Control or privacy: the "challenge" of age verification on the internet

BarcelonaThe historic trial against Meta, the parent company of Facebook and Instagram, for the pernicious effects of its social networks on children and adolescents, forces the debate on young people's access to social networks to be reopened. The Spanish state is already studying a regulation to oblige digital platforms to establish effective controls to ban minors under 16 years of age; a proposal that the Minister of Youth and Childhood, Sira Rego, hopes will be approved after the holidays, according to statements made in a recent interview with the Europa Press agency. Spain would join a movement led by Australia, which banned access to networks for minors under 15 years of age in December. France also aspired to join the trend; although its law, which was to come into effect on September 1, was overturned by the Constitutional Council, alleging that the prohibition "did not provide the necessary legal safeguards to guarantee the right to respect for private life." The body also observed a clear conflict with the freedom of expression of the affected users.

The French case has demonstrated the difficulties that platforms would encounter in applying a balanced ban on minors' access to social networks. Indeed, Meta claimed in a recent statement that the 29 states that have brought it before the Oakland court want to attribute "a challenge that the entire industry faces," namely age verification. In the words of José María Fachado, technical director of the Catalan company i3e, "there are age control tools, but they clash with legal limits." "The technical challenge is to implement a control that is not intrusive," argues the expert, in conversation with ARA.

It should be noted that existing regulations, such as the Australian one, leave the tools used to recognize users' ages in the hands of the platforms; and only stipulate that "they must function in accordance with regulatory requirements in terms of privacy and digital rights." Some of the most recurring, according to Fachado, would be age recognition by AI, or identification with official documents. However, these are tools that present numerous problems in the face of European data protection regulations, as "unnecessary user data is granted to a private platform," in the expert's words.

The most favorable alternative, according to César Córcoles, a professor in the UOC's computer science, multimedia, and telecommunications studies, would be digital certificates issued by the administration, such as the age verification app announced by the EU in April. "You can mandate the use of a certificate that, without offering any further data, simply returns a response to the platform about whether the user is of legal age" at the time of account creation, the expert tells this newspaper. In other words, a public digital tool that holds all the user's data; but does not hand it over to the platform, and simply identifies whether the user meets the minimum age requirement, without providing further information.

According to the European Commission's digital strategy, this solution "preserves privacy, is easy to use, and is fully interoperable with future European Union digital identity wallets." As Fachado recalls, a public-rooted tool of this kind would be the only viable alternative in the EU, given that "only administrations can store users' personal data" such as would be necessary to apply age control measures.

The limits of control

Age control tools, in other words, have clear limitations; and the experts consulted point out that it will be complicated to continuously monitor the ban, even with applications such as these public certificates. Australia is, in fact, the clearest example: according to a study by the eSafety Commission, the Australian independent online safety regulator, the ban for minors has been far from meeting its objectives. According to the report, published at the end of July, more than 80% of young people under 15 consulted continued to use one of the blocked platforms.

It should be said that, according to the Australian government's report, a large part of the failure came from the social platforms themselves, which would not be correctly applying age controls. In fact, more than half of the minors surveyed by the regulator stated that the controlled social networks had not yet requested any age confirmation three months after the measure came into force. "In the absence of effective age control processes, many children have simply kept their accounts," laments the public document. It should be said that there are processes that do not request age verification from the user, such as the analysis of usage patterns, which studies the consumption trends of an account and uses them to determine the consumer's age. However, they do not seem to be serving to prevent minors' access to social networks.

In Córcoles's opinion, this failure demonstrates the technical limitations of many age verification methods, such as biometric verification or age estimation from a user's image. These types of tools, the expert resolves, "make quite gross errors," and can easily let underage users pass; or prevent others who are above the regulatory threshold from accessing social networks. In this regard, he considers that "from a technical point of view, the mechanisms we have involve a certain loss of privacy, and are not very effective." 

Regarding the age verification tool proposed by the EU, the professor of computer studies at the UOC points out the social accessibility problems this measure could have: requiring digital certificates to create any online account could exclude the elderly, who have more digital literacy problems. Also, people in irregular situations, or homeless people. "Anyone who does not have this certificate would be expelled from the entire digital world," laments the lecturer. In this regard, returning to the trial of Meta, he focuses on the control of the networks themselves, and on the addictive and harmful dynamics that are currently being judged in California: "perhaps, instead of preventing minors from accessing, it should be ensured that platforms stop being toxic for everyone," he concludes.