The UK’s age-verification law for commercial porn sites (aka 'the porn block') is nearly ready, but significant problems remain.
After lengthy delays, guidance has finally been published by the British Board of Film Classification (BBFC), the watchdog responsible for ensuring that adult websites have age-verification check systems in place. But, while it has powers to instruct UK internet service providers to block non-compliant pornographic services, it has few teeth to do much else.
The guidance, alongside freshly published draft regulations, will need to be approved by parliament before the age-verification powers under Part 3 of the Digital Economy Act can come into force, which is expected to happen early next year.
A number of minor changes have been made by the BBFC in response to a public consultation process which was opened after the Department for Digital, Culture, Media and Sport (DCMS) conceded that its original plan to have an age-verification block on porn websites “fully in place” by April this year had been delayed.
For many years, the government has been pushing to introduce a system that it hoped would reduce the chances of people under the age of 18 from accessing porn online. However, its plans – under the sprawling Digital Economy Act – have been ridiculed by campaigners who have said that the proposed age-verification privacy protections were wholly inadequate and could be catnip for hackers.
And that’s just the one of a raft of potential problems policymakers will have to grapple with. Throughout the guidance, the BBFC states that commercial porn providers must ensure that the “material is not normally accessible by those under 18”. By saying this, the BBFC has acknowledged that the age-verification system will not completely prevent children from accessing porn online, given the ease with which teenagers can work around it via methods such as VPN.
The regulator has revealed little technical detail about how the age-verification systems will work, but does say they will be “most frequently” provided by third parties who will offer “consumer choice” and mechanisms that it claims will “confirm age not identity”. Mindgeek – which owns Pornhub, YouPorn and several other popular porn websites – has been heavily pushing its AgeID technology. But critics have said that, given its dominance, Mindgeek could act as a gatekeeper to online porn which in turn could give it even more power in the market.
Mindgeek, meanwhile, has been pointing the finger at Google. “Search engines return images within the search engine based upon the terms entered,” the company said in its consultation response. “Some of which could be archived or deleted images which are still cached in the search engine. This is a major issue which should be discussed with search engine owners to ensure it does not happen, else [children] stumbling [across pornography] will still occur on quite a large scale. We would therefore expect the BBFC to have mandatory powers to require search engine owners to cooperate with these very important aspects of child protection.”
The BBFC has confirmed it will “incorporate search engine results” into its “proportionate approach”, which – among other things – consists of “deciding which services that provide online pornographic material on a commercial basis it will investigate”. However, it declined to reveal whether it has been working with Google and other search engine companies to tackle this issue. One thing is clear: any such action is optional rather than mandatory.
Google scrapes millions of images from porn sites and serves them via its search engine. How enthusiastic will Google be in response to requests from the regulator? Stone cold, potentially, given it offers “safe search” filters to anyone browsing the search engine. Google, citing the EU’s eCommerce Directive, could also say it is not the service providing pornographic images on a commercial basis and instead acts merely as a conduit.
Despite calls for social networks, such as Facebook and Twitter, to fall under the age-verification rules, the government has resisted the urge to widen the scope of the new regulations, saying that “the focus of the legislation should be pornographic websites”. Search engines and social networks have been confirmed as ancillary service providers (ASPs), which means that the BBFC can ask them to remove material served up on their services by porn providers who fail to comply with the age-verification regime, but they are not lawfully required to do so.
“There is no requirement in the Digital Economy Act for ASPs to take action on receipt of a notice but government expects that responsible companies will wish to withdraw services from providers who are in breach of UK legislation by making pornographic material accessible online to children,” the regulator explained in a government document.
The BBFC’s remit is limited to a “focus on the ability of arrangements to verify whether someone is 18 or over”. Which means that, despite calls from campaigners for stronger powers, it will not be able to use enforcement measures to crack down on age-verification providers with poor privacy practices. Instead, that will be the job of the Information Commissioner’s Office (ICO) under existing data laws. It will be up to the BBFC to notify the ICO of any privacy or security concerns it has about an age-verification provider’s system.
The regulator – in consultation with the ICO – has also been developing a non-statutory, certification scheme for age-verification checkers. Privacy campaigners have repeatedly argued that weak age-verification systems could be open to abuse, where potential data breaches could lead to hackers holding porn users to ransom.
Read more: Under the threat of new laws, British sex workers fear for their websites and their safety
Draft regulation states that the BBFC can exempt websites or apps that carry 33 per cent or less of “pornographic material”. But the threshold does not apply where websites are marketed as porn providers. The regulator declined to comment, however, when asked about how that one-third metric would be measured.
The DCMS has separately confirmed that, while it hopes to enforce the age-verification regime swiftly after significant delays, “it is not the intention to bring the power to impose financial penalties into force at this stage”.
While the law may have a gentle landing, the government has decided to provide indemnity for the BBFC after admitting that without it, the watchdog could be swamped with legal action costing up to £10 million in the first year alone.
This article was originally published by WIRED UK
