Analysis: Tech Solutions for the Age Verification Problem

LOS ANGELES—Age verification is currently one of the most hot-button topics in the adult entertainment industry. The issue has been at the center of recent public policy debates in state legislatures, among elected officials, and in circles of the left- and right-wing political elite.  While lawmakers present age verification mandates as measures to protect minors under the age of 18 years from viewing inappropriate content, there is much concern among members in the adult industry and in the technology space who view these new laws clearly as a step way too far. Louisiana became the first state in the country to implement an age-gating requirement for adults who wish to access pornography from IP addresses linked to that jurisdiction. Quickly, the adult industry and several civil society organizations criticized the age verification law and its sponsor, religious conservative Rep. Laurie Schlegel, for pushing a potentially unconstitutional law that violates the First and Fourteenth Amendments of the Constitution. Utah became the second state to follow implementing a porn age verification law that was more punitive than Louisiana’s law. Due to the severity of the Utah law, Pornhub parent company MindGeek opted to geo-block access to the major adult tube site. Soon, this became a reality in Mississippi and Virginia. The only way to visit Pornhub in these states is by using a virtual private network (VPN) application or proxy. AVN contacted MindGeek to understand their position on certain age verification methods. In an email, a spokesperson explained that their preferred method for an age verification intervention is device-based. This means that MindGeek would support age-gate mandates as long as the methods identify that the owner of a device is legally permitted to view the website and the only data that’s retained is a unique identifier or an IP address for that device. But the recently passed laws in Utah, Mississippi and Virginia don’t provide for the ability to enable device-based age verification methods, so rather than adopt an age verification method for use like in Louisiana, MindGeek took “an easy way” to comply rather than risk vulnerability. “While these new laws claim to protect children from accessing harmful material online—something we fully support—they not only fail to do this but also jeopardize user safety and privacy,” argues Pornhub in a blog post published on July 25. “There are multiple ways that a user can prove their age, but any effective method requires them to submit some form of personally identifiable information (PII).” PII includes anything as simple as government identification, credit card number, other financial information, a social security number, or medical records. All of this information is considered “sensitive” or “confidential.” There is such a thing as “non-sensitive” PII, which includes data that is accessible from public records and social media websites. But, this data could be spoofed. Regardless, Pornhub’s method of intervention and withdrawal from these states for unknown periods of time is based solely on increased information security risks and how the laws in these specific jurisdictions make it harder to not only self-regulate but comply with laws. But, that doesn’t mean Pornhub isn’t interested in solutions to blocking underaged traffic. The company’s spokesperson explained that one method is age estimation technology as a measure for verification. “So as you know, only verified users are able to upload content to Pornhub and other MindGeek platforms,” the spokesperson explained, alluding to when former leadership at MindGeek adopted a “nuclear option” to scrub its servers of unverified content and required all content uploaders to verify their age through an age verification solution offered by a company called Yoti. “This includes studio content partners and those who have been verified within the model program. Anyone seeking verification within the model program must confirm their identity with Yoti,” the rep added. “Yoti will check the validity of the ID document and match the user’s ID document to their face using secure biometric technology during a live face scan.” This is actually quite common for adult content programs across the industry. Yoti offers a set of tools to these companies that includes one of the more controversial methods for age checking, artificial intelligence-assisted age estimation, and biometric matching. Cyprus-based adult tube site xHamster also has Yoti integrated into its content creator program, as does OnlyFans. A case study written by Yoti features now-OnlyFans chief executive officer Keily Blair lauding the age verification measures adopted by the company. “We work with Yoti because their market leading age assurance technology provides the right balance between accurately assessing users’ ages and respecting their privacy,” Blair said. AVN spoke with Yoti’s chief policy and regulatory officer, Julie Dawson, to learn more about their approach.  “We offer a range of age solutions so companies can select the methods which work best for them and their users,” Dawson explained. “Our solutions balance effective and accurate age checking with privacy. Platforms should be able to offer their users a choice of options to verify their age, to ensure age checking is as inclusive as possible. Not everyone owns or has access to identity documents or credit cards, and not everyone will feel comfortable sharing this information with different websites.” Dawson added that design specifications for age verification are held to an extremely high standard that other companies and governments follow, via a standard like the Public Available Specification for Age Checking PAS1296:2018.  