By Matt Powell Published on 29 January 2018

From April adult web sites will be required to verify the age of visitors from the UK, or risk being blocked.

The controversial rule, part of the Digital Economy Act, is intended to prevent children accessing pornography. But many UK citizens still have no idea what’s changing or what they’ll be asked to give up in order to continue accessing legitimate content. And critics contest that it is invasive, potentially harmful and ultimately ineffective. It could also give parents a false sense of security while doing little to protect children online.

Once the law is implemented adult sites must verify the age of anyone from the UK to ensure they are over 18. Sites which do not cooperate could face a fine of up to £250,000, or be blocked by ISPs. The system is being overseen by the BBFC, who will have the power to order providers to block adult sites.

There’s a good chance this is all news to you. We recently surveyed 2,103 UK adults to ask their opinions about age verification and we’ve found that many people remain unaware of the impending changes.

Just 38% of respondents already knew about the age verification rule. However there does seem to be strong support for it - 48% say sites should verify, with a further 37% in agreement depending on the verification method.

But many of those who agree may change their mind when asked to sign up.

The age verification process is going to be far more stringent than simply asking a user to confirm they are over 18. In order to access many adult sites you are going to have to hand over personal information.

Although a majority are in favour of verifying age, it seems far fewer people in our survey would be happy to actually go through verification themselves. Only 19% said they’d be comfortable sharing information directly with an adult site, and just 11% would be comfortable handing details to a third party.

It’s being left to the industry to decide how to implement verification, but a leading contender is MindGeek’s AgeID. With AgeID users create an account then verify their age with a third party, where the options include using a passport, credit card or mobile phone.

This has enormous implications for our privacy and personal freedoms. AgeID and other verification systems are not only going to be responsible for storing masses of personal data, but they will have access to your browsing history. Every adult site visited will be recorded, allowing them to build profiles of your preferences. We are going to have to trust that this information will be kept confidential but it’s going to be a tempting target for hackers.

Speaking to Sky News, MindGeek insisted that AgeID is safe, saying it "has been built from the ground up with data protection, data minimisation and the principles of privacy by design at its core, whilst also complying with the GDPR". But this is unlikely to put many minds at ease. As we saw from the Ashley Madison hack this kind of data can have very serious consequences if it leaks into the public domain.

Lee Munson, security researcher at Comparitech.com, says that “a centralised repository of personal and financial information related to the visitors of such sites is quite simply a crazy idea as it will attract hacking bees as if the database is a huge pot of irresistible honey. Spoof verification websites, hijacked websites and phishing emails will multiply as soon as proof of age becomes mandatory.”

“When a user lands on an age authentication site they can hope that the page is protected by SSL and that it displays the correct certificates and that the data they transmit is not hijacked en-route. None of these options are entirely foolproof though and, I suspect, many visitors to porn sites will not be willing to take the time to make any checks anyway”.

Age verification is also problematic for adult site owners, driving up costs and putting further pressure on businesses which already operate on tight margins. And as people are unlikely to want to sign up for multiple verification services there is an opportunity for one company to dominate the market; there’s a good chance that will be MindGeek.

MindGeek already own a vast number of adult ‘tubes’ - including the single biggest porn site in the world, Pornhub. As well as using AgeID on its own sites it will charge others for the right to integrate AgeID. If AgeID becomes popular smaller companies will face a choice of using a less popular verification platform and potentially lose customers, or pay a fee to a business largely built upon the distribution of free pornography.

Unintended consequences

The government hopes to prevent young people from viewing pornography, but it may have other consequences.

Rather than deterring kids from accessing adult content age verification could drive them to smaller sites or filesharing services, where they may be at greater risk of encountering malware or highly illegal child abuse content.

It might also set the stage for censorship of the internet beyond pornography. “Once we have set up a system for blocking websites without court orders, it will be much easier to use it for other legal content – for example material that is legal but considered political" says Jim Killock, executive director of the Open Rights Group. "This could set a dangerous precedent, where political content is being censored without any recourse. Politicians have already discussed other kinds of material that ought to be banned because of the risks posed to children.”

And the entire endeavour may be ultimately pointless. Those who don’t wish to give up their private details to a porn site will either move to a service free of restrictions, or bypass site blocks and geographic restrictions with Tor or a VPN. And it remains to be seen how services like Twitter, Tumblr and Reddit - home to a huge amount of adult content alongside inoffensive material - will be treated.

Age verification may deter some casual browsers, but it seems unlikely to have the kind of impact that would justify the time and effort spent on what may turn out to be an ill conceived idea.