Think of the children?

Why online age verification is the worst of both worlds

By IEA Programmes Manager Matthew Prescod

While most people would probably agree that individuals should be free to consume adult entertainment even if others find it morally objectionable, few would argue that children should have access to such material. Before the advent of streaming services, no minor would have been able to waltz into a Blockbuster and rent an 18-rated film, so why should those safeguards not apply in the online space? Additionally, there is evidence, albeit preliminary and tentative, that adult content can cause harm to young minds. Present research suggests that exposure at a young age can normalise sexual harm, shape misogynistic attitudes, and lead to addiction. British legislators are resolute that online age verification is the solution to safeguard minors from adult content. However, the risk to civil liberties is significant, and the effectiveness of such measures is highly doubtable.

As stipulated in the Online Safety Act, ushered in last year with support from both the Conservatives and Labour, websites hosting adult content will need to verify the age of every user who visits their site. This technology is not unprecedented and has use in other sectors. For instance, the e-cigarette manufacturer Juul verifies the age of its online customers using a mix of photo upload assessed by AI, personal details checked against public and commercial records, or the upload of government-issued ID. Credit bureaus like Experian have extensive repositories of customer information that, for a pretty penny, can confirm whether a user is of age. So, if providers of adult content had to start doing this too, what’s the problem?

On the civil liberties front, age verification for adult websites is a looming privacy disaster. As the previous example demonstrates, the most effective forms of online age verification currently out there compromise any customers’ anonymity by requiring users to upload personal information. Regardless how short a time this information stays on a particular computer server, it leaves a trace. A customer database of nicotine addicts is far from a lucrative target for hackers, but the same cannot be said for a database of pornographic website purveyors. An optimist who believes online age verification could be implemented well, or a social conservative who cares little for the privacy of libertine citizens, might say this is only a hypothetical concern. Recent experience shows that these sites are already targets for cybercriminals.

Back in 2015, the data of extramarital affair website of Ashley Madison was hacked and user details were publicly released, exposing 37 million members. One year later, hackers stole details of 63 million users of a major webcam pornography website. Data breaches are common fare for any firm with an online presence. In fact, in the last year alone, major names like Ticketmaster and the BBC have also been victims of significant breaches, highlighting that even well-established, non-adult platforms struggle to safeguard user data. If adult content providers operating in the UK implemented online age verification, their platforms and age verification vendors would overnight become even more lucrative targets for cyber criminals and state-sponsored hacking groups.

Beyond the glaring privacy risks, the sheer impracticality of online age verification is another major regulatory failure waiting to happen. Since 2023, a series of US states started enacting ‘porn’ bans which mandate providers of adult content to implement age verification mechanisms on their websites. In response, rather than going along with the requirements, adult content vendor Aylo pulled the plug, suspending access to its websites for visitors with IP addresses from affected states. The immediate aftermath of the ban was not a drop in visitors to these sites, but a gargantuan surge in Virtual Private Network (VPN) usage.

VPNs allow their users to access the internet privately by rerouting their traffic through a different location, improving anonymity and facilitating the evasion of censorship. According to VPNmentor, demand in Utah skyrocketed by 967% following the state’s ban in 2023. Additionally, ExpressVPN provided data to Newsweek showing increased usage in the weeks following similar bans in other states. This is not just an American phenomenon. In Thailand, which outright banned all adult websites in 2020, one VPN vendor cited a 644% surge in installs. As IEA authors have long argued, prohibitionism of all kinds usually fails.

Unless the UK wishes to go follow the path of authoritarian states, where the usage of VPNs and other privacy tools is heavily regulated, there is nothing to stop adolescents using easily available software to circumvent online age verification measures.

I realise that this may sound like I am trying to have it both ways: on the one hand, age verification is a major civil liberties infringement; on the other hand, it is easily circumvented, and therefore largely ineffective anyway. It cannot be both, right? If it is so easy to circumvent, it cannot be much of a privacy risk.

But it very much can be both – just for different subgroups of the population. Simply put, the more tech-literature ones will get around it, while the less tech-literature ones will risk having their personal details exposed.

The people this policy is meant to protect are, of course, overrepresented in the former group. A YouGov poll earlier this year found that 53% of Brits aged 16-24 have used a VPN before, while only 37% of those aged 55+ have. NordVPN published a report which noted that most of their UK users are from Gen-Z. The horse has already bolted the stable, ensuring that any attempts at control will prove futile.

At this point, arguing that online age verification will effectively shield children from adult content is a difficult sell. Politicians from both major parties are unwittingly advancing a policy that does not only risk jeopardising the privacy of the over 14 million Brits who regularly access such content, but that is also remarkably easy to circumvent. Instead of safeguarding the young, this policy ironically gives them every incentive to master the art of evading censorship.

Considering these challenges, and the risks of getting it wrong, policymakers should explore alternatives that can improve protections for children whilst avoiding the pitfalls of online age verification. One such solution, device-level verification, could offer a more effective means of protecting children without drastically compromising the privacy of ordinary adults. Children deserve better than the non-solution currently hawked by politicians, and wider society should not have to endure a digital panopticon.