Age verification – more questions than answers – A serious look at whats happening

This excelent article is taken from the blog by feminist pornographer and activist Pandora Blake. She  has been at the fore front of the fight against censorship of allkinds. We recomend her far seeing articles to all who have an interest in the spaking and adult scenes. We support the Open Rights Group and would ask that you take a look at their website and if possibel contribute.

Since the Digital Economy Act passed in April, age verification is coming to the UK – and the government have announced a deadline of April 2018. Thanks to the combined campaigning efforts of myself and various groups, we managed to get an amendment passed which averted the worst case scenario regarding prohibited content. But with web blocking still in place as a potential sanction, and no safeguards for user privacy, the Act still represents bad news for UK internet freedom.

I’m not the only one concerned about this. The Open Rights Group are also worried about the consequences of this badly-worded new law. This month I’ve had meetings with Executive Director Jim Killock and Legal Director Myles Jackman about age verification and what we can do about it. ORG have a long history campaigning for digital rights, and I’ve been a member for over ten years. We’ll working together over the coming months to campaign on age verification and privacy, alongside my work with Backlash and as an independent voice.

I joined ORG in meeting Chris Ratcliff from the Digital Policy Alliance, the cross-party group consulting to the Government on the age verification policy, and also with a representative from the DCMS (the Department of Digital, Culture, Media and Sport – the ‘digital’ has been recently added), the branch of the civil service who are responsible for implementing it. The meetings were useful in allowing me both to make my concerns known, and ask questions to improve my understanding of the situation. Although I learned a lot, overall it seems that as far as age verification is concerned, there are still more questions than answers. 

The process of implementing AV

All websites visible by UK viewers have to have AV installed by April 2018. For a new tech policy to be implemented this is an incredibly short time frame. This problem becomes worse when it’s revealed that none of the details are yet in place that will tell people how AV is going to work, or what they need to do to comply.

The Act being passed is just the first stage; there’s now a schedule of events that need to take place before anyone can comply. Even having talked to the DCMS, made careful notes, and re-read the text of the law just now, I’m still a bit confused about exactly what the process is. But my best current understanding of the schedule is as follows:

• The DCMS provide regulations specifying the scope of the law, which need to be scrutinised in Parliament before being approved .
• The DCMS designate an age verification regulator; the choice must also be approved by both Houses of Parliament.
• The Secretary of State provides guidance to the regulator, which is laid before Parliament (but not scrutinised).
• The new regulator must produce guidelines about how it will decide financial penalties, and guidelines about what they will consider to be compliant, both subject to scrutiny by the Secretary of State and both Houses of Parliament.

This all adds up to a lengthy bureaucratic and Parliamentary process, and frankly I find it doubtful that it will be complete before the end of the year. That doesn’t leave people much time at all to comply with an April 2018 deadline.

The DCMS told me in person that the first step is for them to draw up guidance for the regulator. I can’t find reference to this in the law, unless it’s the guidance mentioned in 14 (2) specifying the “circumstances in which material is or is not to be regarded as made available on a commercial basis”.  As I understand it, the DCMS need to lay out how the regulation is going to work, what the regulator’s powers and responsibilities will be, which sites will fall under the scope of the law, and what process the regulator will have to follow in order to be in line with the law. This needs to be approved by Parliament, which is currently in its summer recess; therefore this step can’t be completed until after Parliament reopens in the Autumn.

It doesn’t make sense for the new age verification regulator to be designated until after the guidance has been approved specifying what their role will be; otherwise the regulator won’t know what they’re signing up for. The British Board of Film Classification have been tipped as the regulator-in-waiting, but they don’t have any authority until they’re officially appointed.

A lot of people have questions about how the regulation is going to be enforced and what they need to do to comply. But until the guidance has been published and the new regulator has been appointed, no-one can answer them. This is pretty inconvenient for people who are keen to crack on with implementing age verification.

These uncertainties around the regulatory guidance and the identity of the regulator are massive obstacles when it comes to figuring out how age verification is going to work in practice. It’s absolutely ludicrous that people are expected to comply with age verification by next April when there are still months of bureaucracy ahead before we know exactly what will be considered compliant. Installing age verification on a website is not an overnight process: many site owners are going to have to overhaul their websites considerably, moving all material classifiable as 18 or above  behind age checks, shopping around for the best and most affordable age verification solutions (which is tricky when very few age verification systems have been launched yet, and most are still in development), and installing the requisite software. All of it is going to take time, effort and money. And yet, we might only find out what’s required a couple of months before the deadline.

Sites which install age verification systems which the regulator doesn’t consider compliant will be penalised just as badly as sites which don’t bother to install AV at all – making it all the more important that this information is published in time.

The notification process, sanctions and penalties

The law has a whole section on financial penalties, and yet I had it from the DCMS in person during our meeting that there are “no plans to give the regulator the power to issue fines”. Seemingly this is because the BBFC don’t have the experience or resources to apply fines, and it doesn’t  look like a second “enforcement regulator” (as was mooted during the Parliamentary debates) is going to be designated. But until the guidance has been published, we can’t know for sure. This is a massive issue for UK site owners, and official, published guidance on exactly what penalties are at stake is needed as soon as possible.

