UK push for 'porn passes' raises privacy and data concerns

A proposal to require online providers of pornography to compel users to prove their age before allowing them to access porn has raised fears about privacy, and concerns that independent providers will suffer disproportionately.

The proposal comes from the British Board of Film Classification (BBFC), which has been appointed by the UK government to work out how to get websites to verify the age of users to make it more difficult for under-18s to view adult content. It’s part of an overhaul of the United Kingdom’s digital services mandated by the 2017 Digital Economy Act.

Under one age-verification proposal, people wanting to watch porn online will first have to visit a local store in-person, show that they’re over the age of 18 by presenting a passport or drivers license, and pay £10 (about $14) for a coupon containing a 16-digit code they can enter onto a porn site to view content.

You can edit or expand this story


The new law says that all online pornographic content providers with content available to people in the UK – even if the website is based elsewhere – will be subject to mandatory age-verification controls to “prevent access by persons under 18.” Websites that don’t comply could face fines of £250,000 or up to 5 percent of their sales (Engadget).

“Offline we do not allow children to enter a sex shop where they might see pornographic content. It’s common sense to have the same protections in place online as offline,” a BBFC spokesperson said in an email to WikiTribune.

Initially announced in July 2017, the Digital Economy Act was intended to take effect in April 2018. Implementation was delayed (Wired) to give the BBFC time to draft the guidance and allow for a three-month consultation period before the law comes into force by the end of the year.

‘Porn passes’ and personal-data security

AV Secure is one private company offering to perform face-to-face age verification with passes bought in stores. It says its “age verification card” will be available “at up to 60,000 retail stores across the UK including major supermarket chains.”

Its website says its age-verification process is “simple and secure” and “protects your identity.”

“The system has been developed to optimize protection of consumer anonymity, while at the same time satisfying the compliance requirements of age verification,” the AV Secure website says.

Discuss or suggest changes to this story


But data-security experts worry that making people provide personal details in order to access porn could jeopardize privacy and lead to data being compromised.

Jim Killock, executive director of Open Rights Group, a nonprofit organization of data rights experts promoting free speech, privacy and data protection, said there would not be guaranteed privacy with the proposed plan.

He said his group so far doesn’t know how the system will work in practice, but so-called “porn passes” will “use a cookie to identify you” once you log into a site. This could lead to log leaks that contain information linking back to devices, homes, or workplaces.

A photo of somebody typing on a laptop
“Porn passes” are the “most privacy-friendly solution” to age verification, says obscenity and pornography lawyer Myles Jackman. “But it is not invulnerable and it does depend who’s going to use it.” Photo by: Startup Stock Photos

“These may be easy to then identify someone,” he told WikiTribune. “That also leads to the potential for businesses to try monetizing that data, through profiling and selling advertising based on porn habits.”

While users would technically be anonymous online, making users buy “porn passes” would also put the onus on the user to pay more for privacy, according to Open Rights Group.

Other alternatives ‘less secure’

Despite potential problems, however, porn passes could be more privacy-friendly than other models of age verification, said Myles Jackman, an obscenity lawyer and legal director with Open Rights Group. “The porn pass is probably the most privacy-friendly solution that we have seen, but it is not invulnerable and it does depend who’s going to use it.”

Another way to verify age could be by requiring adults to enter credit card information onto adult websites in return for access.

MindGeek, a company that owns a large number of popular adult websites, including Pornhub, RedTube, and YouPorn, has come up with a tool for age verification. Its AgeID software, which is already in place in Germany, uses “third-party age-verification companies” to authenticate the age of people signing in.

Some of the ways it identifies users is with credit card details, by mobile SMS, or passport and drivers license numbers. It’s not clear yet what form of identification will be used in line with UK law.

Websites using AgeID will prompt a user to create an AgeID account with an email address and password, which AgeID says is encrypted. The company would then verify a user’s age on a third party site that sends AgeID a “pass” or “fail” result, said AgeID spokesperson James Clark in an email to WikiTribune.

Clark said users’ details are encrypted and cannot be reverse engineered to reveal the original email and password.

Know a fact to enhance this story? You can edit it


“This is something we have spent a lot of time developing, as we completely understand how important privacy is to our users … AgeID is uniquely built on the principles of privacy by design and data minimization,” said Clark.

But a requirement to supply personal information brings huge privacy and security risks, and could lead to a database of user information vulnerable to a breach, said Jackman.