This standard was developed to address age verification requirements for restricted products like electronic cigarettes and other tobacco products. PAS1296:2018’s development was sponsored by the Digital Policy Alliance and the British Standards Institute. Yoti, with several other firms like British American Tobacco, contributed to the standardization procedure and collaborated on developing something that could be applied to other industries. The standard happens to address companies that sell and produce adult content and how this standard could inform age-checking for private companies and governments that require or encourage certain industries to check age. “Yoti ... provides a range of age assurance to enable companies to meet regulatory requirements,” Dawson added. “Where companies are seeking to comply with regulations that require age assurance, organizations like Yoti can support them. Yoti operates across many sectors including gaming, gambling, social media, adult, crypto, finance, retail, and employment. Our solutions deliver speed, accuracy, security, and usability.” Dawson said Yoti aims to cater to adult content consumers by minimizing data needed for a user to access particular websites, explaining, “No other personal information is shared. Some consumers prefer to use a non-document-based approach. Facial age estimation is powered by an algorithm that’s learned to estimate age in the same way humans do—by looking at faces. It estimates age from a selfie, and as soon as someone’s age is estimated, their image is deleted—protecting privacy at all times. It is accurate, easy, and quick to do.” But, does an age estimation solution actually work at the scale of millions of users? Vice News senior editor Samantha Cole tested an implementation of Yoti for adult users looking to access xHamster from Utah-based IP addresses. Cole reports that Yoti, and other third-party age verification measures, include a “cumbersome” pipeline of steps if the user isn’t comfortable with the “selfie” solution. In recreating the estimation process ourselves, we found it to be considerably accurate (but it should be noted that this author happens to have a beard). Once verified, xHamster directed us to create an account to save the age verification. It seemed to work well. The age estimation measure, Dawson explained, is also not a facial recognition tool. It relies on proprietary algorithms, deletes the image immediately, and you are able to use the site. “It is a privacy-preserving solution as people do not need to share their ID documents, name, date of birth, address, mobile phone number, or credit card information,” he concluded. “Crucially, the image used to estimate their age is always deleted, and it is not facial recognition because it does not identify anyone when it estimates age.” Still, the question looms as to whether this is a viable option for adult. Alison Boden, executive director of industry advocacy organization the Free Speech Coalition (FSC), and former CEO of adult paysite Kink.com, says that it is not in most U.S. states that have adopted age verification mandates for adult content. Boden told AVN that “six out of the seven states that have passed laws requiring age verification for adult content don't allow for the use of age estimation technologies (whether it's facial, voice, or behavioral analysis).” Indeed, a brief review of some of the laws in states like Virginia and Louisiana provides no language dealing with age estimation as a measure to comply with the mandate. In Louisiana, Pornhub integrated with LA Wallet, the state's digital wallet app for driving licenses and hunting permits. Developed by a small software company called Envoc, the app requires government identification and additional documentation. And while FSC is currently suing the state over its age-verification law, that doesn’t mean age estimation is the ideal option either. “We know these options have issues, including serious concerns among the public about how the data will be used and poor performance for individuals with darker skin tones,” Boden explained. “If the government was to permit the use of this technology, [FSC] would need to be sure that it is safe (the data is secure and isn't able to be sold or misused by the provider) and effective (independently scientifically validated). And even then, it isn't clear whether consumers will trust this technology enough to make it a real option.” A scientific study conducted by researchers at the Ben Gurion University of the Negev, in Israel, and the Western Institute for Neuroscience at Western University, in Ontario, Canada, found that age estimation artificial intelligence, while showing promise, isn’t as accurate as the companies behind the technology claim it to be. The research team, led by Dr. Melvyn A. Goodale, “tested a large sample of the prominent major AI technologies available today and found not only did they reproduce human biases in the recognition of facial age, but they exaggerated those biases.” “Our results showed AI is even less accurate and more biased than human observers when judging a person’s age—even though the overall pattern of errors and biases is similar,” Goodale said.  While these limitations continue to be studied, there is still potential for age estimation technology to be used in a broader format in the U.S. adult entertainment consumer market. Ashley Johnson, a senior policy analyst for the nonprofit Information Technology and Innovation Foundation, in April wrote in favor of implementing age estimation AI as a “less invasive” means to confirm age. Regarding companies like Yoti, Johnson contended that “the technology is not perfect, but it is accurate, particularly at providing age ranges.” But, she argued in favor of a position that is reflected by stakeholders in the industry, including MindGeek and the FSC. “Until lawmakers can ensure age verification requirements would not infringe on user privacy or bar those without government-issued identification from using online services, they should not include such requirements in child privacy and online safety laws and should instead focus on pursuing technologies that will enable easy, secure age verification,” Johnson asserted. Unfortunately, states—especially those dominated by far-right religious Republicans—have not even considered the implications of data-heavy age verification and the potential security risks. In addition to its lawsuit against Louisiana, the FSC has sued Utah, in both cases claiming violations of the First Amendment for mandating age-verification measures in order to access otherwise protected forms of sexual expression and consensual pornography.  With more such measures taking effect soon in other states, adult companies are essentially left at the whim of an incongruent patchwork of laws, and with no exact science for complying with them.