The position of porn in contemporary society is pithily summed up in the title of a recent report by the UK’s normally sober children’s commissioner: “Basically... Porn is Everywhere".

The computational neuroscientists Ogi Ogas and Sai Gaddam estimate something like 10% of the internet relates to adult content. That’s a pretty hefty amount of smut flying around. Put that together with the ever-growing proportions of ever-younger children spending significant amounts of time connected, and it’s easy to understand the imperative many politicians feel to protect them from explicit material.

Later this year, the UK is set to require all adult websites to verify the ages of their visitors. The private sector will pick up the task, overseen by state-backed regulators.

If the process goes smoothly, Britain could stand as a model for the rest of Europe and beyond. But privacy advocates and social liberals have issued bleak warnings of data breaches and profiteering. So is the UK carving a bold new path in child protection, or entering into a doomed marriage with the adult industry?

Won't somebody think of the children?

In the early 1960s, many developed countries were in the grip of an epidemic: accidental child poisoning (kids ingesting medicine meant for adults around the house) was rife. Henri Berlaut, a pediatrician in the Canadian city of Windsor - where 1,000 such cases were occurring a year - was determined to tackle the problem. But no amount of public education campaigns did the trick. A technical fix was needed.

Berlaut resolved to commission a child-proof medicine container. In 1962, his Ontario Association for the Control of Accidental Poisoning set up shop and began hunting down a design. Eventually, the “palm-n-turn,” a concept by then-president of ITL Industries Peter Hedgewick, was rolled out locally, and the child poisoning rate in the area dropped by 91%. Child safety caps were gradually mandated by governments around the world.

For Rachel O’Connell, CEO of the age checking company Trust Elevate, what the UK is attempting today is a digital equivalent. “The UK is being regarded almost as... a test bed for this,” she said, “and that’s very exciting.”

O’Connell has authored a set of standards - a “due diligence document,” as she puts it - sanctioned by the British Standards Institute, for companies looking to commission age checking tools, and for the makers of those tools. She believes that there is now both the technical capability and the imperative to justify implementing age checks on adult sites.

New technological advances make “single attribute” age checking possible - i.e., age checking tools can deliver a simple yes/no answer on whether someone passes the required age limit, rather than gathering reams of data within the tool. The services rely on third parties to check proof entered by the user.

The government agrees with O’Connell that the time is right - it passed the legislation underpinning the checks last year.

You never know who's watching

One difference between the offline and online world is the traces our actions leave - and who might pick up on them.

While a childproof bottle cap holds no record of who has opened it successfully, and what they ingested, personal data is the currency of much online business. If identifiable information detailing one’s tastes in porn were to be stored and used inappropriately, or stolen, the risks could be huge - think, for example, of a gay person in a conservative community, using porn as a secret outlet for their sexuality.

The most prominent potential age verification tool to emerge so far is AgeID. The software is developed by Mindgeek, a website management company whose bland nomenclature belies their status as operator of some of the world’s top porn sites, including PornHub and Brazzers. The company’s possible positioning at the heart of the new policy framework has some privacy advocates very nervous.

James Clark, a spokesperson for AgeID, said both that the AgeID tool itself “does not store personal data input during the age verification process,” and that “sites [that use it] cannot see let alone retain any personal information.” A customer must enter their email into AgeID to create an account, but Clark said this is then encrypted such that it cannot be reverse engineered. The age verification process itself happens via a third party.

But, said Myles Jackman, legal director for the privacy campaigners Open Rights Group, the amount of information on precisely how the verification process will work - for Mindgeek or anyone else - remains low. “Based on the solutions that we have currently been made aware of… it’s sales pitch, it’s not granular detail,” he said.

Meanwhile, even if we accept that developers can create workable, secure solutions, Jackman is worried about the potential monopoly position of AgeID, which could have a big advantage in this new market thanks to its connection to leading adult sites. He thinks large age verification providers might be tempted to change their privacy policies after growing their user base.

“It’s a land grab,” he said. “Once the porn platforms... have signed up every single person in humanity to their product, then they’re not really going to care.” (AgeID’s spokesperson said that “AgeID is one of many age verification platforms, and it is likely their use will be split across the adult industry.”)

A deterrent with teeth?

The extent to which you share Jackman's fears will partly depend on your views on a much wider change. The General Data Protection Regulation (GDPR) is a flagship new EU regulatory framework designed to give citizens greater control over their data and ensure companies are behaving responsibly.

For O’Connell, it’s also a guarantee against companies resorting to the sort of underhand methods Jackman fears. “The general data protection regulation is very clear that you
need affirmative informed consent if you're going to process the data for any other purposes other than what an organsiation states it would... collect it for in the first place." she said.

“They could, of course they could, try and bury in their terms of service data usage for some other purposes,” she said, but added that companies may be loath to risk the hefty fines and sanctions GDPR threatens, while also being nervous of the kind of reputational damage Facebook is suffering after revelations about the political consultancy Cambridge Analytica harvesting data on the network.

What’s more, O’Connell said, the harmonising of cross-country standards and technical advances that allow for more secure methods are creating a world in which digital age verification is far more viable in a range of different policy areas.

“This has implications beyond the adult sector,” O Connell said. Historically, when asked by regulators why they hadn't implemented age verification solutions, the tech industry would reel off a litany of reasons, among them the lack of common technical standards, the range of different legislation, and the need to collect a lot of information in way that was disproportionate to the risk.

"Every single one of those objections has now been deconstructed,” O'Connell said. Technological advances allow for data to be "tokenised" to preserve privacy, the EU-wide regulatory frameworks are coming into place, and the vast proportions of very young children with internet access makes protecting them all the more important.

But for Jackman, GDPR just isn’t the deterrent it’s made out to be. “It’s an ineffectual remedy,” he said. “Once you’ve leaked all of the sexual information on half of the adults in the country, fining someone 4% of turnover [as GDPR permits] is really an afterthought.”

Government steps aside

The government, Jackman said, is also abdicating responsibility on the issue.“The state here has decided that by passing this on to private sector interests, they will try and retain some level of plausible deniability when it all goes horribly pear-shaped.” He said he is sympathetic to the broad goal of controlling children’s access to porn, but cannot currently see an electronic solution he would support.

While the state is not directly stepping in to solve the problem, it is taking a role in managing the solution, recently appointing the UK’s film classification board as regulator for age verification providers. Rollout of the policy - which was due in April - is being delayed while the board runs a consultation on its guidance.

But Jackman would rather the government take a more holistic approach: “The alternatives would be education, would be parental responsibility,” he said, “and actually having a mature conversation within society about the nature and role of pornography, which would include things like how it’s consumed; where it’s consumed; why it’s consumed; and how it can be consumed more appropriately.”

O’Connell is more enthusiastic about the role for the private sector: the identity as a service industry, she said, could be worth $1.5 trillion by 2021, and it makes sense for the government to encourage private sector developments in the space. “This is a nascent ecosystem of new businesses and it is really good to have innovation," she said.

Government, sex and cutting-edge technology is a daunting mix, and concerns are understandable. Meanwhile, however, the advent of GDPR does usher in a new system that can offer protections greater than were available to web users before. As the British consultation on the policy runs, other governments should pay close attention.

(Picture credit: Vitelone)

Josh Lowe
Josh.Lowe@Apolitical.co