'Can I see some ID?' As online age verification spreads, so do privacy concerns
The U.K.’s Online Safety Act took effect last Friday, requiring proof of age to access certain content
Ontario-based cybersecurity expert Richard Rogerson was surprised to get ID'd by a children's online gaming platform last month.
His three kids had been playing the Roblox game Murder Mystery, until the platform put it behind an age verification system. They were asked to enter the email address of a parent, for permission to update their content maturity setting from "Mild" to "Moderate" if they wanted to keep playing.
The email, which Rogerson shared with CBC News, asked him to enter his birthday and verify his age using a government-issued ID or credit card.
"When my kids sent me a form saying, 'Upload your driver's licence,' you can imagine the amount of resistance that I had towards that," he said.
While he had no problem with his kids playing the game, Rogerson declined to upload his ID, unsure how securely his data would be stored. His kids have had to give up Murder Mystery as a result.
Online age verification systems are sweeping the internet as jurisdictions introduce laws to prevent children from accessing certain content, and a wave of privacy concerns has followed.
The U.K.'s Online Safety Act took effect last Friday, putting age gates on pornography and other content deemed "harmful" to minors. Many websites are now required to ask U.K. users to verify their age using identifiers like selfies, driver's licences, passports or credit cards, triggering frustration and backlash from some users.
While some sites have pulled out of the country rather than comply with the new rules, others are rolling out their own measures beyond the U.K.
YouTube announced Tuesday it will introduce an age verification system with select U.S. users before implementing it more broadly. The video streaming platform will analyze the browsing patterns of users to determine their age before asking for other forms of ID.
"We're seeing this kind of pop up everywhere," said Rogerson, who is the founder of Packetlabs, a cybersecurity firm specializing in professional hacking services.
Data breaches raise alarms
Rogerson says it's a good idea to restrict minors from accessing certain content, but it's also important to address related privacy and security concerns.
Most companies rely on third-party verification systems, so the average user won't know who is privy to their private information, how secure it is, or how it's being stored.
If that data is breached, the fallout can be disastrous.
"You think about an adult website getting compromised, and here's all the faces of all the people and where they live, and here's all the content they viewed," Rogerson said. "That would be quite, quite damaging."
Last Friday, San Francisco-based Tea Dating Advice Inc said in a statement that some 72,000 images, including 13,000 selfies and photo IDs, were leaked online from Tea, an app designed for women to vet dates by sharing information about men.
Rogerson says Canada has mandatory breach notification laws, but some companies aren't sophisticated enough to even know when they've been breached.
He says the U.K.'s General Data Protection Regulation, while not perfect, offers strong privacy protections in some areas and stiff penalties for violations. But he worries Canada is lagging behind, as its proposed legislation aimed at modernizing online privacy laws has been stalled.
"We need the privacy laws here in Canada to protect Canadians, because it's every every day we're seeing companies get breached with hordes and hordes of privacy related information," he said.
The Online Harms Act was introduced in February 2024 but didn't pass, and the federal government may rewrite or reintroduce the act. Justice Minister Sean Fraser recently said the government plans to take a "fresh" look at the legislation over the summer, though it's unclear what changes are coming.
A ministry spokesperson did not answer whether age verification might be one of those changes, saying in an email Friday that the government "cannot speculate on legislation or content at this time."
Tough choice for users
Cliff Steinhauer, director of information security and engagement at the National Cybersecurity Alliance, a non-profit that promotes online safety, says age verification requirements present users with a tough choice when faced with insufficient or unclear privacy policies from the apps and websites they use.
"It's like, either do this and accept the policy, or don't do it and don't get access to the service," he said.
"As a user, I think you have to really ask yourself: Am I comfortable with this? If this were to be breached, what would the impact on me be? What is the risk that I'm taking by putting this selfie into this app? And is this service worth the risk?"
Steinhauer says privacy laws need to put safeguards around age verification systems, like guarantees of deleting the data as soon as the user's age is verified.
Several U.S. states have already implemented age verification laws.
Last week, the U.S. Supreme Court upheld a Texas law requiring porn sites to verify the ages of all visitors after a judge previously struck it down as a violation of free speech.
Australia has legislated a social media ban for users under 16, which is slated to go ahead in the coming months, and Quebec is considering following suit.
Verification needed: advocate
The Canadian Centre for Child Protection has been lobbying the federal government to mandate online age verification.
Jacques Marcoux, the centre's director of research and analytics, worries about children being harmed by sexually explicit material online, pointing to a 2022 Mediasmart survey that found three in 10 Canadian youth in Grades 7 to 11 had encountered explicit material inadvertently, with most saying they were between the ages of nine and 13 when it first happened.
Marcoux says while there is no perfect way to do it, verification is needed to require website operators to act more responsibly. Without that piece, he says other proposed online child protection measures could be hard to enforce.
"I think this is maybe a first step in moving towards a better system, where it will be refined over time," he said.
As a tech-savvy parent himself, Marcoux says even with parental controls, it's "impossible" to monitor a child's online activity 24/7.
"The bottom line is that the current situation — which is that children of all ages have unfettered, no-friction access to essentially the whole of the content of the internet — is a problem that we can't turn away from," he said.
ABOUT THE AUTHOR
With files from CBC News