States’ online age verification requirements may bear more risks than benefits, report says

Some state age verification requirements designed to keep underage users from accessing “adult” content online may bear more risks than benefits, according to a report released Tuesday.

The report, titled “Age Verification: The Complicated Effort to Protect Youth Online,” authored by researchers from the Open Technology Institute at the think tank New America, evaluates state and federal efforts to mandate age verification processes. Several states have passed or are aiming to pass the regulations with the goal of keeping kids safe online. But, the report claims, the technical feasibility and legal vagueness of the age verification process could unintentionally harm the youth it aims to protect.

In 2022, Louisiana became the first state to mandate age verification with the passage of a law that requires adult websites to introduce “reasonable age verification methods” or be held liable for distributing harmful material to minors. One method of verification allows users to verify their ages with government-issued digital IDs.

Age verification is now the standard in numerous states, including Arkansas, Mississippi, Montana, North Carolina, Texas and Virginia. In Utah and Connecticut, more targeted laws require social media users to verify their ages. A First Amendment group sued Utah in January, arguing that limits on social media will have a chilling effect on free speech.

Prem Trivedi, Open Technology Institute’s policy director, said concerns of free speech, data privacy and security were the impetuses for the report.

“I think the first objective we had in this report is just to equip policymakers and the interested public with a better technical understanding of what age verification entails, what the trade-offs and challenges are to implementing different AV solutions,” Trivedi said. “There’s there’s no one AV solution. And I think our table in our report tries to lay out a whole range of practices.”

Some age verification methods explored in the report include facial age estimation, which uses artificial intelligence to analyze the geometry of a user’s face in a still or live photo. Other methods included submitting a government-issued ID, credit card or live photo.

There is no method yet for social media companies and other online services to confirm user age without requiring additional sensitive data, such as biometrics. The report highlights the inability of these technologies to verify age in a private and secure manner, especially at the large scale required by most social media platforms. Researchers looked at studies from Australia and France and found that the age verification methods are “too immature” to work effectively while balancing user privacy and security.

“I think most [lawmakers] are just well-intentioned in their efforts to say, ‘We’ve got to do something to protect kids online.’ This is an urgent imperative that we all, including the OTI, feel. But then the question is like, what do we do?” Trivedi said.

While the intention of some state lawmakers may only be to apply these restrictions to specific content or to users of a certain age, the impact of broad and vague age verification legislation — such as legal challenges to what constitutes “adult content” — could be broad as well, Trivedi said.

“Platforms might decide that to comply with age verification requirements, the easiest thing to do is simply to cut off access to certain types of information to the whole population, because they may not be confident in their ability to do it on an age grouping basis,” Trivedi said, adding that this end result might hurt already disadvantaged groups seeking access to politicized content online, such as LGBTQ populations or at-risk youth.

But Trivedi said there is a path to implement age verification requirements in a way that respects privacy and security needs. One method highlighted by the report is to use a trusted intermediary for age verification on social media platforms. Allowing a third party to conduct the process lowers the risk of having unnecessary data shared online, Trivedi said.

Still, the report suggests that age verification is not a “fool proof” process and additional controls will still be needed. Researchers recommended lawmakers emphasize efforts that would increase awareness of youth online safety measures and better parental controls. They also suggest technologists build privacy and security into the design of any age verification processes and that governments play a role in determining the standard of age verification and identification online, such as the availability of digital IDs or exploring alternative age verification processes for people who lack traditional identification.

“But even if perfectly implemented, is age verification going to solve all the ills that, in some conversations, people are suggesting that it will?” Trivedi said. “It’s absolutely worth engaging with and understanding the trade-offs, thinking about whether we can do the research to make age verification even more robust from a reliability but also a security and privacy perspective and a broader civil liberties perspective.”