How will age verification for porn work and what about your data?

The way people in the UK access pornography websites is about to undergo a major change.

The Internet Safety Act says sites must make it harder for children under 18 to view explicit material, and Pornhub and other major adult sites have confirmed they will introduce age verification for adults. by July 25.

Media regulator Ofcom estimated at 14 million people watch online pornography, and concerns have been raised about the privacy and security implications if they have to undergo more stringent identity checks.

Age verification companies most likely to operate say people should be reassured because the firms do not store data and do not know what a person has accessed.

“The only database that can't be hacked is no database at all,” says Ian Corby of the Association of Age Verification Providers. Chelsea Jarvie, a cybersecurity expert, says society needs to be wary of the “normalization of mass online identity.”

An adult website may choose several ways to verify a user's age, and Ofcom suggests recommended seven methods. A website may allow a combination of these to give people choice. Let's take a look at them.

How does this work

You provide your credit card information and the payment processor verifies that the card is valid.

What are the privacy concerns?

Age verification firm Verifymy claims that when you perform this verification on its service, there is a two-factor authentication verification and a mini-transaction without exchanging money, similar to checking into a hotel.

“No personal data is transferred in any way to the adult platform. It's simply a yes or no answer to the question: 'Is this person over 18?'” said Andy Lulham, Verifymy's chief operating officer.

The 5RightsFoundation – an online child safety charity – said credit card checks, as well as photo identification and digital identity verification methods, provide a high level of confidence, especially when the data is well protected, but “carry significant privacy risks if they are not designed and managed appropriately.”

How does this work

These include digital identity wallets that can securely store and transmit information that verifies your age.

What are the privacy concerns?

Omari Rodney is Yoti's Chief Product Engineer.

He told BBC News that once a document such as a passport has been checked and verified, all parts of it are then separated and encrypted. The only person who could decipher it was a human.

“We won’t be able to see this information until we get permission from you,” he said.

Luciditi, another background verification company, said a user can choose to reveal part of their identity – that they are over 18 years old.

Ms Jarvie, however, believes digital wallets – along with open banking – “may seem disproportionate” as a method of proving you are over 18.

How does this work

You provide your email address and the technology analyzes other online services where it has been used, such as banking services or utility providers, to estimate your age.

What are the privacy concerns?

Verifymy is one of the operators and told the BBC that its research showed this method would be the most convenient for users.

Mr Lulham says the technology checks whether email has been used to interact with a range of websites, such as financial institutions.

Check my details can be stored up to 28 daysbut it adds that it will often be smaller, encrypted, and no data will be transmitted to the website being accessed.

How does this work

You show your face in a photo or video, and the technology analyzes it to estimate your age.

What are the privacy concerns?

The verification company will usually check to see if it is a person, just one person, not an image.

Yoti uses an artificial intelligence model to determine a person's age.

While estimating a face's age “can be accurate”, Ms Jarvie said her research showed many people would be uncomfortable using this method.

How does this work

You give your permission to use the age verification service to confirm whether age filters have been applied to your mobile phone number.

What are the privacy concerns?

Yoti looks at who the bill payer is and whether it's the adult paying for the child's phone – for example, on a family plan. The mobile operator is asked to confirm a person's age, but does not know which website they are about to access.

The OneID verification company prompts the user to log into their digital ID using their phone number, and the mobile operator confirms whether the person is over 18 years old.

Verifymy said pay-as-you-go numbers will not be compatible – users will need to sign up for a phone contract.

How does this work

You authorize the age verification service to securely access your bank's information about whether you are over 18 years of age.

What are the privacy concerns?

OneID uses this method if the user cannot verify that they are over 18 years old through their mobile operator.

While OneID doesn't see your transactions, your account number and sort code are passed to it during a one-time check, but the company says it doesn't store any details.

OneID founder Rob Kotlarz admits that users may not want to show their bank details to access an adult website.

“Protecting children is the right thing to do,” he told BBC News. “We're offering an easier way to verify someone's age. If it's easy and convenient, why wouldn't you do it to protect your children?”

How does this work

You upload an image of an ID document that shows your face and age, and at the same time a picture of you. They are then compared to confirm that the document is yours.

What are the privacy concerns?

In addition to UK documents, Yoti will allow the user to upload some from outside the UK.

Ms Jarvie said uploading photo IDs and checking credit cards “feels outdated” and “very intrusive”.