Millions of Australians could be pressed to hand over their data in exchange for access to social media, online porn or gaming, under an age verification scheme.
Australia is on the path towards introducing age verification laws, with the federal government funding a $6.5 million trial of technology designed to protect children online.
But the scheme won’t only affect children — if it goes ahead, people of all ages will have to prove they’re old enough to access certain content.
It’s been labelled a “porn passport” by the digital rights group Electronic Frontiers Australia (EFA).
“It essentially requires anyone to establish their age [in order] to access a website providing adult content,” EFA chair John Pane said.
“So, by default, we’re regulating the rest of the adult public in an endeavour to restrict access by minors.”
The trial was initially framed in terms of underage porn use and unspecified “online harms”, but the government has since broadened its focus to social media and gaming.
“Social media is going to be one of the use case scenarios that will be examined,” Communications Minister Michelle Rowland said.
“We know that social media platforms already have … minimum ages for users. The question here is whether or not they are being enforced.”
Research indicates that more than half of all Australians have used online porn, although up-to-date and authoritative data is hard to come by.
Many more Australians use social media — survey data varies, but 70-80 per cent of the population are thought to be active users.
They will all be asked to participate if an eventual scheme is as broad as the trial.
“It’s a fundamental invasion of privacy … [and] we do have a right to remain anonymous in public spaces,” Mr Pane said.
The question is: Would the vast majority of Australians be willing to participate?
“This is precisely why we are conducting this trial,” Ms Rowland said.
There’s been bipartisan support for the push since April, but prior to that there was debate about whether the technology was “mature” enough.
But a growing age verification industry says the tech has already been proven.
“We provide the services to the biggest banks in Australia and some of the biggest banks globally — it’s exactly the same technology,” said Peter Violaris, head of global privacy at IDVerse, an Australian company offering age verification services.
The eSafety commissioner’s road map makes clear that identity companies such as IDVerse would require the tick of approval from a regulator in order to participate in any scheme.
The EFA warns there are no guarantees, but Mr Violaris disagrees.
“Some people have genuine concerns about honey pots of data being hacked, but that’s not how technology works anymore,” he said.
“We only send the 18-plus status across to the adult site — there’s no name, there’s no email addresses, no mobile number.
“Then we delete it immediately, so there is no honey pot of data”.
He says the technology has reached a tipping point.
“And that’s why I think the law can be passed now, whereas it couldn’t have been passed perhaps five years ago.”
The age verification menu explained
The details of the trial are yet to be revealed, but we have some clues about what kind of tech is being considered.
The eSafety commissioner has recommended a “double-blind tokenised approach”, which would involve a combination of techniques.
So of all the methods, which are the most secure and accurate?
HIGH RISK: Biometrics
Biometric methods analyse your face or voice to estimate your age.
Privacy risk: High.(red) The law considers biometric data to be highly sensitive.
Accuracy: Moderate(orange) but imprecise. Facial analysis is more accurate than vocal analysis, but it’s only intended as an estimate.
MEDIUM RISK: AI Profiling
AI profiling guesses your age using other data the website has collected about you, such as how long you spend on a page, the ages of people in your network, your stated interests, mobile data usage, and finger-swiping patterns.
Privacy risk: Moderate(orange)
Accuracy: Compromised and variable(red)
HIGH RISK: Hard identifiers or proxies
A hard identifier is usually a government-issued document, such as your birth certificate, passport or drivers licence, validated using a separate database or a real-time photo. A “proxy” might be your credit card or phone contract in jurisdictions where only adults can obtain them.
Privacy risk: High(red)
Accuracy: High(green)
MEDIUM RISK: Account-based
Account-based assurance is when you verify your age via a separate platform, such as Facebook or Google.
Privacy risk: Moderate.(orange) Other data can be shared in the process.
Accuracy: Compromised and variable.(red)
LOW RISK: Age-gating
Age-gating usually involves a landing page which asks you if you’re old enough to proceed, but there’s nothing to stop you from lying.
Privacy risk: Zero(green)
Accuracy: Very low(red)
Methods for sharing information
LOW RISK: Devices
Your age is embedded within your device.
Privacy risk: Low to moderate.(green)
Flaws: A child might set up their own device and lie about their age, or use an older person’s device. However, it may be the only method that can’t be dodged using a VPN.
Low RISK: Age tokens
A reusable electronic “token” which conveys only that you do or don’t meet age requirements.
Privacy risk: Variable, but potentially very low(green) if the company issuing the token deletes the person’s data.
Flaws: VPNs, but otherwise very few. A token can be set to expire after a set period to avoid someone else using it, and can be protected by a password or biometric lock.
MEDIUM RISK: Digital IDs and wallets
An online ID document and software capable of storing it
Privacy risk: Variable.(orange) The digital ID might provide more personal data than necessary, but a wallet allows for specific information to be shared.
Flaws: VPNs, but otherwise very few. A digital ID can be password-protected.
Low RISK: Double-blind approaches
Also known as “zero knowledge”, a double-blind approach means the encrypted transfer of data, such as your age, via a separate hub. The age verification service would have no idea what you needed it for. It’s an extra layer of protection that can be used with other methods.
Privacy risk: Arguably less than zero.(green) Double-blind approaches lower the risk of other methods.
Flaws: Systems like these can be complicated to use and expensive to run.
VPNs: The elephant in the room
Almost all the methods on the table are vulnerable to VPNs, or virtual private networks, which can obscure a person’s location and bypass controls.
Separately, in a court battle against Elon Musk’s platform X, the eSafety commissioner has cited research that a quarter of all Australian internet users have VPN technology in place.
VPNs have been a significant challenge in jurisdictions where age verification has been rolled out.
So far, laws have been passed in the UK, France, Germany, Canada, and 11 US states, although only a handful of those have schemes up and running.
In Texas, porn use appeared to decline by roughly 80 per cent after a scheme was introduced, suggesting that in reality, Texans were dodging the scheme using VPNs.
The industry acknowledges it’s a challenge, but argues it would be a mistake to let perfect get in the way of good.
“I don’t mind if adults [or] older teenagers use VPNs to get around [age verification rules] … the point of the law, in my mind, is to stop young children, primary-school-age children accessing pornography on their smartphones in the playground,” Mr Violaris said.
“That’s a problem that no modern society should accept, and the solution is there to stop it.”
The real harms of seeing porn at a young age
Adam*, now in his mid-30s and receiving treatment for a porn addiction, first saw porn when he was 12 or 13.
“We were on the family computer after school one day and we were just googling ‘sex’ or ‘porn’ or whatever, and it came up,” he said.
“I do remember specifically thinking, ‘Oh … I can just find that out — like, that was easy.'”
The eSafety commissioner says, on average, young Australians first encounter online porn at the age of 13.
Two decades after Adam’s first experience, it’s happening on smartphones rather than the family PC, and access is easier than ever.
“Within two clicks on their phone, they can google what I googled when I was 13.
“If my mum knew that, she would have thrown my computer out the window — and so she should have.”
Adam’s porn addiction began before he’d had his first kiss.
“Being introduced to it before I had any knowledge about all aspects of sex … definitely led me to keep going back to it because that was my baseline now,” he said.
“I do think it impacted the way I then went into my sexual experiences — expecting women to have sex the way that I had already seen it.”
But Adam doesn’t believe age verification technology will work in the way political leaders hope.
“It’s going to be so easy to get around, and of everyone, teenagers now are going to be tech savvy enough to do that.
“I would much rather see whatever money is being assigned to this in the budget be assigned to education, and not just education of kids — education of parents.”
*Name has been changed to protect identity.
