Porn sites will be legally required to verify users’ ages

Pornography websites operating in the UK will be legally required to verify the age of their users under new online safety rules, the government has announced.

The measures, which will be added to the government’s upcoming Online Safety Bill (OSB), would require all websites that publish pornographic content to put “robust checks” in place to ensure users are aged 18 or over.

The government has suggested this could involve using age verification technology to confirm the user has a credit card, or having a third-party service confirm their age against government data. However, the OSB does not mandate the adoption of a specific age verification solution or tool, putting the onus on companies to decide how they comply.

“It is too easy for children to access pornography online,” said digital minister Chris Philp. “Parents deserve peace of mind that their children are protected online from seeing things no child should see.

“We are now strengthening the Online Safety Bill so that it applies to all porn sites to ensure we achieve our aim of making the internet a safer place for children.”

Porn sites’ failure to act could result in fines of up to 10% of their turnover and their services being blocked in the UK by the online harms regulator, which was confirmed to Ofcom in December 2020.

As with the senior management of other tech firms, criminal liability for failure to supply Ofcom with information will be extended to the bosses of porn sites.

The announcement of the measure comes just days after the government added three new criminal offences to the OSB as well as a number of new “priority offences” that tech firms will be required to proactively seek out and minimise the presence of on their platform.

Terrorism and child sexual abuse were already included in the priority list of offences that tech firms must proactively deal with, but the government has now redrafted the bill to include revenge porn, hate crime, fraud, the sale of illegal drugs or weapons, the promotion or facilitation of suicide, people smuggling, and sexual exploitation.

The government previously attempted to put age blocks on porn sites through the Digital Economy Act 2017, but after numerous delays for a variety of reasons – including the technical feasibility of setting up a system to monitor millions of users and websites, and controversy surrounding the invasion of people’s privacy – the plans were ditched in October 2019.

The government has claimed that this new provision in the OSB goes further than the Digital Economy Act did by protecting children from a broader range of harmful content on a wider range of services. For example, the Digital Economy Act did not cover social media, where a considerable quantity of pornographic material is accessible, and which children may use to access pornography.

Julie Dawson, director of policy and regulatory at biometrics firm Yoti – which provides age verification and digital ID technologies – welcomed the announcement. “Age verification will help to protect children while complying with regulations from online safety regulators and it can be used to stop under-age access and sales, provide age-appropriate content moderation, deter grooming and prevent account swapping with automated checks ensuring the real account holder is active,” she said.

While welcoming the effort to protect children from the detrimental effect online pornography can have on their perceptions of healthy relationships, sex and consent, Jamie Akhtar, CEO and co-founder of CyberSmart, said the process may still result in security risks for adults.

“Data is the lifeblood of cyber crime and adding an extra step that requires the transfer of personal data for verification could well make adult sites a key target for criminals,” he said. “Of course, this risk is far outweighed by the potential benefits, but it is worth sounding a cautionary note and urging adults who use these sites to be as diligent as possible.”

Javvad Malik, lead security awareness advocate at KnowBe4, noted the government’s previous attempt to roll out age verification for porn sites, saying that while the intention behind the measures may be good, the execution is deeply flawed.

“Firstly, it will be a trivial matter for anyone intending to reach porn sites to do so,” he said, “whether that is by using someone else’s identity or simply by using a VPN to appear as if they are based in another country.

“Secondly, and perhaps more importantly, there is a huge overhead to collate, validate and store people’s sensitive information in order to access the content. History has shown us that such databases are nearly always prone to being breached at some point or another.”

In line with this, Brian Higgins, a security specialist at Comparitech, said it would not be difficult for people to circumvent the measures set out in the OSB. “Most people these days are aware of VPNs as they are recommended security measures for a lot of online activities such as working from home,” he said. “They are also growing in popularity as a measure to mask individual online searches and streaming.”

Higgins added: “Unfortunately, the internet is incredibly difficult to police. Any attempts to legislate or regulate domestically are usually met with obfuscation and/or relocation by the major platform providers, who have the resources to circumvent many of the proposed measures.

“They may well appoint UK ‘safety controllers’ to appease the regulators, but in effect, any attempt to enforce change or penalise inappropriate business practice will most likely fail.”