Jackman drew comparisons to the 2015 Ashley Madison adultery dating website breach, in which more than 25 gigabytes of user data, including account details and credit card transactions, were leaked.

Jackman said the proposed age-verification solutions cannot provide enough security and are “highly likely” to be breached.

“There is a huge risk of a leak of up to 20 to 25 million people’s private sexual preferences, and that is almost certainly going to lead to suicides,” he said, adding that a leak could be particularly damaging to people who work with children.

The penalties to be levied on companies that breach security regulations aren’t adequate, said Jackman.

“Once someone’s committed suicide, it’s really too late. … The Ashley Madison hack led to suicides and that was proportionally smaller than 25 million adults in the UK [who watch porn].”

But the new law’s focus is on children, specifically the government’s commitment to “make the UK the safest place in the world for children to be online,” the BBFC said in an email to WikiTribune. “It will mean that young children can no longer stumble across commercial pornographic websites.”

Age verification ‘a distraction’

Former prime minister David Cameron first suggested making porn more difficult for children to access in a 2013 speech to the UK’s National Society for the Prevention of Cruelty to Children, in which he promised to protect children from such online content.

But age verification is not a proportionate response to protecting children from sexual content, and the regulator would not be able to guarantee privacy for users, privacy experts and porn makers have said in response to the BBFC’s proposal.

Open Rights Group’s Jackman and porn filmmaker and performer Pandora Blake said in a joint response (PDF) that there is a lack of credible evidence supporting the effectiveness of age-verification checks. Their response said the checks would have a disproportionate effect on low-traffic porn sites and independent sex workers who cannot cover the costs of installing age-verification tools.

They also said age verification “is a distraction from the real issues.”

“To truly protect young people, compulsory sex education, provided by independent experts rather than untrained teachers, needs to be funded and supported by the government,” the response said.

Their response also said the Digital Economy Act creates a market for age-verification technology that is “completely unregulated” because it lacks compulsory privacy safeguards and incentives for large-scale porn websites to minimize data collecting.

Something missing from the story? Say so


Even the European Union’s incoming General Data Protection Regulation (GDPR) isn’t necessarily enough to keep people’s data safe during the checks.

“The intimate characteristics that age verification would be holding are so private, that there needs to be an extra level of privacy protection on top of GDPR,” said Jackman.

But in an email statement to WikiTribune, David Austin OBE, the BBFC’s chief executive, said age-verification will be “simpler than people think.”

“And it’s nothing new,” Austin said. “It has been in use for several years in a number of settings, including for UK hosted VoD [“video on demand”] pornography.

“People can expect to see a choice of age-verification options, typically from third party providers, so there’s no need to share any personal data with a pornography website. An adult website need only receive a ‘yes’ or ‘no’ to confirm the results of the age check. There is no need for the age-verification provider to pass on any personal details to a pornographic website nor to store any personal data.”

Newsagents could again be gateway to adult content

Historically conservative Britain may be coming full circle. The top shelf of the local corner shop was once the only place to buy adult content until online porn overhauled the industry. These shops may once again serve as the hub of access to porn.

Jackman compared the porn pass procedure to people presenting documentation of legal age in shops, “like you’re buying booze.”

A spokesperson for the Department for Digital, Culture, Media & Sport, the government body in charge of the new legislation, told WikiTribune in an email:

“The regulator (BBFC) has been clear that there is no need for age-verification providers to pass on any personal details to a pornographic website nor to store any user data. We are in the process of implementing some of the strictest data protection laws in the world.

“A wide variety of online age verification solutions exist, or are in development, and they will have to abide by these high standards. We expect data security to be a high priority in the BBFC’s guidance on age verification arrangements.”

WikiTribune is waiting for a statement from the National Federation of Retail Newsagents, an association representing more than 15,000 independent retailers across the UK and Ireland, to hear its view on the proposals.

We’re also waiting to hear from Mindgeek and AV Secure to learn more about their proposed solutions to age verification.

Discuss or suggest changes to this story


Image information

  • TODO tags

      Is there a problem with this article? [Join] today to let people know and help build the news.
      • Share

      Subscribe to our newsletter

      Be the first to collaborate on our developing articles

      WikiTribune Open menu Close Search Like Back Next Open menu Close menu Play video RSS Feed Share on Facebook Share on Twitter Share on Reddit Follow us on Instagram Follow us on Youtube Connect with us on Linkedin Connect with us on Discord Email us