Online Age Verification Is Not the Same as ‘Flashing Your ID at a Liquor Store’

June 20, 2024

Several states have enacted laws that require visitors to sites with “material harmful to minors” to verify their age, usually by uploading a government-issued ID, submitting a facial scan or other biometrics, or allowing a third party to verify identity via a credit bureau or other database. While these policies are ostensibly designed to prevent children from viewing age-inappropriate adult content online, opponents claim they obstruct the right to free speech granted by the First Amendment and have a constrictive effect on adults’ ability to access legal content.

Proponents of the laws maintain that uploading one’s ID to access content online is no different than flashing your ID at the liquor store cashier. However, research suggests this is not the case. Specifically:

• In-person ID checks do not store the individual’s data in a database
• Sharing personally identifying information over the internet can allow third parties access to the information en route and at the destination.
• Even programs that endeavor to protect users’ private information admit the potential for hacking or data breaches.¹
• The process of uploading an ID or undergoing other verification processes is often difficult and complicated, and the loss of anonymity may work to dissuade adults from accessing legal content.

Obviously, these concerns are not a risk at liquor stores where no record is kept that includes the actual ID. Further, tying one’s ID to sensitive, sexually explicit content creates the risk of exploitation and extortion that does not exist in the liquor store analogy. Lastly, purchasing liquor is not a constitutionally protected activity, while viewing adult content is protected by the First Amendment.

Protecting children from age-inappropriate material online is important. However, when laws and regulations significantly burden adults’ access to otherwise legal ideas, information, art, and entertainment, they effectively function as censorship.

Myth 1: Is age verification easy and seamless?

Proponents of age verification laws claim that online age verification is an easy, seamless process.

The most common method of age verification requires the visitor to a site with “material harmful to minors” to upload their government ID, such as a passport or driver’s license, through a third-party system to confirm they are who they claim to be and are over the age of 18. While this approach is the most likely to provide true and accessible age verification, it is also the most likely to lead to data breaches, intrusion on privacy rights, and a burden on accessing constitutionally protected speech.²

All other debates about the security risks and privacy concerns of age verification aside, the actual age verification process can be difficult and time-consuming. Following the passage of Utah’s age verification law, one journalist attempted to comply and found that some age verification processes took over 50 steps to establish identity. They also encountered invasive and potentially dangerous protocols, including platforms that required the user to share access to their camera, submit a facial scan, or even identify their individual kinks and what type of pornographic content they like to view before being approved to continue.³

Others have faced different challenges. Following the enactment of Louisiana’s age verification law, Act 440, military veteran Elizabeth Henson found that she couldn’t access certain sites in Louisiana because she didn’t have a Louisiana driver’s license — she was only there as a temporary resident, as her partner had been transferred there for the Coast Guard. Because the state’s verification required a Louisiana ID, she was barred from access.⁴

The age verification process also involves risks not present when showing an ID to a clerk or bouncer. Concerns about security, phishing, exposure, and hacking are enough to dissuade large numbers of visitors from accessing those sites. One platform, JustFor.Fans, said that fewer than 5% of visitors have been willing to comply with the age verification process, an experience echoed by other platforms that have attempted to comply.⁵ In research at France’s Ecole Polytechnique, Professor Olivier Blazy found that just 1.7% of consumers were willing to proceed with age verification on adult sites, even with the promise of free content.⁶

When these laws go into effect, many people — those without a government ID, those without a decent webcam or scanning device, and those who may be closeted or fearful of exposure — are locked out of large portions of the internet and denied their First Amendment right to access speech. These restrictions, unfortunately, fall most heavily on already marginalized populations.

Myth 2: Is the age verification process secure?

Legislators and advocates for age verification claim that the verification process is secure, pointing to language in the laws that regulates how much data can be collected and how long it can be retained and outlines stringent security requirements. Unfortunately, research suggests that these protections fail to achieve their stated goals.

