Robust online age verification for both children and young people wishing to access a range of products and services online, including via mobile devices, is regarded by many as essential to improving children’s safety online.
In Ireland the average age at which children start using the internet is nine. In 2014 a quarter of 13-14 year olds and 37 per cent of 15-16 year olds reported they have experienced something online that bothered them or that they wished they had not seen.
The requirements in the “real” world for age checks, including, for example, when applying for free travel passes, purchasing alcohol and cigarettes, gaining access to age-rated films, apply to both young and old, and can be achieved simply by the presentation of a photocard from a reputable organisation.
These include the iConnect card for which people aged between 12 and 17 are eligible to apply and age cards that can be obtained by individuals aged 18+ to show that they have reached the legal age to buy alcohol. In the case of the latter no record of the card owner’s details are recorded by the retailer because the legal requirement is simply to establish that a person wishing to purchase alcohol is over 18 years.
Why should an online equivalent, that also preserves privacy, be so difficult?
In fact Ireland has the capability to introduce online age verification using the personal public service (PPS) number in a manner that adheres to principles of data minimisation and privacy preservation.
Crucially, these methods enable a private company to query whether a person is in a certain age band, over 13, 18, 16 or 21 years, and it does not involve exposing a PPS number to a private company, which precludes the storing of a PPS number or even a user’s date of birth by a private company.
When there is so much concern about the ill-effects of young children being exposed online to hard core pornography and a willingness by UK-based adult-content producers to introduce online age verification, it is an opportune time for Ireland to consider the benefits and challenges associated with introducing online age verification.
Legal constraints and precedents
Crucially, use of the PPS number is governed by legislation, which precludes use of the PPS number by private companies or bodies other than in transactions with public bodies.
Important legal precedents have been set in other European countries, including Spain, Italy and Denmark, whereby effective use by the online gambling sector of government-led electronic ID schemes – equivalent to a PPS number – provide a reliable means of verifying legal majority age online.
Governments in those countries decided that preventing children and young people from accessing gambling sites was sufficiently important to change the laws governing government-issued electronic ID schemes to enable private sector companies, such as gambling operators, access to the schemes. Stringent data processing and management rules apply.
In the UK Tory ministers are committed to online child safety and in particular online age verification. Representatives of a number of sectors – adult entertainment, gambling operators, e-tailers selling age-restricted products – are involved in the Digital Policy Alliance’s Age Verification Group, and are working with identity providers to find ways to deliver online age verification.
In the UK those companies that provide access to adult entertainment online are required by the regulator ATVOD (Authority for Television on Demand) to verify the age (but not necessarily the identity) of those seeking access.
What is happening in Ireland?
The Government has enabled a scheme that issues a PPS number to Irish citizens, including children and young people.
To address privacy concerns the Department of Education and Skills consulted with the Data Protection Commissioner on the collection of individual pupil information for the primary online database. The Data Commissioner deemed that the PPS number is classified as non-sensitive personal data, similar to name and address, and can be collected by schools.
The PPS number is a unique reference number that could very easily be used to enable online age verification, in a privacy preserving manner, by gambling operators, adult entertainment sites, online dating platforms and online retailers that sell age-restricted goods.
The PPS number could also be used to enable companies running educational services and related social networks for children to age-check users.
In the UK the BBC is exploring the scope to enable online age verification on its educational platforms that may use the UK’s department for education’s pupil database via a company called GroupCall.
How would the technical platform that enables age verification operate?
In the UK the government has invested in GOV.UK Verify, which is the new way to prove who you are online so you can use government services securely.
It was recently announced that the Royal Mail and GBgroup will be using the Avoco secure trust platform to provide online identity verification as a service for the UK government programme.
The trust platform is capable of giving an online site the information it needs, i.e. the person is over or under 18 years, whilst retaining the privacy of the individual, e.g. using anonymous, but verified login and not disclosing the actual date of birth details.
An Irish company called Sedicii. com uses a patented Zero Knowledge Proof (ZKP) cryptographic login protocol that in combination with the PPS number would enable a child or young person to securely login to a website whilst, when required, also indicating the age band to which that child belongs.
This is a privacy-preserving method of authentication by which no data, other than the fact that the person wishing to access a site knows the correct login details and is over or under the age band set by the website, is shared with private companies.
Next steps
This article highlights that examples of the technical architecture required to enable age verification using PPS numbers not only exist but have also been certified and are operational in, for example, a UK context.
Moreover, policies with respect to data processing and management have been developed by a number of countries, often in partnership with privacy and consumer groups.
The PPS number provides the Irish Government with an opportunity to dramatically improve the safety of children and young people online.
To make this a reality the Government should convene a multi-stakeholder group to explore how best to deploy online age verification using the PPS number.
In addition to child protection a key driver that will inform the deliberations of such a multi-stakeholder group is the importance of protecting Irish businesses which are subject to European laws. These laws increasingly recognise that online identity and age verification are already operational in some European countries.
To address challenges such as children using adult’s PPS numbers technical measures have been developed that utilise features like device fingerprinting and delegated parental consent to limit these risks. This means that a child’s online activities are limited to particular devices and their access is allowed by parents.
However, it is always important to highlight that while no technical solution, including age verification, will substitute parental involvement in childrens’ online activities, age verification can act like a safety belt to reduce the risk of harm to a child’s wellbeing.
Dr Rachel O'Connell is an expert on Internet safety and former chief safety officer for the online social network Bebo. She is founder and CEO of TrustElevate, a technology products and services company that specialises in regulatory, policy and compliance online.
