The U.K. Begins Enforcing Age Verification ⇥ bbc.com

Liv McMahon and Andrew Rogers, BBC News:

Around 6,000 sites allowing porn in the UK will start checking if users are over 18 on Friday, according to the media regulator Ofcom.

Dame Melanie Dawes, its chief executive, told the BBC “we are starting to see not just words but action from the technology industry” to improve child safety online.

She told BBC Radio Four’s Today programme that “no other country had pulled off” such measures, nor gained commitments from so many platforms, including Elon Musk’s X, around age verification.

It is remarkable that one of the first large-scale laws of this type happened on the web before it hit smartphone apps. Perhaps that is because both the App Store and Play Store have rules prohibiting pornography. The web has so far only had voluntary guidelines and minimal verification. In the U.K., that has now changed.

This article is headlined “Around 6,000 Porn Sites Start Checking Ages in U.K.”, yet in this — the first paragraph — the reporters acknowledge these are “sites allowing porn” not “porn sites”. This might sound like I am splitting hairs, but this figure seems to include some extremely large non-porn websites too:

Ofcom said on Thursday that more platforms, including Discord, X (formerly Twitter), social media app Bluesky and dating app Grindr, had agreed to bring in age checks.

The regulator had already received commitments from sites such as Pornhub – the UK’s most visited porn website – and social media platform Reddit.

When we are talking about large platforms like Discord and Reddit, there is a meaningful difference between describing them as “porn sites” and “sites allowing porn”.

Apps for Bluesky, Discord, Grindr, Reddit, and X are all available on the App Store, where they all have “16+” ratings, and the Play Store, where they have a “Mature 17+” rating with the exception of Discord’s “Teen” rating. These platforms are in a position to provide privacy-protecting age gating and, I think, they ought to do so with APIs also available to third-party stores.

The age verification mandated by this British law, however, is worrisome, especially if it becomes a model for similar laws elsewhere. The process may be done by a third-party service and can require sensitive information. These services may be specialized, meaning they may have better security and privacy protections, but it still means handing over identification to some service a user probably does not recognize. What is a “Yoti” anyway? And, because website operators are liable if they do not adequately protect youth, they may choose to take broader measures — just in case. For example, the law requires age verification for “material that promotes or encourages suicide, self-harm and eating disorders”. Sounds reasonable, but it also means online support groups could be age-restricted as a precautionary measure by their administrators. Perhaps that is reasonable; perhaps young people should only participate in professional support groups. But it is a notable compromise.

Nevertheless, I think the justification behind this policy is fair and deserved. There are apps and parts of the web where children should not be able to participate. I do not even mind the presence of a third-party in the verification chain — many Canadian government services include the option of logging in with a bank or credit union account, and it works quite well. But there are enough problems with this law that I hope it is not seen by other governments — including my own — as a good foundation, because it is not.