Privacy Preserving Access to Age-Gated Adult Pornography


Screen Shot 2015-04-04 at 16.30.55

One of the longest standing online child safety issues for parents, businesses, regulators and governments relates to concerns about the ease with which children and young people can access adult rated content, in particular, pornography online.

A number of years ago there were concerns about young people accessing online gambling sites . In response to these concerns the Gambling Act 2005 requires online gambling operators to verify that their customers are 18+ years of age. To ensure gambling operators comply with this legal requirement the annual renewal of a gambling operators licence depends, in part, on the effectiveness of the age verification checks they conduct. The gambling sector illustrates how online age verification measures are effective in protecting children and young people from harm.

Addressing Cost Concerns

For those sectors with thinner profit margins than gambling operators the current costs associated with age verification are still deemed prohibitive and so there is little incentive, from a profit perspective, for those online businesses that sell age-restricted products and services, to comply when costs are so high. Under such circumstances regulators have little choice but to allow for degrees of latitude for many online businesses with respect to compliance with legal and policy requirements of age verification legislation. Such a situation translates to disparities between the measures put in place to protect children from accessing age-restricted products offline and online.

Erosion of Privacy concerns

One of the major concerns that people have about online age verification mechanisms being applied to adult content is the assumption that it will necessitate an erosion of privacy. Legal requirements stipulate the degree to which an online provider must know details of the identity of their customers. ATVOD’s Rule 11 requires UK based adult content providers to know whether a customer is over or under 18 years of age, it does not require providers to verify the full identity of the person accessing an adult site. Age is simply one attribute of an internet user’s identity and age verification mechanisms can and do operate on the basis of partial anonymity. It is sufficient for the adult content provider to trust a response ‘Yes, this person is 18+ years old’ or “No this person is not 18+ years of age’ supplied by an Authoritative Source, which does know the person’s identity. In effect, age verification processes preserve users’ privacy by ensuring that the minimal amount of identity data is disclosed to adult content providers.

This approach is operational in countries such as Iceland, and Finland where mobile signatures enable anonymous age verification. Furthermore the architecture of the Cabinet Office’s Identity Assurance Hub enables the  exchange of attributes, including age, in the manner described above.  Typically, legal, business and policy rules that govern attribute exchange are defined in a Trust Framework and in the case of partially anonymous age verification this will mean that the Authoritative Sources, operating in concert with an identity hub, will not have specific knowledge of which websites requested details with respect to the age band to which an individual belongs. In effect, fears that internet users’ privacy will be compromised based on age verification mechanisms are unfounded.

The Role of the Digital Policy Alliance in Age Verification

The Digital Policy Alliance (DPA) is the politically neutral, cross-party policy voice of the Internet and technology sector and late last year it set up an Age Verification Group. This group has gained support from a number of regulated sectors, which have agreed to work together under the umbrella of the DPA in order to agree a common set of standards with respect to age verification. These sectors include adult content providers, and the industry chair of the DPA’s Age Verification Group is Chris Ratcliff, a representative of the adult industry and chair of the Adult Provider Network.

The Authority for Television On Demand (ATVOD) is the independent co-regulator for the editorial content of UK video on demand services. Since 2010, ATVOD  required UK based adult content producers to deploy age verification solutions and many providers rely on a customer’s use of a credit card as proof of age. However, ATVOD’s rules only apply to UK based adult content providers and so these measures, which have been designed to protect children and young people, do not restrict children and young people in the UK accessing free-to-view adult content sites that are based outside of the UK.

Support of .xxx .adult .porn

 ICM is a global domain name registry operator, approved by ICANN for the purpose of initiating and maintaining a database of domain names within the .XXX Top Level Domain (TLD). As operator of the registry, ICM manages the domain name database and overall policies for the .xxx, .adult and .porn. ICM Registry is a member of the Digital Policy Alliance’s Age Verification Group and are committed to addressing the need for online age verification. This means that the work that the Digital Policy Alliance is undertaking has the potential to extend age verification measures beyond UK based adult content producers, which would have a significant impact on the accessibility of adult content to children and young people living in the UK.

Other sectors involved

In addition to adult content providers representatives of the online dating, gambling and e-cigarettes sectors are also involved in the Digital Policy Alliance’s Age Verification Group. A number of other sectors are expected to become more involved in this initiative, including retailers, alcohol and Internet Service Providers. It is time for social networking platforms, data aggregators, advertisers and others to re-visit their approaches to age verification, not just to ensure that they comply with legislation designed to protect children on-line, but also to facilitate the confident use of on-line services by all age groups.

Building on the principles of ‘verify once, use many times’, the DPA Age Verification Group is also working together with a number of identity and attribute providers. The aim of the collaboration is to develop cost effective, privacy preserving and scalable age verification solutions that meet the requirements of a number of sectors. These solutions aim to remove the barriers that have prevented a mirroring online of the measures put in place in the real world.

Why there is no time like the present – Establishing an Age Verification Standard with the British Standards Institute (BSI)

There is a significant opportunity for the UK’s next government to support the Digital Policy Alliance’s initiative that also aims to develop a British Standards Institution (BSI) Age Verification standard. The new standard will have the effect of bringing about an important step change in favour of protecting children online, meeting legal and business requirements in ways which are both cost effective and privacy preserving. A subsequent step will be to ensure the British standard becomes an internationally recognised standard (ISO), supported by certification programmes that define liability models.

The DPA is grappling with issues, which are a concern to every parent in the UK and the Tories have stated their support for this initiative. In the run up to election if there is one question you should take the opportunity to pose to prospective candidates who come to your door it is: what are you going to do to support efforts to protect children online?  

There are a number of groups and lobbyists that obstruct efforts to develop cost effective, privacy preserving age verification measures. However, the UK has set the benchmark with respect to protecting children from the risk of harm associated with becoming involved in gambling and the opportunity exists to do the same with respect to online pornography.


 About the Author, Dr Rachel O’Connell, is chair of the UK Council for Child Internet Safety’s Age Verification Project Group and she also leads the Digital Policy Alliance’s Age Verification Requirements Working Group. To find out more about Dr O’Connell check out:



One thought on “Privacy Preserving Access to Age-Gated Adult Pornography”

  1. The described age-verification scheme will only have limited effects as only bona fide porn websites will live up to it. It won’t do anything to the loads of freely accessible and UGC sexual explicit material one may find all over the Internet.

    Furthermore I do have my doubts on the BSI – ISO standardization route. Technology is developing fast and regular standardization processes move (very) slow. Starting from a national orientated standardization position might not work efficiently where a global issue is concerned.
    A fast-track solution could be self-regulation / standardization by industry within a multi-stakeholder, holistic approach. There are already examples whereby such a self-regulatory process resulted in co-regulation on developing Harmonized Standards (EN) by EU Standards Developing Organizations (SDO).

    Yes, I know such an approach might be contrary to the feelings of some British politicians / policymakers, but compare the outcomes of 1.5 years intensive self-regulatory discussions within the value-chain – resulting in a standardization proposal to EU SDO -, 9 months of consultation by those SDO and an European Norm (EN) to be implemented by EU member states within another year. The other way around would have taken about 5-7 years at least.


Leave a Reply

Your email address will not be published. Required fields are marked *