UK sets out how pornographic websites must verify users’ ages

Britain’s communications regulator Ofcom published guidance on Tuesday for the ways in which pornographic websites could verify they’re not sharing adult content with children.

According to Ofcom, the average age at which children first see online pornography is 13, although a tenth of children are as young as 9 when they encounter it for the first time.

Under the country’s Online Safety Act (2023) websites that host adult content could be blocked by internet service providers if they fail to prevent underage access.

Businesses that fail to comply with the Online Safety Act’s provisions could be fined up to £18 million ($22.3 million) or 10% of their global turnover.

The guidance includes a number of mechanisms that can be used to check that users are 18 or older, and explicitly bars users simply checking a box to avow their age.

The techniques include matching an uploaded photo ID image to a live image taken of the user, as well as credit card checks — but not debit cards, as you must be 18 or over to obtain a credit card in the UK — alongside digital identity wallet technologies.

But some civil liberties organizations have warned that the techniques to protect children online also “create serious risks to everyone’s privacy and security.”

Abigail Burke of Open Rights Group said “Age verification technologies for pornography risk sensitive personal data being breached, collected, shared, or sold.

“The potential consequences of data being leaked are catastrophic and could include blackmail, fraud, relationship damage, and the outing of people’s sexual preferences in very vulnerable circumstances,” she added.

Ofcom argued that all of the proposed acceptable age assurance methods are covered by the country’s privacy laws, and that the privacy regulator, the Information Commissioner’s Office, was involved in developing the guidance.

Burke said it was “very concerning that Ofcom is solely relying upon data protection laws and the ICO to ensure that privacy will be protected” as these were “insufficient for a scheme this intrusive.”