Research shows that current age verification systems fail to accurately identify consumers’ ages without compromising their privacy or security. To ensure accuracy, age verification requires proof of identification through documents, facial recognition, or both. However, there is currently no technology that ensures total privacy and security of this data.^{7 8 9}

Third-party age verification providers are often utilized in an attempt to offset this risk and to prevent sites that require verification websites from saving or sharing users’ information. This means individuals need to upload their identification documents and risk the associated privacy breaches.¹⁰ However, third-party providers are not automatically more secure. Some promise that the data is immediately deleted from their system, while others retain the individual’s data but commit to keeping it safe.¹¹ Neither promise, however, ensures immunity from data breaches or hackers.

More so, age verification processes that link one’s identity with a record of their sexual preferences obtained via their browsing history risk nefarious actors blackmailing or extorting users who want to protect their anonymity.

Unfortunately, there have been several cases in which data breaches led to users’ personal information being leaked despite commitments to keep consumer data safe. For example, Louisiana has relied on a third-party age verification app to compare a user’s ID to their profile in the Louisiana Office of Motor Vehicles (OMV). Months after the law went into effect, the OMV suffered a major data breach (though, luckily, no visit information was revealed).¹² In 2015, when “affair” site Ashley Madison was hacked, millions of users were exposed, and thousands were estimated to have been extorted. At least two committed suicide — despite the site website having reported using proper encryption techniques to protect customers.¹³

Experts fear that such breaches may become more common with the rise of age verification. Some cases of data breaches have resulted in consumers being blackmailed over the type of pornographic content they consume. In 2020, the FBI ranked exposure threats related to porn as one of the top three internet scams. One 18 year old hacker in England made over $850,000 by blackmailing porn users to pay or have their sexual interests exposed.¹⁴

International governments have raised concerns about the security of age verification systems.

• A national law in the UK aimed to implement similar age verification has been found to be largely ineffective at guaranteeing citizens’ privacy and faced similar issues related to data breaches and overall effectiveness.¹⁵
• France’s data protection agency, the Commission Nationale de l’Informatique et des Libertés, said it was unable to identify a third-party service that accurately verifies age while respecting the privacy and security of users.¹⁶
• A review of the age and identification verification system in the EU likewise found that third-party verifiers largely fail to offer security and respect users’ privacy, noting that far more development and research in the field is needed to adequately protect children from viewing pornography without infringing on users’ security.¹⁷
• In Australia, an eSafety commission tasked with implementing an age verification law found such extensive issues with privacy and security with current age verification technology that the plan was scrapped. Instead, the country’s eSafety commissioner said it would work with the tech industry to develop code that educates parents on filtering software and limit children’s access to age-inappropriate content.¹⁸

Policy Suggestions

• Increase awareness and access to and development of device-level age restrictions. Device-based filters are a more effective solution that doesn’t compromise the privacy of consenting adults. Parental controls are much harder to bypass and can not be evaded with a VPN.¹⁹
• Educate lawmakers regarding the risks and burdens of mandatory age verification and the significant constitutional concerns.

References

1. Yar, Majid. “Protecting Children from Internet Pornography? A Critical Assessment of Statutory Age Verification and its Enforcement in the UK.” Policing 43, no. 1 (2020): 183-197. doi:https://doi.org/10.1108/PIJPSM-07-2019-0108.

2. Yar, Majid. “Protecting Children from Internet Pornography? A Critical Assessment of Statutory Age Verification and its Enforcement in the UK.” Policing 43, no. 1 (2020): 183-197. doi:https://doi.org/10.1108/PIJPSM-07-2019-0108.

3. Cole, Samantha. “Accessing Porn In Utah Is Now a Complicated Process That Requires a Picture of Your Face.” Vice. May 3, 2023.
https://www.vice.com/en/article/z3mnqx/utah-age-verification-pornhub-xhamster-laws

4. Schwedel, Heather. “The Porn Patriot.” June 25, 2023. Slate. https://slate.com/human-interest/2023/06/louisiana-porn-id-age-verification-act-440.html

