Porn age verification is coming. But can it protect your privacy?

How users in the UK access websites with pornographic content is set to change dramatically. The Online Safety Act says that sites should make it more difficult for under-18s to view explicit content - and several adult sites have announced they will implement sophisticated age checks by July 25. Media regulator Ofcom estimates 14 million people watch online pornography - and concerns have been raised about the privacy and security implications of them having to undergo more robust identity checks.

Age verification companies, who are likely to be employed, say people should be reassured because firms don't retain data, and they don't know what a person has accessed. "The only un-hackable database is no database whatsoever," says Iain Corby, of the Age Verification Providers Association. Chelsea Jarvie, cyber security specialist, says that society must be careful to “normalise mass identification online.” There are several methods an adult website might use to check a user's age, and Ofcom has suggested seven of them. A site could allow a combination to provide consumers with choice. Let's have a look.

How it works

You enter your credit card details and a payment processor verifies the card. Age verification company Verifymy indicates that if you do this test on its service, a two-factor authentication test and a mini purchase with no money going back and forth happens, like checking into a hotel. "No personal data gets passed on to an adult platform in any way. It is simply a yes or no as to answering a question: is this individual over 18?", Andy Lulham, Verifymy's chief operating officer was quoted saying in an interview.

The 5RightsFoundation, an internet child safety charity, said credit card checks, and the photo identification and digital identity verification approaches, provided high assurance particularly where the data was properly secured, but "carry substantial privacy risks if not properly designed and managed".

Digital identity services. How it works?

They include digital identity wallets, which can store and pass on safely information which confirms your age. Omari Rodney is the head product engineer at Yoti. He explained to BBC News that once the document like a passport was checked and validated, all its sections were then removed and encrypted. Only the individual could decrypt it. "We can't view that information unless we have permission from you," he explained. Luciditi, another authentication company, said the user might elect to release a portion of their identity - that they were above 18 years old.

Jarvie, however, believes digital wallets - and open banking - "can feel disproportionate" as a way to establish that you are above 18.

Email-based age estimation

You submit your email address, and technology checks other online services in which it has been employed - for example, banks or utility companies - to make an educated guess at your age. Verifymy are among operators, and it said their research indicated this was the way that users would feel most at ease. Lulham explains the technology tests whether an email has been used to communicate with a variety of websites like banks. Verifymy said information could be stored for as long as 28 days, but added it would in most cases be shorter, would be encrypted, and no information would be passed to the site being accessed.

Facial age estimation

You reveal your face through photo or video, and technology scans it to make a guess on your age.

What are the concerns regarding privacy? A verification business would normally verify whether it is an individual, just one person, and not an image. Yoti use a model of AI to decide on an individual's age.

Although facial age estimation "can be precise", Jarvie said her work had found that many individuals would not feel at ease with this approach.

Mobile network operator age checks

You grant consent for an age-check service to check if and when age filters are in place on your mobile phone number. Yoti considers who pays the bill, and if it is an adult paying for a child's phone - i.e., on a family plan. The mobile company are requested to verify the age of the individual, but would not know what website they plan to visit. OneID, a verification company, has the user log in to their digital ID through their phone number, with the phone operator verifying if they are above 18.

Verifymy stated pay as you go numbers would not work - a phone contract would be required for users.

Open Banking

You allow the age-check service to securely access information from your bank regarding whether you are over 18. OneID employs this approach if a user is unable to confirm he or she is older than 18 through his or her mobile operator. Though OneID does not view your transactions, your sort code and account number are passed to it when it makes its one-off check - but the firm assures that it does not retain any information.

OneID's founder Rob Kotlarz accepts that users will not be keen to reveal their bank information so that they can visit an adult website. "It is the right thing to help protect children," he was quoted saying to BBC News. "We are providing a more convenient method of verifying the age of someone. If it is convenient and frictionless, then why would you not do it to help safeguard the kids?"

Photo ID matching

You take a photo of an ID document with your face and age on, and a photo of yourself at the same time. These are then matched to verify the document belongs to you. In addition to UK documents, Yoti would enable the user to upload some non-UK ones as well. Jarvie feels photo ID uploads and credit card checks "feel outdated" and "highly intrusive".