UK age verification is flawed, and regulators need a technology wake-up call

Age verification isn’t new: we encounter it daily, whether ticking a box to say that we’re over 13 when signing-up to social media platforms or presenting ID if we’re buying alcohol or opting for the gorier or more risqué choices at a cinema.

Thanks to new regulation, it’s a topic that’s getting attention. In May this year, the Gambling Commission has demanded that online bookmakers beef up their identity and age verification checks while also reducing the time taken to vet each player. Also in May, new industry guidance for online pharmacies mandates that an identity check before supplying certain medicines, particularly those that need monitoring or can be abused. Grabbing the most attention, however, is AgeID—as of the 15th July, the UK government will launch an age-check scheme designed to stop under-18s viewing pornographic websites.

Adult material is a tricky area to regulate. While most people would likely be happy for others to know that they placed the odd bet, and people are used to their medical records being accessed by a number of medical professionals, access to adult material is often something people want to keep very private. Getting this wrong will mean people will want to circumvent rather than engage with the system.

• UK porn block: everything you need to know
• Starbucks plans to block adult content on its Wi-Fi in 2019
• Tumblr announces adult content ban

The flaws in AgeID

AgeID has already been subject to criticism before its launch, particularly from privacy and free speech advocates. The proposed aim of the rules are to stop minors stumbling across content that they shouldn’t, but there’s already a lot of scepticism as to whether it will work.

A good analogue is the trend in piracy in recent years. In 2013, 18% of UK consumers used illegal downloads to get their music. Thanks to streaming apps such as Spotify and Apple Music, this is now down to 10%. If you make it easier for consumers to engage with the right way of doing things, then they will do so. Streaming is far simpler than torrents or usenet groups, and far less risky, so people will naturally choose the easier option.

So how simple is AgeID? Consumers will have two options—they can either buy a card from a store, or they can prove their identity online through a number of credentials, such as a credit card or passport.

Buying a card has its advantages—the stores where the card will be available will already have processes in place to make sure its customers are old enough to buy alcohol, lottery tickets, and other restricted items. The problem here is that there is no social taboo associated with alcohol and lottery tickets. Are consumers likely to go through the embarrassment of asking staff for a card that has only one obvious use? Trading Standards has done a great deal of work to ensure that age verification is taken more seriously by retailers than ever before, making some sort of document check more likely. However, unfortunately people are more likely to circumvent this system than engage with it.

Online verification comes with its own problems. One of the most infamous data breaches of all time was that of Ashley Madison, the dating site for those looking to cheat on their significant other. The data exposed led to blackmail, divorces and even suicides. AgeID, no matter the data that it will actually keep on file, is asking a lot of trust in its users.  

Again, people are more likely to try to subvert the system than engage with it. A quick google search reveals that, even before the system goes live, there is already a great deal of advice available on how to bypass AgeID—even the BBC has explained that a VPN is a legal workaround.

How other industries such as online gambling have worked to get it right

Identity verification is vital for online bookmakers, not just for age restriction, but because they can be used for money laundering. Therefore, they are required by law to make sure that their customers are who they say they are, in case a future money laundering investigation demands this information.

So how do they do this? Many engage the services of companies that already perform similar services for the financial sector. Banks must identify their customers for the same reasons as online bookmakers, so it makes sense to use the similar processes for both sectors.

A recent development has been the regulators making these rules tougher—but in the favour of the consumer. Previously consumers could be asked for extra documentation when making a withdrawal and could have to wait 72 hours before receiving their money. This has led to the creation of robust systems that bookmakers rely on to on-board new customers.

In the short history of the internet, it is the adult industries that have innovated and others follow. Adult sectors are credited with pioneering elements of streaming video, payment tools and online credit card transactions. AgeID, however, is an unusual retrograde step, trying to create something new where trusted solutions already exist. In order to make sure consumers use a system rather than avoid it, it must be both trusted and simple. By looking to sectors that have already solved age verification, the adult industry has a much better chance of implementing a system that works.

• We've also highlighted the best VPN services of 2019