It seems that the notification process will be as follows:

• The AV regulator identifies a site as falling within their scope, and classifies it to establish that the content on it would be considered 18 or higher.
• The AV regulator assesses the AV systems in place on the site, if any.
• If the site has insufficient AV in place, or if the AV used is not considered compliant by the regulator, or the regulator notifies the site owner and gives them a deadline to comply.
• If the site owner has not complied by the deadline, the regulator may contact the site’s payment services providers (eg credit card processors) to ask them to withdraw services from the site, thereby cutting off the site’s source of income. The regulator may also contact ‘ancillary service providers’ such as server hosts, domain name registrars, and advertisers who provide income to the site owner.
• Payment and ancillary service providers are not obliged by law to fulfil the regulator’s requests – whether they do so is voluntary. (This is because many of these services will be provided by overseas companies, who are not under the legal authority of the UK age verification regulator.) However, credit card companies and billing providers have previously expressed their willingness to co-operate, as it is in many of their terms and conditions that material on the sites they provide billing for must be legal in their country of origin.
• If these measures fail, the regulator may notify any UK Internet Service Provider and require them to prevent UK internet users from accessing the non-compliant website(eg by adding the site to a block list). The ISP has a duty to fulfil this requirement which is enforceable in civil proceedings.
• Even if AV is in place, if the site contains any extreme pornographic material, the regulator may contact ISPs and require them to block the site.

With web blocking looming large as a sanction, and no information yet available about how to comply, this is a pretty worrying situation for most website owners. A lot of people are asking me what they need to do to stay within the law, and not only can I not answer those questions, no-one else can either – at least not until the regulator has been appointed and the requisite guidance has been produced.

Proportionality

The Act gives the regulator a fair amount of discretion in how it goes about enforcing age verification. For example, section 26 (1) of Part 3:

The age-verification regulator may, if it thinks fit, choose to exercise its powers […] principally in relation to persons who, in the age-verification regulator’s opinion—

(a) make pornographic material or extreme pornographic material available on the internet on a commercial basis to a large number of persons, or a large number of persons under the age of 18, in the United Kingdom; or

(b) generate a large amount of turnover by doing so.

How many websites will the AV regulator include in their scope? The BBFC only have a few staff members available to regulate online porn. In order to regulate each website, they first need to classify it to determine whether it “makes material available which would be classified as 18 or higher”. The BBFC need to analyse each site to determine not only its commercial status, but also how they would classify it before they know whether it falls under their jurisdiction or not. This is no small task.

Perhaps as a result of these limited resources, the chief executive of the BBFC, David Austin, has said that only tens of sites would be targeted:

“We would start with the top 50 and work our way through those, but we would not stop there. We would look to get new data every quarter, for example. As you say, sites will come in and out of popularity. We will keep up to date and focus on those most popular sites for children.”

Given their small taskforce, it would seem sensible for the BBFC to prioritise, and start with the sites which are demonstrably most visited by under 18s. But there’s nothing in the law to compel the AV regulator to take this proportionate approach. The previous online porn regulator, ATVOD, certainly didn’t; they seemed to disproportionately target femdom sites, particularly those owned by people critical of the organisation, regardless of how few under-18s were accessing those sites.

The Open Rights Group submitted a Freedom of Information request to see the correspondence between Mindgeek and the BBFC, which showed that Mindgeek have been putting pressure on BBFC via private emails to regulate all the four million sites on Sky’s adult content block list, and block any sites that are non-compliant by the deadline by default. It would be great for Mindgeek if every other adult site on the web were regulated, because their tube sites almost certainly will be, and they don’t want to be the only ones. Blocking the competition is an easy way to increase market dominance. Under the ATVOD regime there were noted examples of site owners reporting their competitor’s websites so that their competitor would get regulated and they wouldn’t, giving themselves a business advantage. If this kind of game-playing was permitted by the AV regulator, it would be an unjust and ineffective implementation of the law.

Mindgeek’s request sounds silly because it is. There’s no way they can co-opt the UK AV regulator to block the entire adult internet. Smaller sites which don’t rely on a known brand URL can easily change domain names and IP address to avoid detection, or setting up multiple mirrors. New sites start up every day, and catching them all is a Pokémon game the regulator can’t win.

With web blocking on the table, the stakes are high. I know first hand how damaging it is to have your business taken offline. Even after winning my appeal, the harm caused by a ten month downtime was not survivable. One of the conditions for appointing an AV regulator is that arrangements for appeals must be in place, and handled by a person “sufficiently independent of the age-verification regulator”. So that, too, needs to be pinned down before the regulator can be appointed; until then, we don’t know who will be handling appeals or how they will work.

I’m fear that we might end up in a situation where small business owners acting in good faith try to comply, but perhaps misunderstand the rules or don’t implement them in the right way – maybe simply don’t have the technical know-how to do it, or the money to afford someone to help them. Without guidance enforcing a proportionate approach, we risk these sites getting blocked; while other site owners who are being savvy and conniving get away with avoiding regulation, even if their sites are easier to find, and more accessed by under-18s.

There is a chance to prevent this. If the DCMS were to produce guidance that requires the regulator to take a proportionate response, and focus their attention on the most visited websites most accessed by under-18s in order to have the most impact, that would improve matters a lot. My meeting with the DCMS reassured me that they understand these concerns, but it’s now up to them to produce some sensible guidance.

Tags. age verification, AVMS, BBFC, censorship, DCMS, Digital Economy Act, Digital Economy Bill, Digital Policy Alliance, digital rights, Mindgeek, obscenity, Ofcom, Open Rights Group, porn, porn law