BBFC consults on age verification
There is a consultation now running on the age verification systems that will be put in place as part of the Governments measures to make the internet a safer place for children. The measures were set to actually have been in place in April 2018, but given the BBFC who are charged with monitoring and dealing with miscreants were only formally given their mandate on 21st February 2018 had not had time to set everything up and providers of age verification systems looking almost like vapourware at that time the early implementation was delayed.
We now have a situation where the BBFC has started a public consultation on its draft guidance for age verification systems and ancilliary service providers (e.g. social media apps). The consultation is open until 23rd April.
The most interesting aspect of all this is that if these measures are solely about protecting the children why is non commercial pornography exempt and what precisely is the definition of a commercial site, having adverts on a site appears to mean a site will count as commercial, as will free sites that are just a gateway to a paysite; but the situation around community ran sites with a donation system to just pay for server space are less clear. What is clear is that when it comes to policing the new system the largest sites are likely to be looked at first and for many smaller commercial or community run sites if they can avoid drawing attention to themselves they might be able to avoid the controls or at least wait and see how all the measures work in practice.
Age verification that will be acceptable under the new system will be more more than just a simple tick box saying you are over 18 or entering your date of birth. The BBFC explicitly calls out Debit, Solo or Electron cards as not being suitable for verification purposes and also says that other data elements such as name, address and date of birth are not suitable. Therefore the most likely sources of verification are credit cards, passport or mobile phone and one of the requirements is that verification providers need to guard against improper use by children, so it will be interesting to see how they guard against a 16 year old noting down a parents credit card details while at the same time retaining ease of use for end-users.
A lot has been said on Data Protection by opponents to the age verification system and the delay to implementation was fortunate particularly given the revelations about the way facebook data has been used thus highlighting how easy it is for the public to be tricked into sharing a lot more information than they expected, and the facebook/Cambridge Analytica episode vindicates a lot of the concerns of privacy groups over age verification.
Worries about the actual adult content provider learning who a member of the public and then being able to profile their content tastes and sexuality are largely being dismissed by age verification solutions since they are saying that data is only processed by them with a simple yes or no sent to the adult content site. Which sounds great, but with things like pay sites no doubt encouraging people to sign up with one time verification it is likely that where as millions access content anonymously for convience people may sign up and thus make profiling easier.
Another issue particularly now is whether the public will trust an age verification system that is actually owned by the adult content provider?
We hope that the BBFC in line with its commitment to be open and transparent will when issuing a block notice for a non compliant site or service add it to a list of all the notices so that the many worries about over blocking and the potential for blocking notices to be widened for politicial purposes can be mitigated. The notices we believe are not industry wide, but individual providers will be notified and given that other elements of the processes take into account the frequency of visits by children it looks like some smaller more business focussed providers may escape and avoid the extra costs involved in both dealing with the block notices and ensuring that blocking is over blocking.
The BBFC when the Age Verification is up and running will be monitoring the effectiveness and we hope that as part of this they will investigate whether traffic has simply shifted from http/https to being hidden within a VPN tunnel that avoids all the measures put in place for just UK visitors to sites. Additionally research will need to be undertaken to determine if if measures are being bypassed by under 18's sharing data that allows them to bypass the controls.