The Trade-offs of Mandated Age Verification
“There are no solutions. There are only trade-offs,” economist Thomas Sowell famously wrote. Like most other pieces of good advice given about the offline world, Sowell’s statement applies just as much to the digital world.
A useful new report by technology reporter Drew Harwell in The Washington Post examines the trade-offs that are inextricably intertwined with online age-verification services. Advocates of age-verification mandates believe the technology to be a near panacea for kids’ online safety issues; but as Harwell notes, it comes with significant privacy, feasibility, and constitutional concerns.
For all their claims of data deletion and robust privacy protections, verification services continue to justifiably worry privacy experts. “All these extremely sensitive pieces of information, linked to people’s faces?” Jason Kelley of the Electronic Frontier Foundation told Harwell. From a cybercriminal’s perspective, “that’s the best [treasure trove] I can imagine,” Kelley said. And besides parents who might not want their children to have to undergo a facial scan to access social media, many parents are very concerned about supplying the photos of their children that are needed to create and refine age-verification technology.
A quote from Brenda Leong (an attorney specializing in biometrics) gets at the heart of the privacy issue. “To protect them, you have to know who the children are,” Leong said. “But one of the things you want to protect about them is their privacy. And the more you learn about them, the more their privacy is at risk.” And it’s not just children – age verification would allow digital services to “learn” more about everybody. As Harwell notes, many worry that age verification could impose very large privacy risks on users of all ages, who would find themselves force to give up substantial amounts of personal data simply to access basic online services.
Accuracy remains another substantial problem. Industry-standard age-verifiers have progressed to the point at which they can estimate a user’s age within three years, but they continue to have problems being maximally accurate when verifying members of certain demographic groups, most notably females. “Those blurred results could undermine [verification services’] usefulness,” Harwell writes. “The estimators’ three-year error rates, one federal judge noted, meant that some 16-year-olds would be able to access websites that 20-year-olds could not.”
It should also be noted that digital verification services are not immune from cyber incidents. In 2024, two high-profile breaches at such services have come to light. Every company and government agency – no matter how big – is at risk of a breach; perfect cybersecurity is an illusion.
Policymakers should take heed of warnings about the dangers of age-verification mandates. Acting first and asking questions later too often results in the wrong person being affected. Protecting children online is a noble goal, but it must be accomplished without destroying the privacy and cybersecurity of Americans of all ages.
Published on August 28, 2024