In just a couple of days, many online platforms in the United Kingdom, including social media, dating apps, and sites with user-generated content, must verify users are over 18. These age checks are primarily aimed at adult websites, but they’re not the only platforms planning to add age checks.
Other platforms such as Reddit and Bluesky have already started implementing these checks. Now, the Open Rights Group is calling for providers of age verification to be regulated to ensure user data is not going to be misused.
According to UK-based ORG, a civil liberties organization, similar to the Electronic Frontier Foundation in the US, users will be forced to hand over sensitive data to unregulated third-party age assurance providers. Data that users could potentially be made to hand over to access services include ID documents and facial scans.
ORG believes that this data collection creates significant risks for phishing, hacking, and even sextortion scams if weak security standards are used. It also claimed that Reddit is collecting birth dates to target ads and that one of the age assurance providers, Facetec, claims the right to track users via cookies for ad purposes.
Under the Online Safety Act, users have no choice in which age verification provider a platform uses and have to go along with it if they want to use the service fully.
As expected from a civil liberties body, ORG is concerned about freedom of expression and platform overreach. For example, Bluesky is restricting access to direct messaging, which most wouldn’t consider harmful content (though it could be used by predators targeting children).
ORG also criticized the broad and vague definitions of “harmful content” which, on Reddit, includes content that promotes depression, hopelessness, and despair. It believes this could lead to over-censorship, rather than focused on definite troublesome content. It even went as far as to ask the question “These definitions could be open to broad interpretation – will we see content relating to Goths, Emos, the Brontes and Sylvia Plath being inaccessible to under 18s?”
To ease fears over how data is being handled, the ORG wants to see the age assurance industry be regulated to ensure they’re meeting privacy and security standards. It has also called for age assurance methods to be interoperable, allowing users to pick who they want to verify with. Finally, it has called on Ofcom to be more specific about when these checks are needed and the ICO to engage with the industry’s practices.