Age verification systems are surveillance systems. Mandatory age verification, and with it, mandatory identity verification, is the wrong approach to protecting young people online. It would force websites to require visitors to prove their age by submitting information such as government-issued identification. This scheme would lead us further towards an internet where our private data is collected and sold by default. The tens of millions of Americans who do not have government-issued identification may lose access to much of the internet. And anonymous access to the web could cease to exist.
Why We Are Against Age Verification Mandates
Age verification laws don’t just impact young people. It’s necessary to confirm the age of all website visitors, in order to keep out one select age group.
Once information is shared to verify age, there’s no way for a website visitor to be certain that the data they’re handing over is not going to be retained and used by the website, or further shared or even sold. While some age verification mandates have limits on retention and disclosure of this data, significant risk remains. Users are forced to trust that the website they visit, or its third-party verification service, both of which could be fly-by-night companies with no published privacy standards, are following these rules.
Further, there is risk that website employees will misuse the data, or that thieves will steal it. The more information a website collects, the more chances there are for it to get into the hands of a marketing company, a bad actor, or someone who has filed a subpoena for it. This would inevitably lead to further data breaches, because these laws won’t just affect companies that are big enough to have robust data protection. If a website misuses or mishandles the data, the visitor might never find out. And if they do, they might lack an adequate enforcement mechanism. For example, one recent age verification law requires a user to prove “damages resulting from” the unlawful retention of data, in order to hold the website accountable in court—a difficult bar to reach.
These mandates wouldn’t just kick young people offline. There are tens of millions of U.S. residents without a form of government-issued identification. They could also be kept offline if age verification is required. These are primarily lower-income people who are often already marginalized, and for whom the internet may be a critical part of life.
No Age Verification Method Is Foolproof
Last year, France’s Audiovisual and Digital Communication Regulatory Authority ordered several sites with adult content to implement age verification. Then France’s National Commission on Informatics and Liberty, CNIL, published a detailed analysis of current age verification methods. It found that no method has the following three important elements: “sufficiently reliable verification, complete coverage of the population, and respect for the protection of individuals' data and privacy and their security.” In short, every age verification method has significant flaws.
Whether it’s called “age assurance,” “age verification,” or “age estimation,” there are only a few ways the technology can work. Verification usually requires a website or its contractor to analyze every user’s private information, like the information on government-issued identification cards. A potential alternative is for the website to communicate with third-party companies like credit agencies, but they are known for often having mistaken information. A third option is age estimation via facial analysis, which is used by Instagram. But such face recognition technology has its own privacy and other problems, including clear evidence that errors abound.
EFF and many other privacy organizations have been concerned about age verification laws for decades. We opposed a previous federal law, COPA, the Child Online Protection Act, which included an age verification requirement. It was struck down as unconstitutional nearly twenty years ago for limiting the First Amendment rights of adults.
No one should have to hand over their driver’s license just to access free websites. That’s why EFF opposes mandated age verification laws, no matter how well intentioned they may be. Dozens of bills currently being debated by state and federal lawmakers could result in dangerous age verification mandates. We will resist them.
