How will age verification for porn work and what about your data?

The way people in the UK access websites with pornographic material is about to undergo a significant change.

The Online Safety Act says sites must make it harder for under-18s to see explicit material – and Pornhub and other major adult websites have confirmed they will introduce advanced age checks by 25 July.

Media regulator Ofcom estimates 14 million people watch online pornography – and concerns have been raised about the privacy and security implications of them having to undergo more robust identity checks.

Age verification companies, who are likely to be employed, say people should be reassured because firms don’t retain data, and they don’t know what a person has accessed.

“The only non-hackable database is no database at all,” says Iain Corby, of the Age Verification Providers Association. Chelsea Jarvie, a cyber security expert, says society needs to be cautious about “normalising mass identification online”.

There are a number of ways an adult website may choose to verify a user’s age, and Ofcom has recommended seven methods. A website may allow a combination of them to give people choice. Let’s look at them.

How it works

You provide your credit card details and a payment processor checks if the card is valid.

What are the privacy issues?

Age verification firm Verifymy says when you carry out this check on its service, a two-factor authentication check and a mini transaction with no exchange of money takes place, similar to checking into a hotel.

“No personal data gets passed on to an adult platform in any way. It is simply a yes or no as to answering a question: is this individual over 18?”, said Andy Lulham, Verifymy’s chief operating officer.

The 5RightsFoundation – an online child safety charity – said credit card checks, along with the photo identification and digital identity verification methods, offered high levels of assurance especially when the data was well protected, but “carry significant privacy risks if not designed and managed appropriately”.

How it works

These include digital identity wallets, which can securely store and share information which proves your age.

What are the privacy issues?

Omari Rodney is the chief product engineer for Yoti.

He told BBC News once a document such as a passport was examined and verified, all parts of it were then separated and encrypted. The only person who could decrypt it was the individual.

“We can’t see that information unless we get permission from you,” he said.

Luciditi, another verification firm, said the user could choose to share a part of their identity – that they were over the age of 18.

Ms Jarvie, however, thinks digital wallets – along with open banking – “can feel disproportionate” as a method to prove you are over 18.

How it works

You provide your email address, and technology analyses other online services where it has been used – such as banking or utility providers – to estimate your age.

What are the privacy issues?

Verifymy are one of operators, and it told the BBC its research identified this as the method users would be most comfortable with.

Mr Lulham says the technology checks if an email has been used to interact with a range of websites such as financial institutions.

Verifymy said data could be kept for up to 28 days, but added it would often be less, would be encrypted, and no data would be shared with the website being accessed.

How it works

You show your face via photo or video, and technology analyses it to estimate your age.

What are the privacy issues?

A verification company would typically check if it is a human, only one person, and not a picture.

Yoti use an AI model to determine a person’s age.

While facial age estimation “can be accurate”, Ms Jarvie said her research indicated many people would not be comfortable using this method.

How it works

You give your permission for an age-check service to confirm whether or not your mobile phone number has age filters applied to it.

What are the privacy issues?

Yoti looks at who the bill payer is, and if it is an adult paying for a child’s phone – such as on a family plan. The mobile operator is asked to confirm the age of the person, but would not know which website they intend on accessing.

Verification company OneID has the user log into their digital ID via their phone number, with the mobile operator confirming if the person is over 18.

Verifymy said pay as you go numbers wouldn’t be compatible – users would need to have a phone contract.

How it works

You give permission for the age-check service to securely access information from your bank about whether you are over 18.

What are the privacy issues?

OneID uses this method if a user cannot verify they are over the age of 18 via their mobile operator.

While OneID does not see your transactions, your account number and sort code are shared with it during its one-off check – but the company says it does not keep any details.

OneID founder Rob Kotlarz accepts users may be reluctant to show their bank details so they can access an adult website.

“It is the right thing to protect children,” he told BBC News. “We are offering a simpler way of checking someone’s age. If it is simple and seamless, why wouldn’t you do it to protect the kids?”

How it works

You upload an image of an ID document that shows your face and age, and an image of yourself at the same time. These are then compared to confirm the document is yours.

What are the privacy issues?

As well as UK documents, Yoti would allow the user to upload some from outside of the UK.

Ms Jarvie believes photo ID uploads and credit card checks “feel outdated” and “highly intrusive”.