from the of-course-it-means-id-verification dept
Last week, Ofcom, the UK regulator in charge of all this stuff, released its “rapid assessment of highly effective age assurance at 16.” That came right on the heels of its quietly released (only because the law required it) report showing that the Online Safety Act’s duty of care wasn’t actually having any noticeable impact on kids’ access to “harmful content.”
Even as the Online Safety Act was being rolled out after years of debate, UK politicians started whining and screaming that they had to follow other countries towards banning kids from social media entirely. Ofcom is supposed to help put together a plan for such a social media ban by the end of the year, with implementation set for next spring. As part of this, Ofcom was tasked with reviewing the state of technology that can determine whether someone is under or over 16, and in doing so basically confirmed what many activists have been pointing out all along: if you’re putting an explicit age limit on social media, you are requiring kids to hand over private information and put themselves at risk.
The report includes this handy chart, which basically notes that if you’re trying to determine if someone is between the age of 16 and 18, you’re really talking about having them hand over private information:
That first column on the left is the telling one. That’s the one that says there are only four(ish) “highly effective” means of doing age assurance… and basically all of them are actually “send private info to a company.” The first two are obvious: uploading a photo ID or banking info, both of which are incredibly risky, especially since you’ll be uploading them to companies which are clear targets for hackers. The third one is really the same thing, because even as “digital identity services” are coming online with the goal of doing the ID part as a third party and then issuing some sort of “old enough” / “too young” token, those services are still getting that information via the uploading of private info.
But it’s the last one that’s the funniest. For years, age verification providers have insisted that no one would have to upload private info, because they could estimate your age just based on scanning your face. But we’ve always called bullshit on that. Such scanning may be able to tell the difference between a 50-year-old and a 15-year-old but it’s effectively useless for determining the difference between a 15-year-old and a 17-year-old.
And Ofcom kinda admits that. It still lists facial age estimation as “highly effective,” but only with that parenthetical caveat. And the full paper concedes that the technology falls apart for exactly the kids closest to the age line:
The margin of error for facial age estimation becomes more significant for the ages closest to the target age gate (16 in this case). For example, if the facial age estimation algorithm is accurate within two years for children aged 15, it could estimate them as aged 17. This could result in significant numbers of children under 16 gaining access to services or functionalities that are restricted. It could also result in a 17-year-old being denied access if they are estimated to be 15, unless they use another method. However, this is only likely to affect users who are close to the target age, as most adults offered this method would be estimated to be clearly above 16.
So, yes, if you’re much older, perhaps a facial scan gets you onto a website without uploading your ID. But if you’re anywhere near 16, you’re basically out of luck, because Ofcom’s fix for the margin of error is to kick anyone who looks young-ish over to a different method… and a different method is always going to be “upload an ID.”
In order to account for the margin of error in a facial age estimation algorithm, services should implement a ‘challenge age’ (sometimes known as a ‘buffer age’). A challenge age approach is widely used in an offline context when selling age-restricted products like alcohol in retail environments, for instance, through the retailing strategy ‘Challenge 25.’ In this approach, anyone who appears to the provider of restricted products to be under the age of 25 should be challenged to provide acceptable ID proving that they are over the age of 18 if they wish to buy alcohol.
Of course, requiring kids to upload their photo IDs or banking info is going to be difficult given that many kids… don’t actually have photo IDs or banking info at age 16. Ofcom argues that 89% of 16-year-olds have a passport while 19% have a provisional driving license. But passports also aren’t the kind of ID that kids regularly have at the ready any time they’re reaching an internet service. Perhaps I’m out of touch with the youth of the UK, but I’d be surprised to find many of them regularly have passports at arms length most of the time.
The likely result is forcing more kids to get IDs at younger ages than they would otherwise need them, again creating privacy questions for those kids. Either way, teenagers are in for a lot of “your papers please!” and Ofcom says so pretty directly:
Our preliminary assessment suggests that 16- and 17-year-olds are more likely than users of other ages to need access to a photo ID document. Of the methods listed as capable of being highly effective at 16, a photo ID will likely be needed at some point in the process. This is either because the method itself requires a photo ID, because ownership of a photo ID is part of the underlying process for accessing another method (such as opening a bank account or using a digital identity service), or because a 16- or 17-year-old will most likely fall within the challenge or buffer age for facial estimation methods and be asked to prove their age with a secondary method.
In other words, what UK politicians (and plenty of “child safety activists”) are demanding here is that a bunch of kids have to give up their privacy and hand over documents that can put them at risk. For their safety. At a time when there remains little to no evidence that barring kids from internet services will actually improve their safety.
Filed Under: age verification, highly effective age verification, protect the children, social media bans, uk
Companies: ofcom
——————————————————–
Click Here For The Original Source.
