Online Safety Act: Age assurance industry must be regulated

• ORG joins Age Verification Providers Association in calling for higher standards for age assurance and more clarity about when it should be used.
• Online Safety Act is forcing public to use unregulated age assurance services.
• MPs are due to discuss Online Safety Act on Mon Dec 15 after more than 550,000 people petitioned Parliament to repeal the law.

Open Rights Group has written to the Secretary of State for Science, Innovation and Technology, Liz Kendall MP calling for regulation of age assurance providers operating under the Online Safety Act. The letter has also been signed by Age Verification Providers Association (AVPA) and over 600 members of the public.

Regulate age verification

Since July, many online platforms have forced their users to verify their age as part of their obligations under the Online Safety Act. These are not just pornography websites but also dating apps, social media platforms such as BlueSky and Reddit, streaming services such as Spotify, and Xbox gaming services.

It is platforms, not users, that decide which age verification providers are use. They have an incentive to choose cheaper and less secure vendors, mainly located in the US, with varying quality of data protection practices. Some less reputable providers may also choose to collect more data than necessary in order to profit from it.

ORG is asking the Government, ICO, and Ofcom to establish compulsory privacy and security standards for these providers to ensure that users’ sensitive data is protected.

James Baker, Platform Power Programme Manager at ORG, said:

“As a result of the Online Safety Act adults in the UK are being asked to share sensitive data to access social media sites, dating apps, and online gaming.

“Platforms choose which provider to use, and the public has to hope they can be trusted. Regulation would at least give some reassurance that our data is in safe hands.”

The call for regulation is supported by the Age Verification Providers Association (AVPA). Iain Corby, their Executive Director said:

“We’ve implemented self-regulation – a code of conduct, international standards, audit and certification – but agree more should be done officially too.”

In October, 70,000 IDs of Discord users were leaked, demonstrating the potential risks from age assurance.¹ All processes around age assurance need to be secure, including any customer service support put in place to deal with people who experience problems when trying to verify their age.

Regulate the age assurance industry

Read the letter

On Monday December 15, MPs will debate the Online Safety Act after 550,000 people signed a petition calling for it to be repealed. ORG has outlined a number of ways that the Act can be improved in a new briefing.