described by its organisers as a "massive success and a very promising development ahead of the new ban."

Digital age gates were placed on "I Want Fourplay," an adult film created during Channel 4’s shooting of the documentary "Mums Make Porn." The film was directed by five mothers who sought to draw attention to the negative impact that easy-access pornography has on children’s mental wellbeing.

The three-part show had more than 850,000 viewers in the UK, with the film available to watch after the final episode last night (3rd April 2019.)

Viewers were required to authenticate their age as over-18; as will be mandatory once age verification legislation is implemented. The process was supported by age verification software provider, AgeChecked.

The system worked by age-verifying customers through a driving licence, credit card or mobile phone - the latter of which emerged as by far the most popular method of verification. It then provided them with a unique username and password. The external film website only received a ‘pass’ or ‘fail’ message - nothing more – whilst users that did not meet the age requirements were denied entry.

In the system used, AgeChecked’s software does not stores personal information on its users and credentials are anonymised, so personal data cannot be passed on to the adult website in question – or indeed anyone.

Alastair Graham, CEO of AgeChecked, said: "The results of this first mainstream test of our software were hugely encouraging. (It) suggests a clear preparedness to offer robust, secure age verification procedures to the adult industry’s 24 to 30 million UK users.

"It also highlights that customers are willing to participate in the process when they know that they are being verified by a secure provider, with whom their identity is fully protected.

"The popularity of mobile phone verification was interesting and presumably due the simplicity of using this device. This is something that we foresee as being a key part of this process moving forward."

Rudd Apsey, a spokesman for the Age Verification Providers Association (AVPA) said: "There have been a number of negative stories lately about the so-called ‘porn ban’ in the UK. This test demonstrates that the age verification measures required under the Digital Economy Act can be successfully applied to adult websites without issue – verification of adults can be quick and anonymous. It is worth remembering that the goal of this legislation is to protect young kids from stumbling across adult content - the UK is leading the world in the introduction of online child protection measures."

Of course the entire process will be targetted by criminals, as John Fokker, head of cyber investigations at McAfee notes: "It is important that the implementation of these robust age verification checks are done diligently, as it is likely that cyber-criminals will target users by creating fraudulent age verification processes to cash-in on unsuspecting Brits.

"As it stands, some websites ask for age verification through the means of asking users to input sensitive personal information, including credit card details. And this is the perfect ploy for cyber-criminals to take advantage, encouraging users to unknowingly hand over their card details and give direct access to all kinds of personal information, including card numbers, home addresses and online passwords.

"A censored internet will force users to circumvent the enforced controls. On the hunt for the content they want, it is likely they will search in even more dangerous places online. It’s paramount that people take responsibility to check the authenticity of websites before sharing any personal information. Once submitted, people must keep a close eye on their bank account history because all-too-often criminals get away with their fraudulent activity for quite some time before anyone realises."

There was no coverage in the trial or the government statements regarding potential use of VPNs, the use of Tor or other means of circumventing the restricitons, nor did they address the issue of potentially driving people on to the dark web - and greater illegality. 

Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews

Interview - Everyone has an Achilles heel: The new security paradigm

How can we defend networks now that the perimeter has all but disappeared?
Brought to you in partnership with ExtraHop