The agency, however, rules out total perfection in implementing the rules and outcomes. When the government announced plans to block social media for children under the age of 16 earlier this year it vowed that the ban would be backed by highly effective age checks…and then made it Ofcom’s job to figure out what effective assurance looks like. As instructed, the regulator has carried out what it terms a rapid assessment of age assurance techniques and has published its findings. There is no earth-shattering, never-before-thought-of option on the list, naturally. Ofcom’s four suggestions are: photo ID matching; banking information; digital identity services; and facial age estimation, with a challenge age. The methods are based on Ofcom’s existing guidance on effective age assurance for services for over-18s and they are “capable of being highly effective at 16,” it said.
But there are pitfalls. A major issue will be photo ID, or more accurately, the fact that many children aged 16 or 17 may not have it and may therefore have to take additional steps to acquire it. Photo ID is either the method itself for proving age, or the backstop for other methods, like facial age estimation. Further, age assurance at 16 involves the processing of personal data, which has implications under data processing law. Ofcom did not go into lengthy specifics, but said it has worked closely with the Information Commission in this area.
Finally, there’s the fact that many children – and doubtless some parents – will work pretty hard to get around whatever method of age check a service or application employs. “No age assurance method is completely resistant to circumvention and service providers will need to take practical steps to identify and address attempts by children to bypass age checks,” Ofcom said. Ofcom identifies the use of VPNs and other technologies that can mask a user’s location as a key way in which minors may try to circumvent the ban. It cited its own research conducted in August that showed a quarter of children had used a VPN in the previous six months.
Meanwhile, percent cent of 11-to-17-year-olds had accessed content for people older than them over the same time period, with 11 percent using a VPN to do so. The watchdog also pointed to attempts to use manipulated photos or videos to pass an age check, or relying on an adult to complete an age check for a child, as well as simply accessing a service via an adult’s account. Those are just some of the ways children could get around age checks, but even those few seem to somewhat undermine the whole idea of effective age assurance. But the onus will be on the providers of social media services to police the issue. As Ofcom’s report reminds us, “it is the responsibility of regulated services to ensure their new age assurance processes are highly effective.”
Ofcom said it expects to see “further innovation from the whole tech industry to support the implementation of highly effective age assurance at 16,” but noted that “questions around governance, accountability and effectiveness of such interventions are out of scope of this report.” The regulator has given the service providers some hints as to how they can prevent children circumventing age checks, including the use of age inference models to sniff out under-16s who may have initially fooled an age check to set up an account; and employing location-related signals to help detect VPN use. Its key message though seems to be that service providers should report underage users and open up reporting systems to allow other users to flag usage by under16s.
On that last point though, it notes that the likelihood of inaccurate or malicious reports and resource constraints would make reporting effective only as part of a wider age assurance process. While the onus is on service providers themselves to police usage, Ofcom is doing its bit; it has pledged to monitor circumvention by children and says it will publish a report on circumvention within twelve months of the ban coming into effect.
