The effects that early access to porn has on minors are worrying in more and more countries. France, Germany and the United Kingdom have implemented age verification systems to access this content. In the United States, eight states have already done so, and several more are considering it. The Government of Spain is preparing its own tool, which should be ready by the end of summer, according to what the Minister of Digital Transformation and Public Service, José Luis Escrivá, told EL PAÍS.
There is a certain international consensus around delaying the age of initiation of young people into online porn, which in Spain is on average eight years old, according to the Spanish Data Protection Agency (AEPD). What is not so clear is how to do it. The great fear of many privacy experts is that these systems will end the digital anonymity of Internet users. They have reason to be suspicious, as these mechanisms often handle personal data, which in turn offers the opportunity to hack such sensitive information to then extort users. “Age verification systems are surveillance systems,” concludes without half measures the Electronic Frontier Foundation, an international reference institution in the protection of digital freedoms.
What techniques are being used to verify that whoever tries to access pornographic content is of legal age? There are three main ways to do it. The first is that the website with material for adults asks the user for a credit card, which usually implies that the card holder is an adult. The second consists of requesting the identity card, which must be verified manually or using artificial intelligence (AI). The third option is to use an automatic facial recognition system. In all three cases, the user must share sensitive data.
There is a fourth way. The National Commission for Informatics and Liberties (CNIL), the French equivalent of the AEPD, has been testing an online age verification system that is more respectful of privacy since 2023. Its strategy consists of putting a digital intermediary (a program) between the age verification service and the website to which you want to apply that filter. The idea is that the system does not have access to data that identifies the user and that the verifier does not know which website the user is accessing.
“They won’t know anything about you, other than that you are of legal age and that someone is asking them to verify your age,” emphasizes Olivier Blazy, a computer scientist and professor at the École Polytechnique, from Palaiseau, on the outskirts of Paris. Blazy has worked with the CNIL on the development of the French road. “What we are trying to demonstrate is that an age verification tool can be designed that respects the anonymity of users,” adds this specialist.
This procedure is done through the FranceConnect portal, where all French people affiliated with social security have an account. Blazy and her colleagues used it as a gateway through which to access the program they have devised. This ensures that the authorities do not know which websites the user is trying to visit (that is, which website is undergoing age verification). “When you try to access a website that requires verification, the website will send you a challenge. That challenge is done at some verification provider, which in turn gives a group signature to the user. So the destination website only receives a group signature, without user details. “It is a very basic cryptography, which has existed for 15 years, but has never been used in this context,” explains Blazy.
What will the Spanish system be like?
The Government has given little information about the Spanish age verification system. The tool “will have as its central point the standards of the European digital wallet, eIDAS2, especially those that have to do with identity protection, so that age verification is secure and anonymous,” Escrivá said in an interview with this newspaper. At the moment it is not known how this verification mechanism will be accessed – through an app? to this? Will it be integrated into another? – nor what security architecture will it have. It has also not emerged whether or not the system will resemble the French one.
The EU has also intervened in this matter. The Digital Services Regulation (DSA) affects the three largest pornographic content portals (Pornhub, XVideos and Stripchat), which are considered “very large online platforms”, having an average of 45 million monthly users. each. Among the requirements imposed by the regulations is verifying the age of users, an issue that for the moment these portals have resolved by asking them directly whether or not they are adults.
Weaknesses of existing methods
The French method presents improvements compared to the rest of the techniques. “It is relatively simple hack systems based on scanning identity documents. And its consequences can be serious for users: they can be impersonated or credits requested in their name,” explains Blazy. The implications of using facial recognition are even more serious. “Storing biometric data is always dangerous,” she points out. They unequivocally identify users, making them a sweetheart for cybercriminals.
Regarding the most used alternative—the payment of 0 euros to prove that you have a bank account—it implies that someone must save the data of those accounts and their owners. And, furthermore, it no longer works as a method of verifying age of majority, because some banks allow minors to have an account. “It also used to happen that children would take their parents’ credit cards and pretend to be them. Our method factors authentication, so it will be more difficult for them to fool the system,” explains Blazy.
The French route is not perfect either. For example, unless a VPN is used – a connection from a virtual private network – the websites accessed are left with the user’s IP, which is the identifier or license plate of the device with which it is accessed. connect. “Therefore, you are not completely anonymous,” explains Blazy, who also explains that foreigners who visit France and want to access pornographic content must open an account on FranceConnect and follow the process already described: “In total, it takes about ten minutes. It is not a lot of time, but to the users of these portals it may seem like a world.”