Photo-Illustration: Intelligencer; Photo: Getty Images
In July, the United Kingdom began implementing major parts of the Online Safety Act, a law that, in the government’s words, “protects children and adults online” by putting “a range of new duties on social media companies and search services, making them more responsible for their users’ safety on their platforms.” Chief among these duties is “age assurance” — that is, figuring out how old users are to prevent them from seeing pornography; content that “encourages, promotes, or provides instructions” for self-harm, eating disorders, and suicide; and, among other things, “content which depicts or encourages serious violence or injury.”
The basic idea here — that children shouldn’t be actively served wildly inappropriate content in the course of conducting their regular lives online — sounds reasonable enough. But the U.K.’s attempt at legislating a solution has so far been something of a disaster. Companies aren’t sure how to comply, users aren’t happy with how they’re supposed to comply, and for all their invasiveness, age-verification systems don’t really seem to work. Ofcom, the U.K.’s communications regulator, outlined a range of acceptable age-verification options, including “facial age estimation, which assesses a person’s likely age through a live photo or video; checking a person’s age via their credit card provider, bank or mobile phone network operator; photo ID matching, where a passport or similar ID is checked against a selfie; or a ‘digital identity wallet’ that contains proof of age.”
In practice, it’s not going well. The systems used by Reddit and Discord are being fooled by screenshots from the game Death Stranding. VPN downloads, which allow users to pretend to be browsing from somewhere other than the U.K., are soaring. Reddit is blocking users from sub-Reddits containing news and footage from Gaza and Ukraine unless they show ID, and other less clearly violent sub-Reddits are shutting off access too. According to reporter Taylor Lorenz, British users need to verify their ages to access “r/periods, r/stopsmoking, r/stopdrinking,” and “other subreddits that provide essential community support to users including minors like r/sexualassault.” Companies are also scrambling to either develop or purchase age-gating tools of all sorts. Spotify is scanning faces. YouTube is using AI “to interpret a variety of signals that help us to determine whether a user is over or under 18,” which can be overridden with a government ID. X, which, like Reddit, serves lots of porn and other adult content, also estimates users’ ages — but apparently not very well and without a clear way to appeal.
It’s too early to know how this law will settle into full implementation, but its implications are clear: For determined kids, it’s relatively easy to cheat; for everyone else, suddenly required to prove their ages, it’s a major privacy setback. As the Electronic Frontier Foundation puts it:
The UK’s scramble to find an effective age verification method shows us that there isn’t one, and it’s high time for politicians to take that seriously. The Online Safety Act is a threat to the privacy of users, restricts free expression by arbitrating speech online, exposes users to algorithmic discrimination through face checks, and leaves millions of people without a personal device or form of ID excluded from accessing the internet.
An overzealous U.K. law in the country’s long tradition of disregarding civil liberties and privacy in favor of surveillance wouldn’t be such a big deal on its own. But it’s emblematic of a much larger trend: Around the world, and across the United States, age- and identity-verification laws are passing into law. The Supreme Court, in a swerve from precedent, recently upheld a Texas age-verification law, and half of the American states, most with conservative governments, have passed laws with similar intentions and implementations, usually under the guise of preventing access to porn. Lots of services choose to ask for age and identity verification — anything that requires a credit card is effectively requiring identity verification, and you can’t rent an e-scooter without submitting government ID — but with these laws, a comprehensively different internet is coming into view: one where, before you can do much of anything, you need to reveal who you are.
