How the government will force everyone to show ID to access porn sites - and why it might fail

Pornography websites in the United Kingdom will be legally required to verify the age of all users, per new government legislation.

As a part of the Online Safety Bill, all websites will be required to put “robust checks” in place to ensure users are 18 or over.

These checks could involve handing over credit card information to a pornography website, or age information to be corroborated by a mobile provider or government database.

However, many users – including the young people the law aims to protect - are likely to still be able to bypass these restrictions via easy-to-access tools such as virtual private networks (VPNs).

Porn blocks will ban anyone from watching pornography unless they have proved they are over the age of 18.

Adults could be forced to use to use age verification technology from a third-party service – although the government has not been exactly clear about how this would work.

If websites fail to bring in the checks, however, websites could be fined up to 10 per cent of their annual revenue by Ofcom and their executives could be held criminally liable.

“The Online Safety Bill seeks to [make the internet safer] by focusing primarily on the systems and processes that online platforms put in place, with a view to reducing the risk of harmful content surfacing in the first place. This is different to the approach being taken in several other jurisdictions, where the focus is on swiftly removing individual pieces of illegal or harmful content”, Rebecca Dickie, a managing associate at Linklaters, told The Independent.

“For example, in Germany, ‘manifestly’ unlawful content must be removed or blocked within 24 hours of a platform receiving a report relating to it. By contrast, the Online Safety Bill is focused on requiring platforms to assess the risks of certain types of harmful content being present on the platform and taking appropriate steps to mitigate those risks.”

The government has said that users “may need to verify their age using identity documents but the measures companies put in place should not process or store data that is irrelevant to the purpose of checking age.”

This could include checking a user’s age against details that their mobile provider holds, verifying via a credit card check, or other personal information such as passport data.

The legislation would apply to all pornography websites operating in the UK, as well as social media sites that host pornography.

Facebook does not allow nudity on its platforms, but Twitter and Reddit both do – albeit with restrictions such as requiring labels if an account will post content that should only be seen by adults.

Since the restrictions will only apply to websites when they are visited by users from the UK, accessing a website through a server in a different country via a VPN will mean that users will not have to confirm their identity.

It is estimated that nearly a third of all VPN users are between the age of 16 and 24, suggesting that many young people would easily be able to circumvent any ‘porn ban’.

These criticisms of the ban have existed since its earlier iteration in 2019. It was intended that restrictions would be put in place by July, they were instead delayed.

“Preventing kids from accessing certain types of online content, such as pornography, is in everyone’s interest. But people who share personal details with third-party age verification platforms need to know that attackers actively target this type of data, and will likely find these databases very enticing”, said Tom Gaffney, a security consultant for cyber-security company F-Secure.

“Collecting data and storing it in a centralised location makes it easy to steal and creates a significant threat to users’ privacy, security, physical safety and even basic human rights. On top of having data stolen after it’s been collected, people are going to have to be on the lookout for fake age checks, ‘free’ tools that market themselves as simplifying the checks but are either privacy-invasive PUAs (Potentially Unwanted Applications) or straight-up malware used in internet scams.”

The government did not clarify how VPNs used to circumvent its restrictions would impact its plans, but said that the “· onus is on the companies themselves to decide their approach to complying with their new legal duty to prevent children from accessing pornography. But any age verification technologies they use must be effective and Ofcom will hold them to account for this.”