5. Poleo, Germania Rodriguez. “Is this the end of internet porn? Pornhub pulls out of Utah over a strict new law – and dozens more states may be affected… Now DailyMail.com lays bare the $100 BILLION war over online erotica.” The Daily Mail. May 5, 2023.
https://www.dailymail.co.uk/news/article-12043365/Is-end-internet-porn-Pornhub-pulls-Utah-100B-war-online-erotica.html

6. Stanford Cyber Policy Law Center. (2024, May 7). Online Age Verification and Privacy Protection: An Impossible Equation? [Video]. Youtube. https://www.youtube.com/watch?v=OkE5EwuLV9o

7. Weissman, Shoshana. “The technology to verify your age without violating your privacy does not exist.” RStreet. May 16, 2023 https://www.rstreet.org/commentary/the-technology-to-verify-your-age-without-violating-your-privacy-does-not-exist/

8. Lively, Taylor K. “Facial Recognition in the United States: Privacy Concerns and Legal Developments.” AsisOnline. December 1, 2021. https://www.asisonline.org/security-management-magazine/monthly-issues/security-technology/archive/2021/december/facial-recognition-in-the-us-privacy-concerns-and-legal-developments/

9. Roth, Emma. “Online age verification is coming, and privacy is on the chopping block.” May 15, 2023. TheVerge.
https://www.theverge.com/23721306/online-age-verification-privacy-laws-child-safety

10. Kelley, Makena. “Child Safety Bills Are Reshaping the Internet for Everyone.” TheVerge. August 29, 2023. https://www.theverge.com/2023/8/29/23849375/kosa-child-safety-free-speech-louisiana-utah-parental-consent

11. Yar, Majid. “Protecting Children from Internet Pornography? A Critical Assessment of Statutory Age Verification and its Enforcement in the UK.” Policing 43, no. 1 (2020): 183-197. doi:https://doi.org/10.1108/PIJPSM-07-2019-0108.

12. Finn, James. “Here’s what to know three weeks after massive data breach hit Louisiana’s OMV.” The Times-Picayne. July 9, 2023. https://www.nola.com/news/what-to-know-weeks-after-huge-data-breach-at-louisiana-omv/article_a3fbf162-1cff-11ee-a898-4f965b21693a.html

13. Matthews, Lee. “Apparent xHamster Hack Puts 380,000 Users In Compromising Position.” Forbes. November 29, 2016. https://www.forbes.com/sites/leemathews/2016/11/29/apparent-xhamster-hack-puts-380000-users-in-compromising-position/?sh=667191985951

14. Dearden, Lizzie. “Hacker who blackmailed porn users into handing him money after they clicked on his pop-up adverts jailed.” Independent. April 9, 2019.
https://www.independent.co.uk/news/uk/crime/porn-hacker-blackmail-zain-qaiser-trial-prison-sentence-a8861236.html

15. Yar, Majid. “Protecting Children from Internet Pornography? A Critical Assessment of Statutory Age Verification and its Enforcement in the UK.” Policing 43, no. 1 (2020): 183-197. doi:https://doi.org/10.1108/PIJPSM-07-2019-0108.

16. Weissman, Shoshana. “The technology to verify your age without violating your privacy does not exist.” RStreet. May 16, 2023 https://www.rstreet.org/commentary/the-technology-to-verify-your-age-without-violating-your-privacy-does-not-exist/

17. Crepax, Tommaso, Victor Muntés-Mulero, Jabier Martinez and Alejandra Ruiz.
“Information technologies exposing children to privacy risks: Domains and children-specific technical controls.” Computer Standards & Interfaces 82, (2022): 103624. https://doi.org/10.1016/j.csi.2022.103624.

18. Taylor, Josh. “Australia will not force adult websites to bring in age verification due to privacy and security concerns.” The Guardian. August 30, 2023. https://www.theguardian.com/australia-news/2023/aug/31/roadmap-for-age-verification-online-pornographic-material-adult-websites-australia-law

19. Cole, Samantha. “Accessing Porn In Utah Is Now a Complicated Process That Requires a Picture of Your Face.” Vice. May 3, 2023.
https://www.vice.com/en/article/z3mnqx/utah-age-verification-pornhub-xhamster-laws

 

Download PDF