Online age verification is coming – but how will it affect websites?

Like so many things, the internet relies heavily on people behaving responsibly.

Yet in many cases, they don’t.

Criminals and fraudsters run riot online, launching phishing and malware attacks, social engineering fraud and orchestrated network assaults like DDoS attacks.

Meanwhile, you don’t have to look far for examples of people treating other people badly – trolling and bullying, ghosting and cancel culture, plus the meteoric growth in fake news.

We can’t even get the balance right with our own children.

Social media sites tend to have minimum age limits of 13, yet 78 per cent of British children are on at least one social media site despite being below the minimum age requirement.

‘Thanks’ to a toxic blend of incompetent parenting and tech-savvy youngsters circumventing existing barriers, kids are being exposed to wholly unsuitable content on a daily basis.

Where parents fail to act, legislators must. And so the UK Government’s heavily criticised Online Safety Act will usher in online age verification for websites.

But will it work? And how might it affect our online experiences?

Age shall not weary them

By July of this year, numerous websites will have to confirm the age of everyone visiting them before they can view hosted content.

This online age verification goes far beyond the obvious pornographic platforms. It also extends to social media outlets, forums, blogs and video hosting websites.

There will be no exemptions for home-spun enterprises, in the way a self-built car avoids the emissions and safety regulations applicable to mass-produced vehicles.

The existing self-verification system has demonstrably failed to keep children safe, so industry regulator Ofcom is now insisting on “robust, reliable and fair” safeguards.

These will involve the submission of verifiable identity documents or the use of age verification tools, including – but not limited to – the following:

• Photographic ID.
• Credit or debit card checks.
• Digital identity services.
• Email-based age estimation (e.g. if your email account has existed for more than 18 years).

Companies failing to impose these checks on site traffic could be fined up to ten per cent of their annual worldwide turnover, or find themselves blocked by ISPs and search engines.

Is my data safe?

In all honestly, probably not.

We live in an age when Ticketmaster lost 560 million customer records, yet took months to respond to enquiries from customers anxious about their own data.

We live in an age when people have committed suicide after hackers stole their details from married dating platforms and published them online to extort money or ruin their reputations.

We live in an age when foreign countries employ teams of hackers to undermine overseas businesses and online services, stealing cryptocurrency and crashing healthcare IT systems.

With more examples of high-profile data breaches than this article could hope to list, the passport scan you upload to a random website after July could well fall into the wrong hands.

Hackers and cybercriminals will be preparing for assaults on many of the companies who will be storing submitted age verification data, hoping to perpetrate mass identity theft/fraud.

What can I do about this?

One workaround is to stop visiting any websites containing adult content – gambling, porn, tube sites, blogs or social media platforms – so you don’t have to confirm your identity.

While this might not be practical across the board, minimise the number of websites you register personally identifiable information with, since PII is a key target for fraudsters.

Most ISPs and mobile networks provide network filtering tools to prevent young eyes seeing age-inappropriate content. If these aren’t enabled by default, they’re easy to activate.

If maintaining both access and anonymity is important, you could use a VPN to evade geolocation restrictions – overseas citizens won’t be caught in Ofcom’s digital dragnet.

You could also access the surface web through the Tor browser, which is slow and old-fashioned, but does ensure anonymity by cloaking your geographic location like a VPN.