UK’s Online Safety Act

The near-decade of review is over, and the Act is in full force – but the controversy carries on

By Anne-Frances Hutchinson

In the nine years since the UK government first proposed the Online Safety Act (The Act) in a working paper, debates have raged on about how to best protect the public from the pitfalls of our super-connected world. Finally put in force on July 25, after extensive reviews, the legislation hasn’t eased the tug o’ war between online safety advocates and online privacy groups that have some very legitimate shared concerns despite being at odds.

Passed by parliament in October 2023, the Act puts heavy-duty pressure on social media companies and search services to take responsibility for their users’ safety on their platforms. Platforms are required to be more transparent than ever about the content they allow, ostensibly giving users better control over the kinds of content they want to access.

The strongest protections in the Act have been designed for children under the age of 18, preventing them from seeing harmful or age-inappropriate content. It gives parents and children clear and accessible ways to report these potential problems.

At this point in the Fourth Industrial Revolution, the uncertainty and excitement is cranked up to 11. Because people will be people, the lightspeed progress in technology colliding with human behavior has made online environments rife with emotional, physical, intellectual, and financial dangers.

Ofcom, the independent media regulator for all methods of communication in the UK, oversees the initiative. In their guide to the Act, they stated, “As well as pornography, we expect the riskiest services to use strong age checks to protect children from suicide, self-harm and eating disorder content and other types of harmful content, while preserving adults’ rights to access legal content.”

In their briefing to users new to the Act, Ofcom provided this list of methods of digital
ID that are in use:

• Facial age estimation – a photo or video image which is then analyzed to estimate age.
• Open banking – with the user’s permission, an age-check service accesses information from the bank.
• Digital identity services – these include digital identity wallets.
• Credit card age checks – users give their credit card details and a payment processor checks if the card is valid.
• Email-based age estimation – using the email address, this approach tracks other online services, such as utility bills, to prove the user is over 18.
• Mobile network operator checks – an age-check service confirms the presence of age filters.
• Photo-ID matching – users upload an image of a document that shows face and age and an image of the user at the same time are compared to confirm the document’s owner.

While there is a clear necessity for meaningful oversight, the struggle to balance security and freedom has become more complicated than ever.

New tech, old worries

Having struggled to clearly define hard-core pornography in a 1964 obscenity case, U. S. Supreme Court Justice Potter Stewart famously said, “I know it when I see it.” UK government stats estimate that 14 million people in the UK watch online porn. Keeping kids away from it is not easy, and parents have been trying since shortly after the first naughty drawing was carved into a cave wall.

The effort to limit kids’ exposure to adult pastimes from smoking to alcohol consumption and others have failed. Age verification is progressing from the common “scout’s honor” yes or no button to advanced technology, spawning a new industry.

The non-profit Age Verification Providers Association (AVPA) represents 25 firms in the emerging “age assurance” industry. Founded in 2018, AVAP is on a fast growth track as the industry niche takes off.

According to AVAP Executive Director Iain Corby, “Age verification is convenient, accurate, cheap, privacy-preserving, secure, effective, accessible, inclusive, and enforceable.” At a 2024 privacy conference, he remarked, “We’re seeing it in Australia, where they’re going to trial age verification, the European Digital Services Act requires it, and they’ve already got a video sharing platforms directive which requires it, and in the UK there’s an Online Safety Act. And we’ve heard about many U.S. states looking at this. The Canadian government is debating it, as well.”

An article in the Washington Post pointed out the hidden difficulties of online age and identity software.  “Companies such as Yoti, Incode, and VerifyMyAge increasingly work as digital gatekeepers, asking users to record a live ‘video selfie’ on their phone or webcam, often while holding up a government ID, so AI can assess whether they’re old enough to enter,” according to the story’s author, Drew Harwell. “While the systems are promoted for safeguarding kids, they can only work by inspecting everyone – surveying faces, driver’s licenses, and other sensitive data in vast quantities.”

A 2023 NIST study, Face Analysis Technology Evaluation: Age Estimation and Verification (NIST IR 8525), evaluated the performance of six algorithms that developers provided voluntarily. Kayee Hanaoka, one of the study’s authors, wrote that there is no single standout algorithm for age assessment, “given that an algorithm’s accuracy is influenced by image quality, gender, region of birth, the age of the person in the photograph, and interactions among these factors.” Each algorithm had sensitivities with demographic groups, showing that an algorithm that performs well on certain groups can perform poorly on others. The study also found that error rates were almost always higher for female faces than for males but couldn’t find the cause.

Data privacy advocates understand that while there is the need to protect children and other vulnerable populations from manipulation, care must be taken to protect personal data. In Corby’s view, the issue of data breaches will always be an issue. “The only non-hackable database is no database at all, he said.”

True. As technology keeps up with the stunning rapidity of change, governments, regulators, and parents must move and change with them. Making that happen just may be the biggest challenge of all.